x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 1335.564347] binder: 26511:26515 transaction failed 29189/-3, size 40-16 line 3133 [ 1335.564384] binder: BINDER_SET_CONTEXT_MGR already set [ 1335.564390] binder: 26510:26513 ioctl 40046207 0 returned -16 ** 6 printk messages dropped ** [ 1335.583569] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/30 15:08:54 executing program 7: socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r0, r0, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x0, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:54 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x0, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 24 printk messages dropped ** [ 1335.649204] binder: BINDER_SET_CONTEXT_MGR already set ** 5 printk messages dropped ** [ 1335.661745] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/30 15:08:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:54 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(0xffffffffffffffff, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x0, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 11 printk messages dropped ** [ 1335.703463] binder: 26540:26546 transaction failed 29201/-22, size 40-16 line 3196 ** 5 printk messages dropped ** [ 1335.726343] binder: undelivered TRANSACTION_ERROR: 29201 [ 1335.726370] binder: send failed reply for transaction 29980, target dead [ 1335.726878] binder: undelivered TRANSACTION_ERROR: 29201 [ 1335.729045] binder_alloc: 26544: binder_alloc_buf, no vma 2018/03/30 15:08:54 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:54 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x0, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:54 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:54 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:54 executing program 7: socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r0, r0, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x0, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 1335.729062] binder: 26544:26550 transaction failed 29189/-3, size 40-16 line 3133 ** 14 printk messages dropped ** [ 1335.793881] binder_alloc: 26554: binder_alloc_buf, no vma 2018/03/30 15:08:54 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:54 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:54 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x0, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:54 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(0xffffffffffffffff, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:54 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 17 printk messages dropped ** [ 1335.800836] binder: undelivered TRANSACTION_ERROR: 29189 ** 4 printk messages dropped ** [ 1335.839465] binder: undelivered TRANSACTION_ERROR: 29189 ** 24 printk messages dropped ** [ 1335.920508] binder: undelivered TRANSACTION_ERROR: 29189 ** 9 printk messages dropped ** [ 1335.966842] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x68, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x68}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x0, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(0xffffffffffffffff, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 1 printk messages dropped ** [ 1335.994869] binder: 26605:26608 transaction failed 29189/-3, size 40-8 line 3133 [ 1335.995698] binder: BINDER_SET_CONTEXT_MGR already set [ 1335.995705] binder: 26607:26614 ioctl 40046207 0 returned -16 [ 1335.996809] binder_alloc: 26612: binder_alloc_buf, no vma [ 1335.996826] binder: 26607:26614 transaction failed 29189/-3, size 40-16 line 3133 [ 1335.996932] binder_alloc: 26612: binder_alloc_buf, no vma 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x0, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() ** 24 printk messages dropped ** [ 1336.042826] binder_alloc: 26627: binder_alloc_buf, no vma 2018/03/30 15:08:55 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x0, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, 0xffffffffffffffff, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 6 printk messages dropped ** [ 1336.068916] binder: 26636:26637 got transaction with invalid offset (0, min 24 max 40) or object. 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x0, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 29 printk messages dropped ** [ 1336.157360] binder: 26648:26655 transaction failed 29189/-3, size 40-16 line 3133 2018/03/30 15:08:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x0, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, 0xffffffffffffffff, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() ** 19 printk messages dropped ** [ 1336.200197] binder: undelivered TRANSACTION_ERROR: 29189 ** 2 printk messages dropped ** [ 1336.217578] binder: BINDER_SET_CONTEXT_MGR already set 2018/03/30 15:08:55 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(0xffffffffffffffff, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 19 printk messages dropped ** [ 1336.263753] binder: BINDER_SET_CONTEXT_MGR already set ** 3 printk messages dropped ** [ 1336.266288] binder: BINDER_SET_CONTEXT_MGR already set ** 2 printk messages dropped ** [ 1336.269550] binder: BINDER_SET_CONTEXT_MGR already set [ 1336.269557] binder: 26677:26684 ioctl 40046207 0 returned -16 2018/03/30 15:08:55 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, 0xffffffffffffffff, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x0, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 1336.271098] binder: 26677:26684 got transaction with invalid offset (0, min 24 max 40) or object. [ 1336.271131] binder: 26677:26684 transaction failed 29201/-22, size 40-16 line 3196 ** 16 printk messages dropped ** [ 1336.325720] binder_alloc: 26693: binder_alloc_buf, no vma 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x0, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x0, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, 0x0, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(0xffffffffffffffff, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 17 printk messages dropped ** [ 1336.367686] binder: 26703:26712 ioctl 40046207 0 returned -16 [ 1336.368743] binder_alloc: 26700: binder_alloc_buf, no vma ** 3 printk messages dropped ** [ 1336.371370] binder_alloc: 26700: binder_alloc_buf, no vma [ 1336.371384] binder: 26699:26711 transaction failed 29189/-3, size 40-16 line 3133 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 1336.373479] binder: BINDER_SET_CONTEXT_MGR already set ** 5 printk messages dropped ** [ 1336.383497] binder_alloc: 26700: binder_alloc_buf, no vma 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x68, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x68}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x0, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, 0x0, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 27 printk messages dropped ** [ 1336.470495] binder: 26727:26733 got transaction with invalid offset (0, min 24 max 40) or object. ** 8 printk messages dropped ** [ 1336.503643] binder: send failed reply for transaction 30114 to 26734:26736 ** 22 printk messages dropped ** [ 1336.554850] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x0, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(0xffffffffffffffff, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, 0x0, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x68, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x68}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 1336.566853] binder: undelivered TRANSACTION_ERROR: 29201 ** 1 printk messages dropped ** [ 1336.597453] binder: 26765:26771 transaction failed 29201/-22, size 40-16 line 3196 2018/03/30 15:08:55 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x0, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 38 printk messages dropped ** [ 1336.707834] binder: 26795:26800 transaction failed 29201/-22, size 40-16 line 3196 ** 24 printk messages dropped ** [ 1336.750188] binder: undelivered TRANSACTION_ERROR: 29201 ** 8 printk messages dropped ** [ 1336.766474] binder: 26812:26817 transaction failed 29201/-22, size 40-16 line 3196 [ 1336.778641] binder: undelivered TRANSACTION_ERROR: 29201 [ 1336.785912] binder: BINDER_SET_CONTEXT_MGR already set 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x0, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:55 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 1336.785920] binder: 26820:26825 ioctl 40046207 0 returned -16 [ 1336.786745] binder: release 26794:26803 transaction 30174 out, still active [ 1336.786750] binder: unexpected work type, 4, not freed [ 1336.786752] binder: undelivered TRANSACTION_COMPLETE [ 1336.786874] binder: 26820:26825 got transaction with invalid offset (0, min 24 max 40) or object. 2018/03/30 15:08:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x0, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x0, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() ** 22 printk messages dropped ** [ 1336.846620] binder: 26829:26840 transaction failed 29201/-22, size 40-16 line 3196 2018/03/30 15:08:55 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x0, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 11 printk messages dropped ** [ 1336.854193] binder: 26839:26844 transaction failed 29201/-22, size 40-16 line 3196 ** 4 printk messages dropped ** [ 1336.860946] binder: 26834:26842 transaction failed 29201/-22, size 40-16 line 3196 ** 20 printk messages dropped ** [ 1336.952765] binder: 26860:26867 transaction failed 29189/-3, size 40-16 line 3133 ** 1 printk messages dropped ** [ 1336.953980] binder: 26859:26866 ioctl 40046207 0 returned -16 ** 1 printk messages dropped ** [ 1336.954804] binder: 26859:26866 transaction failed 29189/-3, size 40-16 line 3133 [ 1336.957947] binder: BINDER_SET_CONTEXT_MGR already set 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x0, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x0, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(0xffffffffffffffff, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x0, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 1336.957953] binder: 26853:26868 ioctl 40046207 0 returned -16 [ 1336.958802] binder_alloc: 26858: binder_alloc_buf, no vma [ 1336.958909] binder: 26853:26868 transaction failed 29189/-3, size 40-16 line 3133 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x0, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x0, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x68, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x68}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 29 printk messages dropped ** [ 1337.062550] binder: 26889:26891 transaction failed 29189/-3, size 40-16 line 3133 ** 8 printk messages dropped ** [ 1337.104588] binder: BINDER_SET_CONTEXT_MGR already set ** 13 printk messages dropped ** [ 1337.112145] binder: BINDER_SET_CONTEXT_MGR already set ** 2 printk messages dropped ** [ 1337.113114] binder: 26899:26906 transaction failed 29189/-3, size 40-16 line 3133 [ 1337.117867] binder: undelivered TRANSACTION_ERROR: 29189 [ 1337.119412] binder: undelivered TRANSACTION_ERROR: 29189 [ 1337.121098] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x0, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(0xffffffffffffffff, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x0, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x68, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x68}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 1337.131624] binder: 26894:26900 got transaction with invalid offset (0, min 24 max 40) or object. [ 1337.131659] binder: 26894:26900 transaction failed 29201/-22, size 40-16 line 3196 [ 1337.140344] binder: undelivered TRANSACTION_ERROR: 29189 [ 1337.142071] binder: BINDER_SET_CONTEXT_MGR already set [ 1337.142078] binder: 26912:26919 ioctl 40046207 0 returned -16 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x0, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x0, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x0, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 21 printk messages dropped ** [ 1337.211649] binder: 26932:26936 ioctl 40046207 0 returned -16 ** 10 printk messages dropped ** [ 1337.235745] binder_alloc: 26923: binder_alloc_buf, no vma ** 5 printk messages dropped ** [ 1337.246106] binder: undelivered TRANSACTION_ERROR: 29189 ** 5 printk messages dropped ** [ 1337.249856] binder: 26945:26949 ioctl 40046207 0 returned -16 ** 1 printk messages dropped ** [ 1337.250540] binder: 26935:26946 ioctl 40046207 0 returned -16 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x28, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x28}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x0, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(0xffffffffffffffff, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x28, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x28}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 1 printk messages dropped ** [ 1337.250609] binder: 26945:26949 transaction failed 29201/-22, size 40-16 line 3196 ** 6 printk messages dropped ** [ 1337.264773] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/30 15:08:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x28, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x28}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f000026c000), &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 24 printk messages dropped ** [ 1337.360379] binder: BINDER_SET_CONTEXT_MGR already set ** 6 printk messages dropped ** [ 1337.362802] binder: BINDER_SET_CONTEXT_MGR already set 2018/03/30 15:08:56 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, 0xffffffffffffffff, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 9 printk messages dropped ** [ 1337.401016] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() ** 25 printk messages dropped ** [ 1337.463103] binder: 26995:27005 ioctl 40046207 0 returned -16 ** 13 printk messages dropped ** [ 1337.472633] binder: 27001:27006 transaction failed 29201/-22, size 40-16 line 3196 2018/03/30 15:08:56 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f000026c000), &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, 0xffffffffffffffff, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() ** 9 printk messages dropped ** [ 1337.552450] binder: BINDER_SET_CONTEXT_MGR already set ** 3 printk messages dropped ** [ 1337.553715] binder: BINDER_SET_CONTEXT_MGR already set [ 1337.553721] binder: 27017:27023 ioctl 40046207 0 returned -16 [ 1337.554695] binder: 27017:27023 got transaction with invalid offset (0, min 24 max 40) or object. 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() ** 25 printk messages dropped ** [ 1337.607179] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/30 15:08:56 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, 0xffffffffffffffff, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 12 printk messages dropped ** [ 1337.635407] binder: 27045:27048 got transaction with invalid offset (0, min 24 max 40) or object. ** 3 printk messages dropped ** [ 1337.656213] binder: undelivered TRANSACTION_ERROR: 29201 ** 1 printk messages dropped ** [ 1337.662689] binder: 27052:27057 transaction failed 29189/-3, size 40-16 line 3133 2018/03/30 15:08:56 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x68, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x68}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f000026c000), &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() [ 1337.664094] binder: undelivered TRANSACTION_COMPLETE [ 1337.664103] binder: undelivered TRANSACTION_ERROR: 29189 [ 1337.666463] binder: BINDER_SET_CONTEXT_MGR already set 2018/03/30 15:08:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x68, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x68}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 21 printk messages dropped ** [ 1337.747416] binder: 27069:27078 ioctl 40046207 0 returned -16 2018/03/30 15:08:56 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:56 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, 0x0, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x0, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x0, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:56 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 12 printk messages dropped ** [ 1337.758758] binder: BINDER_SET_CONTEXT_MGR already set [ 1337.758764] binder: 27072:27080 ioctl 40046207 0 returned -16 [ 1337.759758] binder_alloc: 27066: binder_alloc_buf, no vma ** 9 printk messages dropped ** [ 1337.792273] binder: 27087:27090 ioctl 40046207 0 returned -16 ** 13 printk messages dropped ** [ 1337.830942] binder: 27096:27098 transaction failed 29189/-3, size 40-16 line 3133 2018/03/30 15:08:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x68, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x68}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x0, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x0, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:57 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, 0x0, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 1 printk messages dropped ** [ 1337.837519] binder: undelivered TRANSACTION_ERROR: 29189 ** 1 printk messages dropped ** [ 1337.873802] binder_alloc: 27100: binder_alloc_buf, no vma [ 1337.873819] binder: 27100:27108 transaction failed 29189/-3, size 40-16 line 3133 2018/03/30 15:08:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x0, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 18 printk messages dropped ** [ 1337.892346] binder: undelivered TRANSACTION_ERROR: 29189 ** 8 printk messages dropped ** [ 1337.899530] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/30 15:08:57 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x0, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:57 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0x0, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 1 printk messages dropped ** [ 1337.924853] binder: 27118:27120 transaction failed 29189/-3, size 40-16 line 3133 ** 18 printk messages dropped ** [ 1337.987664] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/30 15:08:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x0, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:57 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:57 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0x0, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 11 printk messages dropped ** [ 1338.009035] binder: undelivered TRANSACTION_ERROR: 29189 ** 5 printk messages dropped ** [ 1338.045432] binder: undelivered TRANSACTION_ERROR: 29201 [ 1338.076685] binder: BINDER_SET_CONTEXT_MGR already set [ 1338.076691] binder: 27150:27159 ioctl 40046207 0 returned -16 2018/03/30 15:08:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x0, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 1338.077696] binder: BINDER_SET_CONTEXT_MGR already set ** 3 printk messages dropped ** [ 1338.078599] binder: 27150:27159 transaction failed 29201/-22, size 40-16 line 3196 2018/03/30 15:08:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:57 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x0, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r3, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r4 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r4, 0x8, r5) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() ** 27 printk messages dropped ** [ 1338.134256] binder: 27172:27177 got transaction with invalid offset (0, min 24 max 40) or object. ** 13 printk messages dropped ** [ 1338.200898] binder: 27185:27193 transaction failed 29189/-3, size 40-8 line 3133 ** 1 printk messages dropped ** [ 1338.201540] binder: 27184:27194 ioctl 40046207 0 returned -16 ** 22 printk messages dropped ** [ 1338.234266] binder: undelivered TRANSACTION_ERROR: 29189 [ 1338.245839] binder: BINDER_SET_CONTEXT_MGR already set 2018/03/30 15:08:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x0, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:57 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x6c, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x6c}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() 2018/03/30 15:08:57 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 1 printk messages dropped ** [ 1338.246793] binder_alloc: 27205: binder_alloc_buf, no vma [ 1338.246810] binder: 27205:27212 transaction failed 29189/-3, size 40-16 line 3133 [ 1338.246904] binder_alloc: 27205: binder_alloc_buf, no vma [ 1338.246919] binder: 27204:27211 transaction failed 29189/-3, size 40-16 line 3133 2018/03/30 15:08:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x28, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x28}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x70, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x70}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x74, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x74}, 0x1}, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, r4, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x90}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0xffffffffffffffff) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r5 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r5, 0x8, r6) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 2018/03/30 15:08:57 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000001180)='/dev/snd/seq\x00', 0x0, 0x80002) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)) dup3(r0, r0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r1, 0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setns(0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x7c, r4, 0x0, 0x70bd2c, 0x25dfdbfb, {0x5}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local={0xfe, 0x80, [], 0xaa}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}]}]}, 0x7c}, 0x1}, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x80, r5, 0xa08, 0x0, 0x25dfdbfb, {0xe}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_SERVICE={0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}]}, 0x80}, 0x1}, 0x0) rmdir(&(0x7f0000001240)='./file0\x00') setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5}, 0xc) creat(&(0x7f0000001840)='./file0\x00', 0x0) inotify_init1(0x0) acct(&(0x7f00000000c0)='./file0\x00') r6 = memfd_create(&(0x7f0000001800)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000140)=ANY=[]) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000140)=0x0) fcntl$setown(r6, 0x8, r7) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000200)) gettid() syz_open_dev$binder(&(0x7f00000016c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ** 14 printk messages dropped ** [ 1338.307019] binder: 27221:27227 transaction failed 29189/-3, size 40-8 line 3133 ** 205 printk messages dropped ** [ 1338.897594] binder: undelivered TRANSACTION_ERROR: 29189 [ 1338.899959] binder: undelivered TRANSACTION_ERROR: 29201 [ 1338.906840] binder: BINDER_SET_CONTEXT_MGR already set [ 1338.906847] binder: 27393:27396 ioctl 40046207 0 returned -16 [ 1338.907649] binder: 27393:27396 got transaction with invalid offset (0, min 24 max 40) or object. [ 1338.907677] binder: 27393:27396 transaction failed 29201/-22, size 40-16 line 3196 [ 1338.914606] binder: undelivered TRANSACTION_ERROR: 29189 [ 1338.932060] binder: BINDER_SET_CONTEXT_MGR already set [ 1338.932077] binder: 27395:27402 ioctl 40046207 0 returned -16 [ 1338.932333] binder: BINDER_SET_CONTEXT_MGR already set [ 1338.932340] binder: 27392:27405 ioctl 40046207 0 returned -16 [ 1338.932951] binder: 27395:27402 got transaction with invalid offset (0, min 24 max 40) or object. [ 1338.932982] binder: 27395:27402 transaction failed 29201/-22, size 40-16 line 3196 [ 1338.933221] binder: 27392:27405 got transaction with invalid offset (0, min 24 max 40) or object. [ 1338.933250] binder: 27392:27405 transaction failed 29201/-22, size 40-16 line 3196 [ 1338.936112] binder: BINDER_SET_CONTEXT_MGR already set [ 1338.936119] binder: 27399:27407 ioctl 40046207 0 returned -16 [ 1338.936914] binder: 27399:27407 got transaction with invalid offset (0, min 24 max 40) or object. [ 1338.936949] binder: 27399:27407 transaction failed 29201/-22, size 40-16 line 3196 [ 1338.941754] binder: BINDER_SET_CONTEXT_MGR already set [ 1338.941760] binder: 27400:27406 ioctl 40046207 0 returned -16 [ 1338.942516] binder: BINDER_SET_CONTEXT_MGR already set [ 1338.942564] binder: 27401:27408 ioctl 40046207 0 returned -16 [ 1338.943673] binder: 27401:27408 got transaction with invalid offset (0, min 24 max 40) or object. [ 1338.943703] binder: 27401:27408 transaction failed 29201/-22, size 40-16 line 3196 [ 1338.943888] binder: undelivered TRANSACTION_ERROR: 29201 [ 1338.951200] binder: undelivered TRANSACTION_ERROR: 29201 [ 1338.951228] binder: send failed reply for transaction 30535 to 27394:27404 [ 1338.952365] binder_alloc: 27382: binder_alloc_buf, no vma [ 1338.967031] binder: undelivered TRANSACTION_ERROR: 29201 [ 1338.976612] binder: 27400:27406 transaction failed 29189/-3, size 40-16 line 3133 [ 1338.978052] binder_alloc: 27412: binder_alloc_buf, no vma [ 1338.978068] binder: 27412:27419 transaction failed 29189/-3, size 40-16 line 3133 [ 1338.986886] binder: undelivered TRANSACTION_ERROR: 29189 [ 1338.991915] binder: undelivered TRANSACTION_ERROR: 29201 [ 1338.995681] binder_alloc: 27421: binder_alloc_buf, no vma [ 1338.995742] binder: 27421:27425 transaction failed 29189/-3, size 40-16 line 3133 [ 1338.998584] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.007180] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.014705] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.014713] binder: 27415:27423 ioctl 40046207 0 returned -16 [ 1339.020241] binder: undelivered TRANSACTION_COMPLETE [ 1339.020249] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.020334] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.023837] binder: 27428:27433 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.023870] binder: 27428:27433 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.026290] binder: 27415:27423 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.026323] binder: 27415:27423 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.027067] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.027075] binder: 27431:27434 ioctl 40046207 0 returned -16 [ 1339.027776] binder: 27431:27434 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.027806] binder: 27431:27434 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.034614] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.034621] binder: 27427:27432 ioctl 40046207 0 returned -16 [ 1339.036010] binder: 27427:27432 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.036041] binder: 27427:27432 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.036267] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.036273] binder: 27426:27430 ioctl 40046207 0 returned -16 [ 1339.036839] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.036942] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.037119] binder: 27426:27430 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.037148] binder: 27426:27430 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.049376] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.053707] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.069168] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.085045] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.112004] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.112011] binder: 27442:27454 ioctl 40046207 0 returned -16 [ 1339.112788] binder_alloc: 27446: binder_alloc_buf, no vma [ 1339.112803] binder: 27442:27454 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.113209] binder_alloc: 27446: binder_alloc_buf, no vma [ 1339.113297] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.113303] binder: 27444:27451 ioctl 40046207 0 returned -16 [ 1339.114247] binder: 27446:27449 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.114425] binder_alloc: 27446: binder_alloc_buf, no vma [ 1339.114441] binder: 27444:27451 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.114520] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.114527] binder: 27448:27450 ioctl 40046207 0 returned -16 [ 1339.115508] binder_alloc: 27446: binder_alloc_buf, no vma [ 1339.115525] binder: 27448:27450 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.120638] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.120644] binder: 27441:27452 ioctl 40046207 0 returned -16 [ 1339.121678] binder_alloc: 27446: binder_alloc_buf, no vma [ 1339.121693] binder: 27441:27452 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.128921] binder_alloc: 27446: binder_alloc_buf, no vma [ 1339.128937] binder: 27445:27455 transaction failed 29189/-3, size 40-8 line 3133 [ 1339.130361] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.130368] binder: 27447:27456 ioctl 40046207 0 returned -16 [ 1339.131085] binder_alloc: 27446: binder_alloc_buf, no vma [ 1339.131099] binder: 27447:27456 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.132273] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.132282] binder: 27443:27453 ioctl 40046207 0 returned -16 [ 1339.132934] binder_alloc: 27446: binder_alloc_buf, no vma [ 1339.132946] binder: 27443:27453 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.137910] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.141502] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.141526] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.144508] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.156631] binder_alloc: 27462: binder_alloc_buf, no vma [ 1339.156647] binder: 27462:27467 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.166843] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.177669] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.178834] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.186392] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.190210] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.219015] binder_alloc: 27473: binder_alloc_buf, no vma [ 1339.219031] binder: 27473:27479 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.221850] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.221856] binder: 27475:27480 ioctl 40046207 0 returned -16 [ 1339.222890] binder_alloc: 27473: binder_alloc_buf, no vma [ 1339.222907] binder: 27475:27480 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.225787] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.225794] binder: 27471:27481 ioctl 40046207 0 returned -16 [ 1339.226570] binder_alloc: 27473: binder_alloc_buf, no vma [ 1339.226587] binder: 27471:27481 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.228828] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.228835] binder: 27472:27486 ioctl 40046207 0 returned -16 [ 1339.230559] binder_alloc: 27473: binder_alloc_buf, no vma [ 1339.230576] binder: 27472:27486 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.230867] binder_alloc: 27473: binder_alloc_buf, no vma [ 1339.230881] binder: 27476:27484 transaction failed 29189/-3, size 40-8 line 3133 [ 1339.232372] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.232379] binder: 27477:27482 ioctl 40046207 0 returned -16 [ 1339.233063] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.233070] binder: 27474:27485 ioctl 40046207 0 returned -16 [ 1339.233117] binder_alloc: 27473: binder_alloc_buf, no vma [ 1339.233133] binder: 27477:27482 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.234345] binder_alloc: 27473: binder_alloc_buf, no vma [ 1339.234366] binder: 27474:27485 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.235871] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.235877] binder: 27478:27483 ioctl 40046207 0 returned -16 [ 1339.236598] binder_alloc: 27473: binder_alloc_buf, no vma [ 1339.236612] binder: 27478:27483 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.239035] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.262568] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.269467] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.280594] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.296126] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.308620] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.308747] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.312125] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.350579] binder: 27503:27505 transaction failed 29189/-22, size 40-8 line 3010 [ 1339.351375] binder_alloc: 27501: binder_alloc_buf, no vma [ 1339.351391] binder: 27501:27502 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.355925] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.368981] binder_alloc: 27504: binder_alloc_buf, no vma [ 1339.368997] binder: 27504:27507 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.376250] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.388120] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.390746] binder: 27509:27513 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.390779] binder: 27509:27513 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.401328] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.401336] binder: 27511:27515 ioctl 40046207 0 returned -16 [ 1339.402097] binder: 27511:27515 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.402127] binder: 27511:27515 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.404523] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.404530] binder: 27510:27512 ioctl 40046207 0 returned -16 [ 1339.405690] binder: 27510:27512 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.405719] binder: 27510:27512 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.411154] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.433850] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.437851] binder_alloc: 27518: binder_alloc_buf, no vma [ 1339.437867] binder: 27518:27523 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.438263] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.438270] binder: 27519:27522 ioctl 40046207 0 returned -16 [ 1339.438949] binder_alloc: 27518: binder_alloc_buf, no vma [ 1339.438964] binder: 27519:27522 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.447134] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.454447] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.459738] binder: 27520:27524 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.459822] binder: 27520:27524 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.479596] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.493641] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.519742] binder_alloc: 27529: binder_alloc_buf, no vma [ 1339.519761] binder: 27529:27534 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.528816] binder_alloc: 27529: binder_alloc_buf, no vma [ 1339.528834] binder: 27530:27535 transaction failed 29189/-3, size 40-8 line 3133 [ 1339.529459] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.529466] binder: 27531:27538 ioctl 40046207 0 returned -16 [ 1339.530337] binder_alloc: 27529: binder_alloc_buf, no vma [ 1339.530353] binder: 27531:27538 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.537290] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.541036] binder: 27533:27536 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.541070] binder: 27533:27536 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.541480] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.541486] binder: 27532:27540 ioctl 40046207 0 returned -16 [ 1339.542223] binder: 27532:27540 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.542248] binder: 27532:27540 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.549196] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.550946] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.550954] binder: 27537:27544 ioctl 40046207 0 returned -16 [ 1339.552815] binder: 27537:27544 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.552849] binder: 27537:27544 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.568950] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.568959] binder: 27541:27545 ioctl 40046207 0 returned -16 [ 1339.571043] binder: 27541:27545 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.571076] binder: 27541:27545 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.587783] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.589509] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.589515] binder: 27552:27557 ioctl 40046207 0 returned -16 [ 1339.592632] binder: 27552:27557 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.592919] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.592926] binder: 27551:27556 ioctl 40046207 0 returned -16 [ 1339.597401] binder: 27552:27557 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.600703] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.604828] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.606517] binder: 27551:27556 transaction failed 29189/-22, size 40-16 line 3010 [ 1339.606731] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.619778] binder: 27539:27543 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.619811] binder: 27539:27543 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.626361] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.628743] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.629217] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.652348] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.652355] binder: 27560:27563 ioctl 40046207 0 returned -16 [ 1339.653110] binder: 27560:27563 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.653143] binder: 27560:27563 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.658010] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.662437] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.662445] binder: 27564:27567 ioctl 40046207 0 returned -16 [ 1339.663229] binder: 27564:27567 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.663260] binder: 27564:27567 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.665565] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.676680] binder: 27566:27569 transaction failed 29189/-22, size 40-8 line 3010 [ 1339.704871] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.715780] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.741980] binder_alloc: 27576: binder_alloc_buf, no vma [ 1339.741998] binder: 27576:27578 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.742078] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.742084] binder: 27575:27581 ioctl 40046207 0 returned -16 [ 1339.742761] binder_alloc: 27576: binder_alloc_buf, no vma [ 1339.742851] binder: 27575:27581 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.744862] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.744868] binder: 27574:27579 ioctl 40046207 0 returned -16 [ 1339.745941] binder_alloc: 27576: binder_alloc_buf, no vma [ 1339.745955] binder: 27574:27579 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.758276] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.758286] binder: 27577:27584 ioctl 40046207 0 returned -16 [ 1339.758481] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.758488] binder: 27580:27585 ioctl 40046207 0 returned -16 [ 1339.759053] binder_alloc: 27576: binder_alloc_buf, no vma [ 1339.759070] binder: 27577:27584 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.759392] binder_alloc: 27576: binder_alloc_buf, no vma [ 1339.759411] binder: 27580:27585 transaction failed 29189/-3, size 40-16 line 3133 [ 1339.765092] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.766915] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.769610] binder: 27583:27587 transaction failed 29189/-22, size 40-8 line 3010 [ 1339.770946] binder: 27582:27589 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.770981] binder: 27582:27589 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.782295] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.788596] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.788604] binder: 27588:27593 ioctl 40046207 0 returned -16 [ 1339.789311] binder: 27588:27593 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.789342] binder: 27588:27593 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.808300] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.811633] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.826900] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.826906] binder: 27599:27604 ioctl 40046207 0 returned -16 [ 1339.827762] binder: 27599:27604 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.827798] binder: 27599:27604 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.829241] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.829508] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.829520] binder: 27603:27607 ioctl 40046207 0 returned -16 [ 1339.830286] binder: 27603:27607 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.830368] binder: 27603:27607 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.844047] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.849931] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.850763] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.854292] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.878441] binder: 27608:27610 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.878472] binder: 27608:27610 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.885409] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.885415] binder: 27609:27612 ioctl 40046207 0 returned -16 [ 1339.886138] binder: 27609:27612 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.886171] binder: 27609:27612 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.895051] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.895058] binder: 27611:27615 ioctl 40046207 0 returned -16 [ 1339.895811] binder: 27611:27615 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.895842] binder: 27611:27615 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.902517] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.902524] binder: 27613:27616 ioctl 40046207 0 returned -16 [ 1339.903389] binder: 27613:27616 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.903427] binder: 27613:27616 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.903724] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.916636] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.920243] binder: 27619:27620 transaction failed 29189/-22, size 40-8 line 3010 [ 1339.926319] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.943406] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.947629] binder: 27623:27624 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.947661] binder: 27623:27624 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.965022] binder: undelivered TRANSACTION_ERROR: 29189 [ 1339.965315] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.965322] binder: 27626:27632 ioctl 40046207 0 returned -16 [ 1339.965730] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.965737] binder: 27625:27629 ioctl 40046207 0 returned -16 [ 1339.966097] binder: 27626:27632 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.966130] binder: 27626:27632 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.968449] binder: 27625:27629 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.968480] binder: 27625:27629 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.974602] binder: undelivered TRANSACTION_ERROR: 29201 [ 1339.987143] binder: BINDER_SET_CONTEXT_MGR already set [ 1339.987150] binder: 27630:27633 ioctl 40046207 0 returned -16 [ 1339.989024] binder: 27630:27633 got transaction with invalid offset (0, min 24 max 40) or object. [ 1339.989058] binder: 27630:27633 transaction failed 29201/-22, size 40-16 line 3196 [ 1339.996902] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.004550] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.016452] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.024575] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.024582] binder: 27637:27640 ioctl 40046207 0 returned -16 [ 1340.025313] binder_alloc: 27642: binder_alloc_buf, no vma [ 1340.025330] binder: 27637:27640 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.025791] binder_alloc: 27642: binder_alloc_buf, no vma [ 1340.025806] binder: 27642:27643 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.026154] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.026162] binder: 27639:27641 ioctl 40046207 0 returned -16 [ 1340.026881] binder_alloc: 27642: binder_alloc_buf, no vma [ 1340.026903] binder: 27639:27641 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.031372] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.037884] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.091628] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.125250] binder: 27649:27651 transaction failed 29189/-22, size 40-8 line 3010 [ 1340.128397] binder: 27647:27652 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.128512] binder: 27647:27652 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.135577] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.135584] binder: 27648:27658 ioctl 40046207 0 returned -16 [ 1340.136469] binder: 27648:27658 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.136499] binder: 27648:27658 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.139076] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.139083] binder: 27650:27659 ioctl 40046207 0 returned -16 [ 1340.140469] binder: 27650:27659 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.140500] binder: 27650:27659 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.141667] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.141673] binder: 27653:27657 ioctl 40046207 0 returned -16 [ 1340.142499] binder: 27653:27657 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.142530] binder: 27653:27657 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.152631] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.152638] binder: 27654:27662 ioctl 40046207 0 returned -16 [ 1340.153397] binder: 27654:27662 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.154503] binder: 27654:27662 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.156154] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.156162] binder: 27655:27663 ioctl 40046207 0 returned -16 [ 1340.157228] binder: 27655:27663 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.157262] binder: 27655:27663 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.160043] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.160050] binder: 27656:27664 ioctl 40046207 0 returned -16 [ 1340.160921] binder: 27656:27664 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.160949] binder: 27656:27664 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.163406] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.166042] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.171202] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.180235] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.201828] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.211127] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.211133] binder: 27674:27677 ioctl 40046207 0 returned -16 [ 1340.211772] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.212278] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.212498] binder: 27674:27677 transaction failed 29189/-22, size 40-16 line 3010 [ 1340.231340] binder_alloc: 27675: binder_alloc_buf, no vma [ 1340.231356] binder: 27675:27681 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.234711] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.237434] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.237665] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.237671] binder: 27678:27680 ioctl 40046207 0 returned -16 [ 1340.240158] binder_alloc: 27675: binder_alloc_buf, no vma [ 1340.240175] binder: 27678:27680 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.241855] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.241862] binder: 27679:27682 ioctl 40046207 0 returned -16 [ 1340.242866] binder_alloc: 27675: binder_alloc_buf, no vma [ 1340.242883] binder: 27679:27682 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.248119] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.251550] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.262706] binder: 27683:27685 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.262742] binder: 27683:27685 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.272426] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.289529] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.289557] binder: send failed reply for transaction 30722 to 27684:27687 [ 1340.293815] binder: undelivered TRANSACTION_COMPLETE [ 1340.293822] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.319569] binder: 27691:27692 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.319597] binder: 27691:27692 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.348175] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.392353] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.392361] binder: 27696:27703 ioctl 40046207 0 returned -16 [ 1340.393107] binder_alloc: 27697: binder_alloc_buf, no vma [ 1340.393127] binder: 27697:27699 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.395729] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.395736] binder: 27695:27702 ioctl 40046207 0 returned -16 [ 1340.396680] binder_alloc: 27697: binder_alloc_buf, no vma [ 1340.396695] binder: 27696:27703 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.396783] binder_alloc: 27697: binder_alloc_buf, no vma [ 1340.396796] binder: 27695:27702 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.403129] binder_alloc: 27697: binder_alloc_buf, no vma [ 1340.403146] binder: 27698:27701 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.411592] binder_alloc: 27697: binder_alloc_buf, no vma [ 1340.411608] binder: 27700:27709 transaction failed 29189/-3, size 40-8 line 3133 [ 1340.414463] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.415461] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.422976] binder: 27704:27708 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.423009] binder: 27704:27708 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.425041] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.426781] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.426786] binder: 27706:27710 ioctl 40046207 0 returned -16 [ 1340.427516] binder: 27706:27710 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.427547] binder: 27706:27710 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.429224] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.429230] binder: 27705:27711 ioctl 40046207 0 returned -16 [ 1340.430232] binder: 27705:27711 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.430261] binder: 27705:27711 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.447835] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.461871] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.461885] binder: 27718:27722 ioctl 40046207 0 returned -16 [ 1340.462604] binder: 27718:27722 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.462638] binder: 27718:27722 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.469043] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.480400] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.487283] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.493419] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.494560] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.495438] binder: 27724:27730 transaction failed 29189/-22, size 40-16 line 3010 [ 1340.500997] binder: 27726:27729 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.501030] binder: 27726:27729 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.510618] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.510625] binder: 27728:27731 ioctl 40046207 0 returned -16 [ 1340.511525] binder: 27728:27731 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.511557] binder: 27728:27731 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.515777] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.533839] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.539750] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.542553] binder: 27735:27738 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.542588] binder: 27735:27738 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.553294] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.553301] binder: 27736:27740 ioctl 40046207 0 returned -16 [ 1340.554836] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.554844] binder: 27734:27737 ioctl 40046207 0 returned -16 [ 1340.556059] binder: 27734:27737 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.556095] binder: 27734:27737 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.556337] binder: 27736:27740 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.556366] binder: 27736:27740 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.560902] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.589657] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.593103] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.638368] binder: 27746:27753 transaction failed 29189/-22, size 40-16 line 3010 [ 1340.647234] binder: 27752:27757 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.647268] binder: 27752:27757 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.650600] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.650608] binder: 27750:27755 ioctl 40046207 0 returned -16 [ 1340.651319] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.651327] binder: 27748:27754 ioctl 40046207 0 returned -16 [ 1340.652108] binder: 27750:27755 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.652133] binder: 27750:27755 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.652201] binder: 27748:27754 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.652221] binder: 27748:27754 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.653459] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.653466] binder: 27747:27756 ioctl 40046207 0 returned -16 [ 1340.654384] binder: 27747:27756 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.654412] binder: 27747:27756 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.658696] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.658702] binder: 27751:27760 ioctl 40046207 0 returned -16 [ 1340.660648] binder: 27751:27760 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.660680] binder: 27751:27760 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.662326] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.671254] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.671262] binder: 27745:27758 ioctl 40046207 0 returned -16 [ 1340.671959] binder: 27745:27758 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.671991] binder: 27745:27758 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.677357] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.692334] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.717212] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.724479] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.728291] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.728320] binder: send failed reply for transaction 30777 to 27749:27759 [ 1340.737607] binder: undelivered TRANSACTION_COMPLETE [ 1340.737615] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.739457] binder_alloc: 27772: binder_alloc_buf, no vma [ 1340.739478] binder: 27772:27777 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.742219] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.749608] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.768108] binder_alloc: 27778: binder_alloc_buf, no vma [ 1340.768123] binder: 27778:27779 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.772308] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.799536] binder_alloc: 27781: binder_alloc_buf, no vma [ 1340.799555] binder: 27781:27786 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.807345] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.807352] binder: 27782:27787 ioctl 40046207 0 returned -16 [ 1340.809166] binder_alloc: 27781: binder_alloc_buf, no vma [ 1340.809184] binder: 27782:27787 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.813004] binder_alloc: 27781: binder_alloc_buf, no vma [ 1340.813020] binder: 27783:27789 transaction failed 29189/-3, size 40-8 line 3133 [ 1340.820701] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.820707] binder: 27788:27791 ioctl 40046207 0 returned -16 [ 1340.821365] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.821377] binder: 27784:27790 ioctl 40046207 0 returned -16 [ 1340.821398] binder_alloc: 27781: binder_alloc_buf, no vma [ 1340.821413] binder: 27788:27791 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.822334] binder_alloc: 27781: binder_alloc_buf, no vma [ 1340.822348] binder: 27784:27790 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.822548] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.828421] binder_alloc: 27793: binder_alloc_buf, no vma [ 1340.828439] binder: 27793:27796 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.828474] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.828480] binder: 27792:27795 ioctl 40046207 0 returned -16 [ 1340.829201] binder_alloc: 27793: binder_alloc_buf, no vma [ 1340.829217] binder: 27792:27795 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.830046] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.830054] binder: 27785:27794 ioctl 40046207 0 returned -16 [ 1340.830855] binder_alloc: 27793: binder_alloc_buf, no vma [ 1340.830870] binder: 27785:27794 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.845856] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.854907] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.872048] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.885432] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.890403] binder_alloc: 27809: binder_alloc_buf, no vma [ 1340.890419] binder: 27809:27813 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.893782] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.896070] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.901753] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.905917] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.910333] binder_alloc: 27815: binder_alloc_buf, no vma [ 1340.910350] binder: 27815:27818 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.916751] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.916759] binder: 27812:27816 ioctl 40046207 0 returned -16 [ 1340.917884] binder_alloc: 27815: binder_alloc_buf, no vma [ 1340.917903] binder: 27812:27816 transaction failed 29189/-3, size 40-16 line 3133 [ 1340.921569] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.924091] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.945540] binder: 27817:27819 transaction failed 29189/-22, size 40-8 line 3010 [ 1340.962027] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.962034] binder: 27821:27823 ioctl 40046207 0 returned -16 [ 1340.963298] binder: 27821:27823 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.963317] binder: 27820:27824 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.963326] binder: 27821:27823 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.963464] binder: 27820:27824 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.976540] binder: undelivered TRANSACTION_ERROR: 29189 [ 1340.981360] binder: BINDER_SET_CONTEXT_MGR already set [ 1340.981372] binder: 27825:27827 ioctl 40046207 0 returned -16 [ 1340.982133] binder: 27825:27827 got transaction with invalid offset (0, min 24 max 40) or object. [ 1340.982163] binder: 27825:27827 transaction failed 29201/-22, size 40-16 line 3196 [ 1340.993501] binder: undelivered TRANSACTION_ERROR: 29201 [ 1340.994032] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.010537] binder: 27830:27832 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.010568] binder: 27830:27832 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.016793] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.028345] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.028353] binder: 27835:27836 ioctl 40046207 0 returned -16 [ 1341.029056] binder: 27835:27836 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.029086] binder: 27835:27836 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.065452] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.068618] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.068648] binder: send failed reply for transaction 30826 to 27837:27838 [ 1341.071087] binder_alloc: 27842: binder_alloc_buf, no vma [ 1341.071103] binder: 27842:27846 transaction failed 29189/-3, size 40-16 line 3133 [ 1341.080934] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.083887] binder: 27843:27848 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.083918] binder: 27843:27848 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.090354] binder: undelivered TRANSACTION_COMPLETE [ 1341.090367] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.107100] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.107108] binder: 27849:27850 ioctl 40046207 0 returned -16 [ 1341.107949] binder: 27849:27850 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.107978] binder: 27849:27850 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.112295] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.119549] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.130557] binder_alloc: 27853: binder_alloc_buf, no vma [ 1341.130587] binder: 27853:27854 transaction failed 29189/-3, size 40-16 line 3133 [ 1341.134462] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.157442] binder: 27855:27856 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.157474] binder: 27855:27856 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.174517] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.174525] binder: 27857:27859 ioctl 40046207 0 returned -16 [ 1341.175311] binder: 27857:27859 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.175337] binder: 27857:27859 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.191412] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.204463] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.204472] binder: 27860:27863 ioctl 40046207 0 returned -16 [ 1341.205274] binder: 27860:27863 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.205307] binder: 27860:27863 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.217266] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.217296] binder: send failed reply for transaction 30847 to 27861:27865 [ 1341.217801] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.220242] binder_alloc: 27868: binder_alloc_buf, no vma [ 1341.220257] binder: 27868:27869 transaction failed 29189/-3, size 40-16 line 3133 [ 1341.224528] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.228425] binder_alloc: 27871: binder_alloc_buf, no vma [ 1341.228442] binder: 27871:27872 transaction failed 29189/-3, size 40-16 line 3133 [ 1341.233671] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.248907] binder: undelivered TRANSACTION_COMPLETE [ 1341.248915] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.271576] binder: 27875:27876 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.271609] binder: 27875:27876 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.286777] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.286784] binder: 27874:27877 ioctl 40046207 0 returned -16 [ 1341.287612] binder: 27874:27877 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.287644] binder: 27874:27877 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.315618] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.315626] binder: 27879:27885 ioctl 40046207 0 returned -16 [ 1341.316302] binder: 27879:27885 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.316330] binder: 27879:27885 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.319948] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.320712] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.326751] binder_alloc: 27881: binder_alloc_buf, no vma [ 1341.326768] binder: 27881:27882 transaction failed 29189/-3, size 40-16 line 3133 [ 1341.328148] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.341464] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.341472] binder: 27887:27888 ioctl 40046207 0 returned -16 [ 1341.342163] binder_alloc: 27881: binder_alloc_buf, no vma [ 1341.342180] binder: 27887:27888 transaction failed 29189/-3, size 40-16 line 3133 [ 1341.342229] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.353341] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.357524] binder: 27886:27889 transaction failed 29189/-22, size 40-8 line 3010 [ 1341.396538] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.401327] binder: 27892:27893 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.401358] binder: 27892:27893 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.411437] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.411444] binder: 27894:27895 ioctl 40046207 0 returned -16 [ 1341.412173] binder: 27894:27895 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.412202] binder: 27894:27895 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.427747] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.464781] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.511608] binder: 27899:27900 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.511642] binder: 27899:27900 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.513543] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.513550] binder: 27901:27902 ioctl 40046207 0 returned -16 [ 1341.514275] binder: 27901:27902 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.514305] binder: 27901:27902 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.522765] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.522773] binder: 27904:27907 ioctl 40046207 0 returned -16 [ 1341.523475] binder: 27904:27907 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.523506] binder: 27904:27907 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.541514] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.545939] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.545946] binder: 27909:27910 ioctl 40046207 0 returned -16 [ 1341.546752] binder: 27909:27910 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.546786] binder: 27909:27910 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.553399] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.560412] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.579023] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.583031] binder: 27913:27915 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.583063] binder: 27913:27915 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.591301] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.591307] binder: 27914:27918 ioctl 40046207 0 returned -16 [ 1341.592199] binder: 27914:27918 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.592232] binder: 27914:27918 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.624679] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.632239] binder: 27922:27923 transaction failed 29189/-22, size 40-8 line 3010 [ 1341.636974] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.637570] binder_alloc: 27925: binder_alloc_buf, no vma [ 1341.637588] binder: 27925:27927 transaction failed 29189/-3, size 40-16 line 3133 [ 1341.644064] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.667268] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.702851] binder: 27933:27935 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.702883] binder: 27933:27935 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.707599] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.707605] binder: 27932:27934 ioctl 40046207 0 returned -16 [ 1341.708288] binder: 27932:27934 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.708318] binder: 27932:27934 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.729978] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.729985] binder: 27937:27940 ioctl 40046207 0 returned -16 [ 1341.730699] binder: 27937:27940 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.731949] binder: 27937:27940 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.735597] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.735606] binder: 27939:27943 ioctl 40046207 0 returned -16 [ 1341.741244] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.748484] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.793063] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.819511] binder_alloc: 27948: binder_alloc_buf, no vma [ 1341.819529] binder: 27948:27949 transaction failed 29189/-3, size 40-16 line 3133 [ 1341.825533] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.841557] binder: 27947:27950 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.841587] binder: 27947:27950 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.848310] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.848319] binder: 27951:27954 ioctl 40046207 0 returned -16 [ 1341.849097] binder: 27951:27954 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.849126] binder: 27951:27954 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.849614] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.849621] binder: 27952:27956 ioctl 40046207 0 returned -16 [ 1341.850323] binder: 27952:27956 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.850360] binder: 27952:27956 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.859770] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.859777] binder: 27955:27961 ioctl 40046207 0 returned -16 [ 1341.862734] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.862741] binder: 27958:27964 ioctl 40046207 0 returned -16 [ 1341.863543] binder: 27958:27964 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.863576] binder: 27958:27964 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.869483] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.869491] binder: 27957:27965 ioctl 40046207 0 returned -16 [ 1341.869531] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.870219] binder: 27957:27965 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.870249] binder: 27957:27965 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.883747] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.892470] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.892480] binder: 27959:27966 ioctl 40046207 0 returned -16 [ 1341.893865] binder: 27959:27966 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.893896] binder: 27959:27966 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.898632] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.898662] binder: send failed reply for transaction 30923 to 27953:27962 [ 1341.913883] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.939207] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.942077] binder: undelivered TRANSACTION_COMPLETE [ 1341.942084] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.945409] binder: undelivered TRANSACTION_ERROR: 29201 [ 1341.951427] binder_alloc: 27972: binder_alloc_buf, no vma [ 1341.951447] binder: 27972:27979 transaction failed 29189/-3, size 40-16 line 3133 [ 1341.959766] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.959773] binder: 27980:27984 ioctl 40046207 0 returned -16 [ 1341.960466] binder_alloc: 27972: binder_alloc_buf, no vma [ 1341.960483] binder: 27980:27984 transaction failed 29189/-3, size 40-16 line 3133 [ 1341.965447] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.965454] binder: 27983:27988 ioctl 40046207 0 returned -16 [ 1341.965813] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.965821] binder: 27982:27986 ioctl 40046207 0 returned -16 [ 1341.966565] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.966837] binder: 27983:27988 transaction failed 29189/-22, size 40-16 line 3010 [ 1341.971214] binder: 27981:27987 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.971244] binder: 27981:27987 transaction failed 29201/-22, size 40-16 line 3196 [ 1341.984984] binder: undelivered TRANSACTION_ERROR: 29189 [ 1341.988972] binder: BINDER_SET_CONTEXT_MGR already set [ 1341.988980] binder: 27989:27991 ioctl 40046207 0 returned -16 [ 1341.993036] binder: 27989:27991 got transaction with invalid offset (0, min 24 max 40) or object. [ 1341.993067] binder: 27989:27991 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.013393] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.013421] binder: send failed reply for transaction 30943 to 27985:27990 [ 1342.020259] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.032602] binder: 28000:28001 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.032635] binder: 28000:28001 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.050435] binder: undelivered TRANSACTION_COMPLETE [ 1342.050443] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.064267] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.068130] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.068138] binder: 28006:28007 ioctl 40046207 0 returned -16 [ 1342.068895] binder: 28006:28007 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.069014] binder: 28006:28007 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.073246] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.074457] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.153482] binder: 28010:28011 transaction failed 29189/-22, size 40-16 line 3010 [ 1342.236058] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.272872] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.272879] binder: 28014:28017 ioctl 40046207 0 returned -16 [ 1342.273707] binder: 28012:28016 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.273739] binder: 28012:28016 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.273918] binder: 28014:28017 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.273944] binder: 28014:28017 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.282498] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.282505] binder: 28013:28021 ioctl 40046207 0 returned -16 [ 1342.283152] binder: 28018:28024 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.283184] binder: 28018:28024 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.283514] binder: 28013:28021 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.283545] binder: 28013:28021 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.285718] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.285725] binder: 28015:28023 ioctl 40046207 0 returned -16 [ 1342.286614] binder: 28015:28023 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.286645] binder: 28015:28023 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.303792] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.303800] binder: 28019:28028 ioctl 40046207 0 returned -16 [ 1342.304607] binder: 28019:28028 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.304638] binder: 28019:28028 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.310566] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.316781] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.316789] binder: 28022:28029 ioctl 40046207 0 returned -16 [ 1342.317596] binder: 28022:28029 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.317626] binder: 28022:28029 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.319959] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.323615] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.337750] binder: release 28020:28027 transaction 30973 out, still active [ 1342.337755] binder: unexpected work type, 4, not freed [ 1342.337757] binder: undelivered TRANSACTION_COMPLETE [ 1342.342599] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.351637] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.351662] binder: send failed reply for transaction 30973, target dead [ 1342.357912] binder_alloc: 28040: binder_alloc_buf, no vma [ 1342.357927] binder: 28040:28043 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.362781] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.368278] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.371882] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.402992] binder_alloc: 28044: binder_alloc_buf, no vma [ 1342.403010] binder: 28044:28049 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.409191] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.409197] binder: 28045:28051 ioctl 40046207 0 returned -16 [ 1342.409797] binder_alloc: 28044: binder_alloc_buf, no vma [ 1342.411054] binder: 28045:28051 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.416135] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.416142] binder: 28046:28052 ioctl 40046207 0 returned -16 [ 1342.416944] binder_alloc: 28044: binder_alloc_buf, no vma [ 1342.416959] binder: 28046:28052 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.421110] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.424195] binder: 28047:28053 transaction failed 29189/-22, size 40-8 line 3010 [ 1342.428420] binder: 28048:28054 transaction failed 29189/-22, size 40-16 line 3010 [ 1342.429793] binder: 28050:28056 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.429832] binder: 28050:28056 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.434776] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.440867] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.448628] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.448635] binder: 28058:28061 ioctl 40046207 0 returned -16 [ 1342.449726] binder: 28058:28061 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.449757] binder: 28058:28061 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.457619] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.457626] binder: 28055:28063 ioctl 40046207 0 returned -16 [ 1342.458348] binder: 28055:28063 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.458379] binder: 28055:28063 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.468419] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.468426] binder: 28062:28067 ioctl 40046207 0 returned -16 [ 1342.469125] binder: 28062:28067 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.469159] binder: 28062:28067 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.479988] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.479996] binder: 28066:28072 ioctl 40046207 0 returned -16 [ 1342.480694] binder: 28066:28072 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.480723] binder: 28066:28072 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.488425] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.495927] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.498245] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.498252] binder: 28070:28076 ioctl 40046207 0 returned -16 [ 1342.499002] binder: 28070:28076 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.499035] binder: 28070:28076 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.501393] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.501732] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.505419] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.510955] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.525438] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.540255] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.554536] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.554543] binder: 28084:28088 ioctl 40046207 0 returned -16 [ 1342.555342] binder_alloc: 28081: binder_alloc_buf, no vma [ 1342.555359] binder: 28081:28083 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.555413] binder_alloc: 28081: binder_alloc_buf, no vma [ 1342.555492] binder: 28084:28088 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.555748] binder_alloc: 28081: binder_alloc_buf, no vma [ 1342.555760] binder: 28082:28086 transaction failed 29189/-3, size 40-8 line 3133 [ 1342.560491] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.560497] binder: 28087:28090 ioctl 40046207 0 returned -16 [ 1342.561169] binder_alloc: 28081: binder_alloc_buf, no vma [ 1342.561188] binder: 28087:28090 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.562007] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.579423] binder_alloc: 28085: binder_alloc_buf, no vma [ 1342.579442] binder: 28085:28089 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.584213] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.593540] binder_alloc: 28094: binder_alloc_buf, no vma [ 1342.593557] binder: 28094:28097 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.596198] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.596205] binder: 28096:28103 ioctl 40046207 0 returned -16 [ 1342.600420] binder_alloc: 28094: binder_alloc_buf, no vma [ 1342.600437] binder: 28096:28103 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.606164] binder_alloc: 28094: binder_alloc_buf, no vma [ 1342.606181] binder: 28095:28104 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.610451] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.610458] binder: 28100:28105 ioctl 40046207 0 returned -16 [ 1342.611170] binder_alloc: 28094: binder_alloc_buf, no vma [ 1342.611186] binder: 28100:28105 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.620762] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.621752] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.623209] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.631586] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.638731] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.655831] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.670586] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.702176] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.702184] binder: 28113:28116 ioctl 40046207 0 returned -16 [ 1342.702956] binder: 28115:28117 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.702991] binder: 28115:28117 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.703122] binder: 28113:28116 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.703151] binder: 28113:28116 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.710916] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.710924] binder: 28118:28123 ioctl 40046207 0 returned -16 [ 1342.712896] binder: 28118:28123 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.712929] binder: 28118:28123 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.718063] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.725456] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.725462] binder: 28120:28126 ioctl 40046207 0 returned -16 [ 1342.726310] binder: 28120:28126 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.726348] binder: 28120:28126 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.739518] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.739527] binder: 28121:28124 ioctl 40046207 0 returned -16 [ 1342.740049] binder: 28125:28127 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.740082] binder: 28125:28127 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.740427] binder: 28121:28124 got transaction with invalid offset (0, min 24 max 40) or object. [ 1342.740453] binder: 28121:28124 transaction failed 29201/-22, size 40-16 line 3196 [ 1342.742759] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.747418] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.751234] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.751241] binder: 28128:28132 ioctl 40046207 0 returned -16 [ 1342.786142] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.786171] binder: send failed reply for transaction 31031 to 28114:28119 [ 1342.788105] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.788145] binder: undelivered TRANSACTION_ERROR: 29201 [ 1342.796042] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.796050] binder: 28136:28139 ioctl 40046207 0 returned -16 [ 1342.796548] binder_alloc: 28141: binder_alloc_buf, no vma [ 1342.796567] binder: 28141:28144 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.796919] binder_alloc: 28141: binder_alloc_buf, no vma [ 1342.796935] binder: 28136:28139 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.803197] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.809144] binder: undelivered TRANSACTION_COMPLETE [ 1342.809151] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.809157] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.809163] binder: 28143:28148 ioctl 40046207 0 returned -16 [ 1342.810211] binder_alloc: 28141: binder_alloc_buf, no vma [ 1342.810231] binder: 28143:28148 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.813798] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.826577] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.841846] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.841853] binder: 28152:28156 ioctl 40046207 0 returned -16 [ 1342.842639] binder_alloc: 28151: binder_alloc_buf, no vma [ 1342.842713] binder: 28152:28156 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.843515] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.843522] binder: 28149:28150 ioctl 40046207 0 returned -16 [ 1342.844358] binder_alloc: 28151: binder_alloc_buf, no vma [ 1342.844372] binder: 28149:28150 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.845780] binder_alloc: 28151: binder_alloc_buf, no vma [ 1342.845797] binder: 28151:28155 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.852629] binder_alloc: 28151: binder_alloc_buf, no vma [ 1342.852648] binder: 28153:28160 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.854200] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.854207] binder: 28154:28157 ioctl 40046207 0 returned -16 [ 1342.854946] binder_alloc: 28151: binder_alloc_buf, no vma [ 1342.854964] binder: 28154:28157 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.856160] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.869342] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.875995] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.881235] binder: 28158:28164 transaction failed 29189/-22, size 40-8 line 3010 [ 1342.890604] binder_alloc: 28162: binder_alloc_buf, no vma [ 1342.890621] binder: 28162:28166 transaction failed 29189/-3, size 40-16 line 3133 [ 1342.901916] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.902367] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.926007] binder: undelivered TRANSACTION_ERROR: 29189 [ 1342.975312] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.011005] binder_alloc: 28174: binder_alloc_buf, no vma [ 1343.011023] binder: 28174:28183 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.011033] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.011040] binder: 28175:28181 ioctl 40046207 0 returned -16 [ 1343.012403] binder_alloc: 28174: binder_alloc_buf, no vma [ 1343.012419] binder: 28175:28181 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.015245] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.015252] binder: 28177:28185 ioctl 40046207 0 returned -16 [ 1343.017409] binder_alloc: 28174: binder_alloc_buf, no vma [ 1343.017424] binder: 28177:28185 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.024217] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.024224] binder: 28176:28184 ioctl 40046207 0 returned -16 [ 1343.025457] binder_alloc: 28174: binder_alloc_buf, no vma [ 1343.025472] binder: 28176:28184 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.026336] binder_alloc: 28174: binder_alloc_buf, no vma [ 1343.026350] binder: 28178:28186 transaction failed 29189/-3, size 40-8 line 3133 [ 1343.029623] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.029631] binder: 28180:28187 ioctl 40046207 0 returned -16 [ 1343.030736] binder_alloc: 28174: binder_alloc_buf, no vma [ 1343.030753] binder: 28180:28187 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.037571] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.040551] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.044006] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.075884] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.078478] binder_alloc: 28182: binder_alloc_buf, no vma [ 1343.078497] binder: 28182:28189 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.079007] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.079014] binder: 28179:28188 ioctl 40046207 0 returned -16 [ 1343.079747] binder_alloc: 28182: binder_alloc_buf, no vma [ 1343.079766] binder: 28179:28188 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.090843] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.090851] binder: 28194:28199 ioctl 40046207 0 returned -16 [ 1343.092200] binder_alloc: 28182: binder_alloc_buf, no vma [ 1343.092218] binder: 28194:28199 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.092259] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.125400] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.125871] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.135722] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.140253] binder_alloc: 28201: binder_alloc_buf, no vma [ 1343.140270] binder: 28201:28203 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.153616] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.156976] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.163472] binder_alloc: 28204: binder_alloc_buf, no vma [ 1343.163490] binder: 28204:28206 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.171268] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.171275] binder: 28207:28208 ioctl 40046207 0 returned -16 [ 1343.172107] binder_alloc: 28204: binder_alloc_buf, no vma [ 1343.172123] binder: 28207:28208 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.175448] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.221296] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.263726] binder_alloc: 28211: binder_alloc_buf, no vma [ 1343.263743] binder: 28211:28214 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.264838] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.264846] binder: 28212:28216 ioctl 40046207 0 returned -16 [ 1343.264878] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.264883] binder: 28213:28219 ioctl 40046207 0 returned -16 [ 1343.265764] binder_alloc: 28211: binder_alloc_buf, no vma [ 1343.265783] binder: 28213:28219 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.267816] binder_alloc: 28211: binder_alloc_buf, no vma [ 1343.267832] binder: 28212:28216 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.274048] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.275804] binder_alloc: 28215: binder_alloc_buf, no vma [ 1343.275823] binder: 28215:28220 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.276407] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.276414] binder: 28217:28222 ioctl 40046207 0 returned -16 [ 1343.288783] binder_alloc: 28215: binder_alloc_buf, no vma [ 1343.288808] binder: 28217:28222 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.290981] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.290988] binder: 28218:28223 ioctl 40046207 0 returned -16 [ 1343.291707] binder_alloc: 28215: binder_alloc_buf, no vma [ 1343.291722] binder: 28218:28223 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.294984] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.294990] binder: 28225:28227 ioctl 40046207 0 returned -16 [ 1343.295952] binder_alloc: 28215: binder_alloc_buf, no vma [ 1343.295968] binder: 28225:28227 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.305412] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.305420] binder: 28221:28226 ioctl 40046207 0 returned -16 [ 1343.305501] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.308091] binder: 28221:28226 transaction failed 29189/-22, size 40-16 line 3010 [ 1343.308208] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.320502] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.320868] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.328547] binder_alloc: 28228: binder_alloc_buf, no vma [ 1343.328593] binder: 28228:28232 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.332794] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.342720] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.342727] binder: 28235:28240 ioctl 40046207 0 returned -16 [ 1343.343397] binder_alloc: 28228: binder_alloc_buf, no vma [ 1343.343413] binder: 28235:28240 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.346857] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.356829] binder: 28236:28238 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.356867] binder: 28236:28238 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.361703] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.364312] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.387078] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.391617] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.408517] binder: 28247:28249 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.408551] binder: 28247:28249 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.409720] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.409727] binder: 28248:28250 ioctl 40046207 0 returned -16 [ 1343.410532] binder: 28248:28250 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.410561] binder: 28248:28250 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.424138] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.465690] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.471243] binder_alloc: 28257: binder_alloc_buf, no vma [ 1343.471263] binder: 28257:28259 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.474815] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.474822] binder: 28258:28264 ioctl 40046207 0 returned -16 [ 1343.475616] binder_alloc: 28257: binder_alloc_buf, no vma [ 1343.475632] binder: 28258:28264 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.478451] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.483223] binder_alloc: 28263: binder_alloc_buf, no vma [ 1343.483242] binder: 28263:28268 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.484303] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.484311] binder: 28260:28265 ioctl 40046207 0 returned -16 [ 1343.485055] binder_alloc: 28263: binder_alloc_buf, no vma [ 1343.485071] binder: 28260:28265 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.506629] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.517215] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.542326] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.572689] binder: 28276:28278 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.572723] binder: 28276:28278 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.577510] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.577516] binder: 28274:28279 ioctl 40046207 0 returned -16 [ 1343.578020] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.578027] binder: 28277:28281 ioctl 40046207 0 returned -16 [ 1343.578258] binder: 28274:28279 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.578291] binder: 28274:28279 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.578970] binder: 28277:28281 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.578998] binder: 28277:28281 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.583203] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.583210] binder: 28275:28282 ioctl 40046207 0 returned -16 [ 1343.584098] binder: 28275:28282 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.584129] binder: 28275:28282 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.597208] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.599966] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.599973] binder: 28280:28285 ioctl 40046207 0 returned -16 [ 1343.600926] binder: 28280:28285 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.601118] binder: 28280:28285 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.602993] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.606583] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.606590] binder: 28283:28287 ioctl 40046207 0 returned -16 [ 1343.607503] binder: 28283:28287 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.607536] binder: 28283:28287 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.610994] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.633158] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.633166] binder: 28294:28295 ioctl 40046207 0 returned -16 [ 1343.633902] binder: 28294:28295 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.633934] binder: 28294:28295 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.634513] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.640884] binder: 28290:28292 transaction failed 29189/-22, size 40-16 line 3010 [ 1343.652429] binder_alloc: 28296: binder_alloc_buf, no vma [ 1343.652446] binder: 28296:28299 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.652771] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.653681] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.678525] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.685432] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.691943] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.710835] binder: 28303:28304 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.710868] binder: 28303:28304 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.717547] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.717553] binder: 28305:28309 ioctl 40046207 0 returned -16 [ 1343.718276] binder: 28305:28309 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.718306] binder: 28305:28309 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.724191] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.725320] binder: 28307:28311 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.725352] binder: 28307:28311 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.740161] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.750879] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.789259] binder_alloc: 28313: binder_alloc_buf, no vma [ 1343.789277] binder: 28313:28315 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.800186] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.800193] binder: 28314:28318 ioctl 40046207 0 returned -16 [ 1343.800851] binder_alloc: 28313: binder_alloc_buf, no vma [ 1343.800867] binder: 28314:28318 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.804881] binder_alloc: 28313: binder_alloc_buf, no vma [ 1343.804899] binder: 28316:28317 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.808257] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.811446] binder: 28319:28320 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.811475] binder: 28319:28320 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.816975] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.816981] binder: 28322:28323 ioctl 40046207 0 returned -16 [ 1343.818441] binder: 28322:28323 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.818467] binder: 28322:28323 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.821294] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.845531] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.850306] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.878553] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.890611] binder_alloc: 28332: binder_alloc_buf, no vma [ 1343.890626] binder: 28332:28333 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.894961] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.908938] binder: BINDER_SET_CONTEXT_MGR already set [ 1343.908946] binder: 28334:28336 ioctl 40046207 0 returned -16 [ 1343.909020] binder_alloc: 28331: binder_alloc_buf, no vma [ 1343.909040] binder: 28331:28335 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.909753] binder_alloc: 28331: binder_alloc_buf, no vma [ 1343.909768] binder: 28334:28336 transaction failed 29189/-3, size 40-16 line 3133 [ 1343.917525] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.920553] binder: undelivered TRANSACTION_ERROR: 29189 [ 1343.924746] binder: 28337:28339 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.924778] binder: 28337:28339 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.935163] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.948891] binder: 28340:28343 got transaction with invalid offset (0, min 24 max 40) or object. [ 1343.948925] binder: 28340:28343 transaction failed 29201/-22, size 40-16 line 3196 [ 1343.972766] binder: undelivered TRANSACTION_ERROR: 29201 [ 1343.984010] binder: 28345:28347 transaction failed 29189/-22, size 40-16 line 3010 [ 1344.021236] binder_alloc: 28349: binder_alloc_buf, no vma [ 1344.021253] binder: 28349:28350 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.043434] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.046125] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.049900] binder_alloc: 28353: binder_alloc_buf, no vma [ 1344.049916] binder: 28353:28355 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.054318] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.064957] binder: 28354:28357 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.064989] binder: 28354:28357 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.067435] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.067441] binder: 28356:28358 ioctl 40046207 0 returned -16 [ 1344.068287] binder: 28356:28358 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.068317] binder: 28356:28358 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.082588] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.082595] binder: 28359:28360 ioctl 40046207 0 returned -16 [ 1344.083403] binder: 28359:28360 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.083437] binder: 28359:28360 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.093262] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.098494] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.128120] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.182305] binder: 28367:28368 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.182338] binder: 28367:28368 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.210337] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.210344] binder: 28369:28373 ioctl 40046207 0 returned -16 [ 1344.211232] binder: 28369:28373 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.211266] binder: 28369:28373 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.216533] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.218649] binder: 28371:28374 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.218686] binder: 28371:28374 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.224031] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.234200] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.234207] binder: 28375:28377 ioctl 40046207 0 returned -16 [ 1344.235044] binder: 28375:28377 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.235076] binder: 28375:28377 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.241542] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.250742] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.250749] binder: 28378:28381 ioctl 40046207 0 returned -16 [ 1344.251470] binder: 28378:28381 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.251503] binder: 28378:28381 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.258072] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.258078] binder: 28382:28385 ioctl 40046207 0 returned -16 [ 1344.258944] binder: 28382:28385 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.258975] binder: 28382:28385 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.259603] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.269691] binder: 28379:28383 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.269725] binder: 28379:28383 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.292831] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.292839] binder: 28387:28392 ioctl 40046207 0 returned -16 [ 1344.293754] binder: 28387:28392 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.293791] binder: 28387:28392 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.302370] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.302956] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.302963] binder: 28388:28391 ioctl 40046207 0 returned -16 [ 1344.303687] binder: 28388:28391 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.303721] binder: 28388:28391 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.308516] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.315646] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.319788] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.336604] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.336613] binder: 28401:28404 ioctl 40046207 0 returned -16 [ 1344.337205] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.337295] binder: 28401:28404 transaction failed 29189/-22, size 40-16 line 3010 [ 1344.345838] binder_alloc: 28399: binder_alloc_buf, no vma [ 1344.345854] binder: 28399:28403 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.349866] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.349873] binder: 28398:28402 ioctl 40046207 0 returned -16 [ 1344.350632] binder_alloc: 28399: binder_alloc_buf, no vma [ 1344.350649] binder: 28398:28402 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.353410] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.362606] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.377123] binder: 28406:28408 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.377157] binder: 28406:28408 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.392800] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.403194] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.403201] binder: 28410:28411 ioctl 40046207 0 returned -16 [ 1344.403911] binder: 28410:28411 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.403942] binder: 28410:28411 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.421675] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.427271] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.463552] binder_alloc: 28417: binder_alloc_buf, no vma [ 1344.463570] binder: 28417:28418 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.467175] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.467182] binder: 28416:28421 ioctl 40046207 0 returned -16 [ 1344.468128] binder_alloc: 28417: binder_alloc_buf, no vma [ 1344.468143] binder: 28416:28421 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.468769] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.468775] binder: 28414:28419 ioctl 40046207 0 returned -16 [ 1344.469514] binder_alloc: 28417: binder_alloc_buf, no vma [ 1344.469530] binder: 28414:28419 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.470878] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.470923] binder: 28420:28423 ioctl 40046207 0 returned -16 [ 1344.474244] binder_alloc: 28417: binder_alloc_buf, no vma [ 1344.474261] binder: 28420:28423 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.480879] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.480886] binder: 28415:28422 ioctl 40046207 0 returned -16 [ 1344.481730] binder_alloc: 28417: binder_alloc_buf, no vma [ 1344.481749] binder: 28415:28422 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.487614] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.496841] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.500064] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.506754] binder: 28424:28426 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.506791] binder: 28424:28426 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.510240] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.510248] binder: 28428:28431 ioctl 40046207 0 returned -16 [ 1344.511155] binder: 28428:28431 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.511186] binder: 28428:28431 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.517661] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.517670] binder: 28429:28434 ioctl 40046207 0 returned -16 [ 1344.518398] binder: 28429:28434 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.518430] binder: 28429:28434 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.527722] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.536686] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.536695] binder: 28436:28439 ioctl 40046207 0 returned -16 [ 1344.537795] binder: 28436:28439 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.537830] binder: 28436:28439 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.538108] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.551038] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.572758] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.576448] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.577053] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.590106] binder_alloc: 28447: binder_alloc_buf, no vma [ 1344.590122] binder: 28447:28448 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.597782] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.597789] binder: 28443:28446 ioctl 40046207 0 returned -16 [ 1344.598520] binder_alloc: 28447: binder_alloc_buf, no vma [ 1344.598535] binder: 28443:28446 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.602470] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.602728] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.626452] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.626457] binder: 28450:28454 ioctl 40046207 0 returned -16 [ 1344.626848] binder_alloc: 28449: binder_alloc_buf, no vma [ 1344.626867] binder: 28449:28458 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.628337] binder_alloc: 28449: binder_alloc_buf, no vma [ 1344.628354] binder: 28450:28454 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.630036] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.630045] binder: 28456:28459 ioctl 40046207 0 returned -16 [ 1344.630948] binder_alloc: 28449: binder_alloc_buf, no vma [ 1344.630963] binder: 28456:28459 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.631128] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.631134] binder: 28451:28457 ioctl 40046207 0 returned -16 [ 1344.633446] binder_alloc: 28449: binder_alloc_buf, no vma [ 1344.633463] binder: 28451:28457 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.635541] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.635547] binder: 28452:28460 ioctl 40046207 0 returned -16 [ 1344.636875] binder_alloc: 28449: binder_alloc_buf, no vma [ 1344.636889] binder: 28452:28460 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.642030] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.642036] binder: 28455:28463 ioctl 40046207 0 returned -16 [ 1344.643610] binder_alloc: 28449: binder_alloc_buf, no vma [ 1344.643626] binder: 28455:28463 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.651134] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.651142] binder: 28453:28461 ioctl 40046207 0 returned -16 [ 1344.652253] binder_alloc: 28449: binder_alloc_buf, no vma [ 1344.652318] binder: 28453:28461 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.656012] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.670792] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.681893] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.696946] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.698858] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.709010] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.716882] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.743538] binder_alloc: 28480: binder_alloc_buf, no vma [ 1344.743555] binder: 28480:28489 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.745000] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.745006] binder: 28485:28487 ioctl 40046207 0 returned -16 [ 1344.746381] binder_alloc: 28480: binder_alloc_buf, no vma [ 1344.746399] binder: 28485:28487 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.746992] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.747000] binder: 28483:28490 ioctl 40046207 0 returned -16 [ 1344.748236] binder_alloc: 28480: binder_alloc_buf, no vma [ 1344.748251] binder: 28483:28490 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.748771] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.748778] binder: 28484:28488 ioctl 40046207 0 returned -16 [ 1344.750236] binder_alloc: 28480: binder_alloc_buf, no vma [ 1344.750252] binder: 28484:28488 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.752556] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.752563] binder: 28479:28492 ioctl 40046207 0 returned -16 [ 1344.753888] binder_alloc: 28480: binder_alloc_buf, no vma [ 1344.753904] binder: 28479:28492 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.754787] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.754794] binder: 28482:28491 ioctl 40046207 0 returned -16 [ 1344.755774] binder_alloc: 28480: binder_alloc_buf, no vma [ 1344.755790] binder: 28482:28491 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.758131] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.758138] binder: 28486:28493 ioctl 40046207 0 returned -16 [ 1344.758826] binder_alloc: 28480: binder_alloc_buf, no vma [ 1344.758843] binder: 28486:28493 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.760217] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.760223] binder: 28481:28494 ioctl 40046207 0 returned -16 [ 1344.760951] binder_alloc: 28480: binder_alloc_buf, no vma [ 1344.760966] binder: 28481:28494 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.766878] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.777890] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.811384] binder_alloc: 28505: binder_alloc_buf, no vma [ 1344.811529] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.812420] binder: 28505:28512 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.816309] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.820238] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.826115] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.826122] binder: 28502:28510 ioctl 40046207 0 returned -16 [ 1344.826821] binder_alloc: 28505: binder_alloc_buf, no vma [ 1344.826838] binder: 28502:28510 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.828750] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.835875] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.840727] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.845321] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.853399] binder: 28516:28520 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.853434] binder: 28516:28520 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.857684] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.860243] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.860250] binder: 28514:28518 ioctl 40046207 0 returned -16 [ 1344.861263] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.861271] binder: 28515:28519 ioctl 40046207 0 returned -16 [ 1344.862140] binder: 28515:28519 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.862171] binder: 28515:28519 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.862558] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.862564] binder: 28517:28521 ioctl 40046207 0 returned -16 [ 1344.863264] binder: 28514:28518 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.863477] binder: 28514:28518 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.864457] binder: 28517:28521 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.864490] binder: 28517:28521 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.873935] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.873943] binder: 28522:28527 ioctl 40046207 0 returned -16 [ 1344.874626] binder: 28522:28527 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.874827] binder: 28522:28527 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.877565] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.898219] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.912503] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.921108] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.921231] binder: undelivered TRANSACTION_ERROR: 29201 [ 1344.954038] binder_alloc: 28537: binder_alloc_buf, no vma [ 1344.954056] binder: 28537:28543 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.959534] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.959541] binder: 28535:28549 ioctl 40046207 0 returned -16 [ 1344.960425] binder_alloc: 28537: binder_alloc_buf, no vma [ 1344.960442] binder: 28535:28549 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.960506] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.960512] binder: 28538:28544 ioctl 40046207 0 returned -16 [ 1344.960822] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.960828] binder: 28536:28548 ioctl 40046207 0 returned -16 [ 1344.961181] binder_alloc: 28537: binder_alloc_buf, no vma [ 1344.961197] binder: 28538:28544 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.961804] binder_alloc: 28537: binder_alloc_buf, no vma [ 1344.961814] binder: 28536:28548 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.968224] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.968232] binder: 28539:28545 ioctl 40046207 0 returned -16 [ 1344.968973] binder_alloc: 28537: binder_alloc_buf, no vma [ 1344.968989] binder: 28539:28545 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.971390] binder: BINDER_SET_CONTEXT_MGR already set [ 1344.971396] binder: 28541:28546 ioctl 40046207 0 returned -16 [ 1344.972610] binder_alloc: 28537: binder_alloc_buf, no vma [ 1344.972626] binder: 28541:28546 transaction failed 29189/-3, size 40-16 line 3133 [ 1344.975016] binder: undelivered TRANSACTION_ERROR: 29189 [ 1344.982353] binder: 28540:28547 got transaction with invalid offset (0, min 24 max 40) or object. [ 1344.982385] binder: 28540:28547 transaction failed 29201/-22, size 40-16 line 3196 [ 1344.990429] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.007088] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.007095] binder: 28555:28557 ioctl 40046207 0 returned -16 [ 1345.007814] binder: 28555:28557 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.007846] binder: 28555:28557 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.018576] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.026965] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.032470] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.032478] binder: 28562:28567 ioctl 40046207 0 returned -16 [ 1345.033700] binder: 28562:28567 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.033735] binder: 28562:28567 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.043400] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.047557] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.051582] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.057343] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.063933] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.071207] binder: 28571:28572 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.071242] binder: 28571:28572 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.082532] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.086411] binder_alloc: 28573: binder_alloc_buf, no vma [ 1345.086427] binder: 28573:28577 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.087888] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.087895] binder: 28574:28576 ioctl 40046207 0 returned -16 [ 1345.088641] binder_alloc: 28573: binder_alloc_buf, no vma [ 1345.088657] binder: 28574:28576 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.090682] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.090689] binder: 28575:28578 ioctl 40046207 0 returned -16 [ 1345.091125] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.092830] binder: 28575:28578 transaction failed 29189/-22, size 40-16 line 3010 [ 1345.114949] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.115678] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.140765] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.140773] binder: 28588:28592 ioctl 40046207 0 returned -16 [ 1345.141293] binder: 28589:28594 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.141326] binder: 28589:28594 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.141370] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.141376] binder: 28584:28596 ioctl 40046207 0 returned -16 [ 1345.142172] binder: 28584:28596 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.142200] binder: 28584:28596 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.142325] binder: 28588:28592 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.142353] binder: 28588:28592 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.147633] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.147639] binder: 28591:28597 ioctl 40046207 0 returned -16 [ 1345.148444] binder: 28591:28597 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.148478] binder: 28591:28597 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.149809] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.149816] binder: 28587:28598 ioctl 40046207 0 returned -16 [ 1345.150727] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.150733] binder: 28590:28595 ioctl 40046207 0 returned -16 [ 1345.151619] binder: 28590:28595 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.151649] binder: 28590:28595 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.159498] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.159505] binder: 28585:28599 ioctl 40046207 0 returned -16 [ 1345.160163] binder: 28585:28599 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.160192] binder: 28585:28599 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.161863] binder: 28587:28598 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.161894] binder: 28587:28598 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.171633] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.179706] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.201114] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.209807] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.212856] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.212864] binder: 28606:28615 ioctl 40046207 0 returned -16 [ 1345.213690] binder: 28606:28615 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.213768] binder: 28606:28615 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.229716] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.231259] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.234739] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.243370] binder_alloc: 28611: binder_alloc_buf, no vma [ 1345.243389] binder: 28611:28619 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.246130] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.246137] binder: 28609:28617 ioctl 40046207 0 returned -16 [ 1345.246862] binder_alloc: 28611: binder_alloc_buf, no vma [ 1345.246880] binder: 28609:28617 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.248952] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.254454] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.257637] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.257645] binder: 28620:28629 ioctl 40046207 0 returned -16 [ 1345.258174] binder: 28624:28628 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.258208] binder: 28624:28628 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.258439] binder: 28620:28629 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.259720] binder: 28620:28629 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.264275] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.264283] binder: 28625:28630 ioctl 40046207 0 returned -16 [ 1345.265740] binder: 28625:28630 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.265776] binder: 28625:28630 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.267608] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.267615] binder: 28621:28631 ioctl 40046207 0 returned -16 [ 1345.268413] binder: 28621:28631 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.268443] binder: 28621:28631 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.269392] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.269399] binder: 28627:28632 ioctl 40046207 0 returned -16 [ 1345.270250] binder: 28627:28632 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.270280] binder: 28627:28632 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.284630] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.298044] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.304478] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.315778] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.321832] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.326047] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.348508] binder: 28648:28652 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.348540] binder: 28648:28652 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.349074] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.349081] binder: 28646:28654 ioctl 40046207 0 returned -16 [ 1345.349903] binder: 28646:28654 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.349935] binder: 28646:28654 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.353053] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.353059] binder: 28649:28656 ioctl 40046207 0 returned -16 [ 1345.353323] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.353329] binder: 28650:28657 ioctl 40046207 0 returned -16 [ 1345.354174] binder: 28649:28656 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.354209] binder: 28649:28656 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.354931] binder: 28650:28657 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.354961] binder: 28650:28657 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.356078] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.356083] binder: 28651:28658 ioctl 40046207 0 returned -16 [ 1345.359943] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.359950] binder: 28653:28659 ioctl 40046207 0 returned -16 [ 1345.361347] binder: 28653:28659 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.361376] binder: 28653:28659 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.365192] binder: 28651:28658 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.365225] binder: 28651:28658 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.366178] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.366186] binder: 28647:28660 ioctl 40046207 0 returned -16 [ 1345.367437] binder: 28647:28660 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.367468] binder: 28647:28660 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.368099] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.368106] binder: 28655:28661 ioctl 40046207 0 returned -16 [ 1345.369167] binder: 28655:28661 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.369195] binder: 28655:28661 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.375895] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.376108] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.393935] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.411563] binder_alloc: 28671: binder_alloc_buf, no vma [ 1345.411581] binder: 28671:28680 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.419775] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.420307] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.429384] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.432562] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.432570] binder: 28679:28685 ioctl 40046207 0 returned -16 [ 1345.433405] binder_alloc: 28671: binder_alloc_buf, no vma [ 1345.433422] binder: 28679:28685 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.437879] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.447689] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.448190] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.472982] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.472988] binder: 28683:28694 ioctl 40046207 0 returned -16 [ 1345.473819] binder: 28683:28694 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.473854] binder: 28683:28694 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.474051] binder: 28687:28692 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.474079] binder: 28687:28692 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.477047] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.477054] binder: 28689:28697 ioctl 40046207 0 returned -16 [ 1345.477280] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.478229] binder: 28689:28697 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.478269] binder: 28689:28697 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.478402] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.478409] binder: 28688:28698 ioctl 40046207 0 returned -16 [ 1345.479336] binder: 28688:28698 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.479367] binder: 28688:28698 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.481796] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.481803] binder: 28690:28695 ioctl 40046207 0 returned -16 [ 1345.482732] binder: 28690:28695 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.482768] binder: 28690:28695 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.483814] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.483821] binder: 28693:28699 ioctl 40046207 0 returned -16 [ 1345.484693] binder: 28693:28699 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.484724] binder: 28693:28699 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.494177] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.494184] binder: 28696:28704 ioctl 40046207 0 returned -16 [ 1345.494896] binder: 28696:28704 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.494928] binder: 28696:28704 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.499026] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.509505] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.523248] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.530165] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.539878] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.550725] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.557702] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.586933] binder: 28717:28723 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.586960] binder: 28717:28723 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.589523] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.589530] binder: 28718:28725 ioctl 40046207 0 returned -16 [ 1345.591224] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.591231] binder: 28716:28726 ioctl 40046207 0 returned -16 [ 1345.591573] binder: 28718:28725 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.591683] binder: 28718:28725 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.591995] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.592001] binder: 28720:28724 ioctl 40046207 0 returned -16 [ 1345.592434] binder: 28716:28726 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.592465] binder: 28716:28726 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.592962] binder: 28720:28724 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.592985] binder: 28720:28724 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.593432] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.593439] binder: 28719:28727 ioctl 40046207 0 returned -16 [ 1345.594655] binder: 28719:28727 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.594684] binder: 28719:28727 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.603510] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.605535] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.605542] binder: 28721:28729 ioctl 40046207 0 returned -16 [ 1345.605941] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.605947] binder: 28715:28728 ioctl 40046207 0 returned -16 [ 1345.606468] binder: 28721:28729 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.606499] binder: 28721:28729 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.606777] binder: 28715:28728 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.606807] binder: 28715:28728 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.608008] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.615382] binder: 28722:28730 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.615413] binder: 28722:28730 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.647261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.651425] binder_alloc: 28737: binder_alloc_buf, no vma [ 1345.651443] binder: 28737:28745 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.652536] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.659852] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.659860] binder: 28742:28749 ioctl 40046207 0 returned -16 [ 1345.660658] binder_alloc: 28737: binder_alloc_buf, no vma [ 1345.660994] binder: 28742:28749 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.668044] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.671976] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.676438] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.682669] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.687063] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.691190] binder: 28752:28755 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.691225] binder: 28752:28755 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.692665] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.692672] binder: 28753:28756 ioctl 40046207 0 returned -16 [ 1345.692680] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.693608] binder: 28753:28756 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.693638] binder: 28753:28756 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.693651] binder: 28757:28760 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.693682] binder: 28757:28760 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.696971] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.696977] binder: 28758:28761 ioctl 40046207 0 returned -16 [ 1345.697721] binder: 28758:28761 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.697758] binder: 28758:28761 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.715041] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.717568] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.717576] binder: 28759:28768 ioctl 40046207 0 returned -16 [ 1345.718739] binder: 28759:28768 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.718812] binder: 28759:28768 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.736650] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.744857] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.750177] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.753550] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.778860] binder_alloc: 28774: binder_alloc_buf, no vma [ 1345.778879] binder: 28774:28784 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.780159] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.780165] binder: 28775:28781 ioctl 40046207 0 returned -16 [ 1345.781074] binder_alloc: 28774: binder_alloc_buf, no vma [ 1345.781089] binder: 28775:28781 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.783064] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.783070] binder: 28780:28782 ioctl 40046207 0 returned -16 [ 1345.783870] binder_alloc: 28774: binder_alloc_buf, no vma [ 1345.783883] binder: 28780:28782 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.788649] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.788655] binder: 28773:28787 ioctl 40046207 0 returned -16 [ 1345.789573] binder_alloc: 28774: binder_alloc_buf, no vma [ 1345.789588] binder: 28773:28787 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.792787] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.792794] binder: 28779:28788 ioctl 40046207 0 returned -16 [ 1345.793677] binder_alloc: 28774: binder_alloc_buf, no vma [ 1345.793695] binder: 28776:28783 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.794149] binder_alloc: 28774: binder_alloc_buf, no vma [ 1345.794164] binder: 28779:28788 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.795743] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.795750] binder: 28777:28786 ioctl 40046207 0 returned -16 [ 1345.796783] binder_alloc: 28774: binder_alloc_buf, no vma [ 1345.796799] binder: 28777:28786 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.800115] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.800120] binder: 28778:28785 ioctl 40046207 0 returned -16 [ 1345.800906] binder_alloc: 28774: binder_alloc_buf, no vma [ 1345.800921] binder: 28778:28785 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.808739] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.820248] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.831648] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.850612] binder_alloc: 28802: binder_alloc_buf, no vma [ 1345.850628] binder: 28802:28808 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.855174] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.870190] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.872175] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.872182] binder: 28799:28803 ioctl 40046207 0 returned -16 [ 1345.874886] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.875001] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.875307] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.880463] binder_alloc: 28802: binder_alloc_buf, no vma [ 1345.880480] binder: 28799:28803 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.890297] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.890304] binder: 28811:28813 ioctl 40046207 0 returned -16 [ 1345.891134] binder_alloc: 28802: binder_alloc_buf, no vma [ 1345.891153] binder: 28811:28813 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.893115] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.898318] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.901261] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.901268] binder: 28816:28817 ioctl 40046207 0 returned -16 [ 1345.902244] binder_alloc: 28802: binder_alloc_buf, no vma [ 1345.902258] binder: 28816:28817 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.904254] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.904261] binder: 28814:28818 ioctl 40046207 0 returned -16 [ 1345.905700] binder_alloc: 28802: binder_alloc_buf, no vma [ 1345.905718] binder: 28814:28818 transaction failed 29189/-3, size 40-16 line 3133 [ 1345.909562] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.909569] binder: 28815:28819 ioctl 40046207 0 returned -16 [ 1345.909835] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.910307] binder: 28815:28819 transaction failed 29189/-22, size 40-16 line 3010 [ 1345.913536] binder: 28807:28810 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.913571] binder: 28807:28810 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.926250] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.926258] binder: 28822:28829 ioctl 40046207 0 returned -16 [ 1345.928591] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.928598] binder: 28820:28825 ioctl 40046207 0 returned -16 [ 1345.929520] binder: 28820:28825 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.929553] binder: 28820:28825 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.931486] binder: BINDER_SET_CONTEXT_MGR already set [ 1345.931497] binder: 28821:28827 ioctl 40046207 0 returned -16 [ 1345.932253] binder: 28821:28827 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.932289] binder: 28821:28827 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.932897] binder: 28822:28829 got transaction with invalid offset (0, min 24 max 40) or object. [ 1345.932929] binder: 28822:28829 transaction failed 29201/-22, size 40-16 line 3196 [ 1345.941004] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.944205] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.952446] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.952772] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.962146] binder: undelivered TRANSACTION_ERROR: 29189 [ 1345.970128] binder: undelivered TRANSACTION_ERROR: 29201 [ 1345.984792] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.004190] binder_alloc: 28835: binder_alloc_buf, no vma [ 1346.004208] binder: 28835:28842 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.005994] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.006001] binder: 28839:28843 ioctl 40046207 0 returned -16 [ 1346.006816] binder_alloc: 28835: binder_alloc_buf, no vma [ 1346.006832] binder: 28839:28843 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.010741] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.010747] binder: 28838:28841 ioctl 40046207 0 returned -16 [ 1346.011754] binder_alloc: 28835: binder_alloc_buf, no vma [ 1346.011768] binder: 28838:28841 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.021266] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.021273] binder: 28837:28845 ioctl 40046207 0 returned -16 [ 1346.022077] binder_alloc: 28835: binder_alloc_buf, no vma [ 1346.022094] binder: 28837:28845 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.022863] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.026644] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.035775] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.037245] binder: 28847:28851 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.037273] binder: 28847:28851 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.043471] binder: 28840:28848 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.043506] binder: 28840:28848 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.044365] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.044373] binder: 28836:28850 ioctl 40046207 0 returned -16 [ 1346.045692] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.045698] binder: 28854:28856 ioctl 40046207 0 returned -16 [ 1346.046074] binder: 28836:28850 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.046109] binder: 28836:28850 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.046620] binder: 28854:28856 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.046648] binder: 28854:28856 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.050885] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.050892] binder: 28855:28858 ioctl 40046207 0 returned -16 [ 1346.051767] binder: 28855:28858 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.053159] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.053166] binder: 28844:28846 ioctl 40046207 0 returned -16 [ 1346.053249] binder: 28855:28858 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.054953] binder: 28844:28846 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.054984] binder: 28844:28846 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.059900] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.063289] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.076541] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.084302] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.092395] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.092402] binder: 28868:28871 ioctl 40046207 0 returned -16 [ 1346.093403] binder: 28868:28871 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.093435] binder: 28868:28871 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.094636] binder: 28859:28864 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.094667] binder: 28859:28864 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.107318] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.107325] binder: 28873:28875 ioctl 40046207 0 returned -16 [ 1346.108199] binder: 28873:28875 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.108235] binder: 28873:28875 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.108538] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.109348] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.119740] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.122579] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.124742] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.124748] binder: 28879:28881 ioctl 40046207 0 returned -16 [ 1346.131988] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.131994] binder: 28874:28878 ioctl 40046207 0 returned -16 [ 1346.132873] binder: 28874:28878 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.132903] binder: 28874:28878 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.138118] binder: 28866:28869 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.138151] binder: 28866:28869 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.142724] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.153912] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.162142] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.173986] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.207893] binder: 28890:28896 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.207929] binder: 28890:28896 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.212851] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.212858] binder: 28889:28893 ioctl 40046207 0 returned -16 [ 1346.213666] binder: 28892:28897 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.213699] binder: 28892:28897 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.214170] binder: 28889:28893 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.214198] binder: 28889:28893 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.216754] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.216761] binder: 28894:28899 ioctl 40046207 0 returned -16 [ 1346.219308] binder: 28894:28899 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.219462] binder: 28894:28899 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.224552] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.224559] binder: 28900:28904 ioctl 40046207 0 returned -16 [ 1346.224701] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.224707] binder: 28898:28903 ioctl 40046207 0 returned -16 [ 1346.225692] binder: 28898:28903 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.225732] binder: 28898:28903 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.227362] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.227368] binder: 28895:28902 ioctl 40046207 0 returned -16 [ 1346.228944] binder: 28895:28902 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.228973] binder: 28895:28902 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.229213] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.229224] binder: 28891:28901 ioctl 40046207 0 returned -16 [ 1346.230334] binder: 28891:28901 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.230361] binder: 28891:28901 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.235558] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.236248] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.271795] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.286356] binder_alloc: 28915: binder_alloc_buf, no vma [ 1346.286376] binder: 28915:28919 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.289805] binder_alloc: 28915: binder_alloc_buf, no vma [ 1346.289823] binder: 28914:28918 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.291462] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.291471] binder: 28920:28929 ioctl 40046207 0 returned -16 [ 1346.291561] binder_alloc: 28915: binder_alloc_buf, no vma [ 1346.291576] binder: 28920:28929 transaction failed 29189/-3, size 0-16 line 3133 [ 1346.296402] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.296411] binder: 28927:28930 ioctl 40046207 0 returned -16 [ 1346.297060] binder_alloc: 28915: binder_alloc_buf, no vma [ 1346.297077] binder: 28927:28930 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.297318] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.300960] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.319456] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.324124] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.324131] binder: 28934:28937 ioctl 40046207 0 returned -16 [ 1346.324825] binder_alloc: 28915: binder_alloc_buf, no vma [ 1346.324843] binder: 28934:28937 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.324889] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.331711] binder: 28933:28938 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.331748] binder: 28933:28938 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.335516] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.335573] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.345951] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.345958] binder: 28942:28946 ioctl 40046207 0 returned -16 [ 1346.346853] binder: 28942:28946 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.346885] binder: 28942:28946 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.352253] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.352378] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.360013] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.360020] binder: 28939:28944 ioctl 40046207 0 returned -16 [ 1346.363228] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.377923] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.391235] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.419015] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.419022] binder: 28953:28958 ioctl 40046207 0 returned -16 [ 1346.419807] binder_alloc: 28950: binder_alloc_buf, no vma [ 1346.419823] binder: 28953:28958 transaction failed 29189/-3, size 40-8 line 3133 [ 1346.429649] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.429656] binder: 28952:28961 ioctl 40046207 0 returned -16 [ 1346.430774] binder_alloc: 28950: binder_alloc_buf, no vma [ 1346.430791] binder: 28952:28961 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.431300] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.431306] binder: 28954:28959 ioctl 40046207 0 returned -16 [ 1346.432145] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.432151] binder: 28957:28962 ioctl 40046207 0 returned -16 [ 1346.433435] binder: 28954:28959 transaction failed 29189/-22, size 40-16 line 3010 [ 1346.433551] binder: 28957:28962 transaction failed 29189/-22, size 40-16 line 3010 [ 1346.442023] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.453541] binder: 28949:28964 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.453573] binder: 28949:28964 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.457534] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.457542] binder: 28967:28968 ioctl 40046207 0 returned -16 [ 1346.463255] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.463262] binder: 28960:28965 ioctl 40046207 0 returned -16 [ 1346.463926] binder: 28960:28965 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.463962] binder: 28960:28965 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.466691] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.466698] binder: 28969:28974 ioctl 40046207 0 returned -16 [ 1346.468750] binder: 28969:28974 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.468783] binder: 28969:28974 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.472917] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.502755] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.510542] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.521808] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.526150] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.535179] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.535186] binder: 28981:28985 ioctl 40046207 0 returned -16 [ 1346.536008] binder: 28981:28985 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.536037] binder: 28981:28985 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.538521] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.542505] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.542513] binder: 28984:28988 ioctl 40046207 0 returned -16 [ 1346.548423] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.548431] binder: 28991:28994 ioctl 40046207 0 returned -16 [ 1346.549113] binder: 28991:28994 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.549146] binder: 28991:28994 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.555644] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.577014] binder: release 28990:28993 transaction 31559 out, still active [ 1346.577018] binder: unexpected work type, 4, not freed [ 1346.577021] binder: undelivered TRANSACTION_COMPLETE [ 1346.577053] binder: send failed reply for transaction 31559, target dead [ 1346.582114] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.607664] binder: 29000:29005 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.607697] binder: 29000:29005 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.609931] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.609939] binder: 29002:29007 ioctl 40046207 0 returned -16 [ 1346.609970] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.609976] binder: 29004:29009 ioctl 40046207 0 returned -16 [ 1346.610317] binder: 29004:29009 got transaction with invalid offset (0, min 0 max 0) or object. [ 1346.610341] binder: 29004:29009 transaction failed 29201/-22, size 0-16 line 3196 [ 1346.610683] binder: 29002:29007 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.610718] binder: 29002:29007 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.628668] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.628674] binder: 29006:29011 ioctl 40046207 0 returned -16 [ 1346.628740] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.628747] binder: 29001:29016 ioctl 40046207 0 returned -16 [ 1346.629550] binder: 29001:29016 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.629581] binder: 29001:29016 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.630694] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.630703] binder: 29008:29012 ioctl 40046207 0 returned -16 [ 1346.631815] binder: 29008:29012 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.631844] binder: 29008:29012 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.637504] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.639906] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.655575] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.655704] binder: 29010:29015 ioctl 40046207 0 returned -16 [ 1346.658997] binder: 29010:29015 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.659028] binder: 29010:29015 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.668685] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.668692] binder: 29003:29014 ioctl 40046207 0 returned -16 [ 1346.669796] binder: 29003:29014 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.669826] binder: 29003:29014 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.670489] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.670515] binder: send failed reply for transaction 31579 to 29006:29011 [ 1346.670902] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.674411] binder_alloc: 29023: binder_alloc_buf, no vma [ 1346.674428] binder: 29023:29026 transaction failed 29189/-3, size 0-16 line 3133 [ 1346.682955] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.702534] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.702543] binder: 29036:29037 ioctl 40046207 0 returned -16 [ 1346.703243] binder: 29036:29037 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.703275] binder: 29036:29037 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.703666] binder: undelivered TRANSACTION_COMPLETE [ 1346.703673] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.706329] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.706335] binder: 29035:29038 ioctl 40046207 0 returned -16 [ 1346.706468] binder: 29035:29038 got transaction with invalid offset (0, min 0 max 0) or object. [ 1346.706490] binder: 29035:29038 transaction failed 29201/-22, size 0-16 line 3196 [ 1346.712428] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.712847] binder: 29025:29030 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.712881] binder: 29025:29030 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.714774] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.729636] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.734125] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.734435] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.744731] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.752349] binder: 29033:29042 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.752382] binder: 29033:29042 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.765656] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.790665] binder_alloc: 29047: binder_alloc_buf, no vma [ 1346.790683] binder: 29047:29053 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.794466] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.794475] binder: 29046:29051 ioctl 40046207 0 returned -16 [ 1346.795426] binder_alloc: 29047: binder_alloc_buf, no vma [ 1346.795445] binder: 29046:29051 transaction failed 29189/-3, size 40-8 line 3133 [ 1346.796540] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.796546] binder: 29049:29055 ioctl 40046207 0 returned -16 [ 1346.797312] binder_alloc: 29047: binder_alloc_buf, no vma [ 1346.797327] binder: 29049:29055 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.809269] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.813000] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.813008] binder: 29050:29056 ioctl 40046207 0 returned -16 [ 1346.813721] binder_alloc: 29047: binder_alloc_buf, no vma [ 1346.813738] binder: 29050:29056 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.817168] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.817176] binder: 29052:29057 ioctl 40046207 0 returned -16 [ 1346.817880] binder_alloc: 29047: binder_alloc_buf, no vma [ 1346.817888] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.817893] binder: 29045:29060 ioctl 40046207 0 returned -16 [ 1346.817900] binder: 29052:29057 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.818815] binder_alloc: 29047: binder_alloc_buf, no vma [ 1346.818832] binder: 29045:29060 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.819000] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.819005] binder: 29048:29059 ioctl 40046207 0 returned -16 [ 1346.819976] binder_alloc: 29047: binder_alloc_buf, no vma [ 1346.819994] binder: 29048:29059 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.820969] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.828265] binder_alloc: 29062: binder_alloc_buf, no vma [ 1346.828282] binder: 29062:29066 transaction failed 29189/-3, size 40-8 line 3133 [ 1346.835434] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.835441] binder: 29054:29058 ioctl 40046207 0 returned -16 [ 1346.836119] binder_alloc: 29062: binder_alloc_buf, no vma [ 1346.836136] binder: 29054:29058 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.839221] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.846361] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.851215] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.861348] binder_alloc: 29075: binder_alloc_buf, no vma [ 1346.861367] binder: 29075:29079 transaction failed 29189/-3, size 40-8 line 3133 [ 1346.866076] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.866083] binder: 29068:29072 ioctl 40046207 0 returned -16 [ 1346.867214] binder_alloc: 29075: binder_alloc_buf, no vma [ 1346.867229] binder: 29068:29072 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.873090] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.873097] binder: 29076:29082 ioctl 40046207 0 returned -16 [ 1346.878783] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.880965] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.881486] binder_alloc: 29075: binder_alloc_buf, no vma [ 1346.881503] binder: 29076:29082 transaction failed 29189/-3, size 40-16 line 3133 [ 1346.890345] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.892623] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.894717] binder: 29083:29085 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.894751] binder: 29083:29085 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.898673] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.898680] binder: 29089:29090 ioctl 40046207 0 returned -16 [ 1346.899544] binder: 29089:29090 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.899577] binder: 29089:29090 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.913604] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.918089] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.923375] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.929251] binder: 29092:29096 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.929286] binder: 29092:29096 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.933233] binder: BINDER_SET_CONTEXT_MGR already set [ 1346.933242] binder: 29093:29097 ioctl 40046207 0 returned -16 [ 1346.934000] binder: 29093:29097 got transaction with invalid offset (0, min 24 max 40) or object. [ 1346.934033] binder: 29093:29097 transaction failed 29201/-22, size 40-16 line 3196 [ 1346.942357] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.964744] binder: undelivered TRANSACTION_ERROR: 29189 [ 1346.969826] binder: undelivered TRANSACTION_ERROR: 29201 [ 1346.979612] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.003472] binder_alloc: 29103: binder_alloc_buf, no vma [ 1347.003490] binder: 29103:29105 transaction failed 29189/-3, size 40-8 line 3133 [ 1347.007093] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.007100] binder: 29106:29111 ioctl 40046207 0 returned -16 [ 1347.009316] binder_alloc: 29103: binder_alloc_buf, no vma [ 1347.009332] binder: 29106:29111 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.016069] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.016088] binder: 29108:29113 ioctl 40046207 0 returned -16 [ 1347.016128] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.016135] binder: 29107:29116 ioctl 40046207 0 returned -16 [ 1347.016914] binder_alloc: 29103: binder_alloc_buf, no vma [ 1347.016931] binder: 29108:29113 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.017492] binder_alloc: 29103: binder_alloc_buf, no vma [ 1347.017508] binder: 29107:29116 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.017788] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.017795] binder: 29104:29117 ioctl 40046207 0 returned -16 [ 1347.018725] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.018732] binder: 29109:29114 ioctl 40046207 0 returned -16 [ 1347.019440] binder_alloc: 29103: binder_alloc_buf, no vma [ 1347.019456] binder: 29109:29114 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.020545] binder_alloc: 29103: binder_alloc_buf, no vma [ 1347.020559] binder: 29104:29117 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.021611] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.021617] binder: 29110:29115 ioctl 40046207 0 returned -16 [ 1347.022322] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.022372] binder: 29110:29115 transaction failed 29189/-22, size 40-16 line 3010 [ 1347.034586] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.040718] binder: 29112:29118 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.040785] binder: 29112:29118 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.057178] binder: 29127:29131 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.057220] binder: 29127:29131 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.066477] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.086709] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.094711] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.097357] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.097364] binder: 29123:29130 ioctl 40046207 0 returned -16 [ 1347.102709] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.102716] binder: 29137:29141 ioctl 40046207 0 returned -16 [ 1347.103438] binder: 29137:29141 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.103470] binder: 29137:29141 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.108271] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.108280] binder: 29140:29142 ioctl 40046207 0 returned -16 [ 1347.108963] binder: 29140:29142 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.108995] binder: 29140:29142 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.109076] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.128139] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.130838] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.130867] binder: send failed reply for transaction 31655 to 29123:29130 [ 1347.141752] binder: 29147:29149 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.141786] binder: 29147:29149 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.142633] binder: 29146:29151 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.142664] binder: 29146:29151 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.151631] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.158136] binder: undelivered TRANSACTION_COMPLETE [ 1347.158144] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.161638] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.162055] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.171413] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.171421] binder: 29153:29156 ioctl 40046207 0 returned -16 [ 1347.172201] binder: 29153:29156 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.172231] binder: 29153:29156 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.174071] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.177924] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.177930] binder: 29158:29162 ioctl 40046207 0 returned -16 [ 1347.178647] binder: 29158:29162 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.178681] binder: 29158:29162 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.193570] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.193590] binder: 29159:29164 ioctl 40046207 0 returned -16 [ 1347.193592] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.193598] binder: 29154:29157 ioctl 40046207 0 returned -16 [ 1347.194477] binder: 29154:29157 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.194509] binder: 29154:29157 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.201046] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.205730] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.205757] binder: send failed reply for transaction 31674 to 29159:29164 [ 1347.209239] binder: undelivered TRANSACTION_COMPLETE [ 1347.209246] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.224295] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.235765] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.258383] binder: 29174:29179 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.258415] binder: 29174:29179 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.260423] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.260430] binder: 29173:29182 ioctl 40046207 0 returned -16 [ 1347.260595] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.260601] binder: 29176:29181 ioctl 40046207 0 returned -16 [ 1347.261212] binder: 29173:29182 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.261244] binder: 29173:29182 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.261674] binder: 29176:29181 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.261700] binder: 29176:29181 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.266905] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.266912] binder: 29180:29184 ioctl 40046207 0 returned -16 [ 1347.267825] binder: 29180:29184 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.267855] binder: 29180:29184 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.267860] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.267866] binder: 29177:29183 ioctl 40046207 0 returned -16 [ 1347.269082] binder: 29177:29183 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.269309] binder: 29177:29183 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.273084] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.273091] binder: 29178:29186 ioctl 40046207 0 returned -16 [ 1347.274205] binder: 29178:29186 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.274236] binder: 29178:29186 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.274351] binder: 29175:29185 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.274380] binder: 29175:29185 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.278731] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.278738] binder: 29172:29187 ioctl 40046207 0 returned -16 [ 1347.279153] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.279674] binder: 29172:29187 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.279704] binder: 29172:29187 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.290576] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.311589] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.317563] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.340766] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.345607] binder: 29211:29212 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.345643] binder: 29211:29212 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.349112] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.363093] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.369866] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.369877] binder: 29200:29206 ioctl 40046207 0 returned -16 [ 1347.370999] binder: 29200:29206 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.371033] binder: 29200:29206 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.377658] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.383109] binder: 29214:29218 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.383145] binder: 29214:29218 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.387117] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.387124] binder: 29205:29209 ioctl 40046207 0 returned -16 [ 1347.388308] binder: 29205:29209 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.388338] binder: 29205:29209 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.390511] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.390517] binder: 29216:29220 ioctl 40046207 0 returned -16 [ 1347.390750] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.394506] binder: 29216:29220 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.394538] binder: 29216:29220 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.396482] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.396776] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.396783] binder: 29217:29222 ioctl 40046207 0 returned -16 [ 1347.398101] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.398106] binder: 29219:29223 ioctl 40046207 0 returned -16 [ 1347.398829] binder: 29219:29223 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.398860] binder: 29219:29223 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.413160] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.431398] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.439621] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.448785] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.475027] binder_alloc: 29232: binder_alloc_buf, no vma [ 1347.475047] binder: 29232:29233 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.476978] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.476986] binder: 29234:29239 ioctl 40046207 0 returned -16 [ 1347.477769] binder_alloc: 29232: binder_alloc_buf, no vma [ 1347.477786] binder: 29234:29239 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.478041] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.478047] binder: 29236:29241 ioctl 40046207 0 returned -16 [ 1347.480529] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.480535] binder: 29238:29242 ioctl 40046207 0 returned -16 [ 1347.481613] binder_alloc: 29232: binder_alloc_buf, no vma [ 1347.481630] binder: 29238:29242 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.484943] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.484950] binder: 29240:29243 ioctl 40046207 0 returned -16 [ 1347.486284] binder_alloc: 29232: binder_alloc_buf, no vma [ 1347.486301] binder: 29240:29243 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.487660] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.487667] binder: 29235:29244 ioctl 40046207 0 returned -16 [ 1347.488350] binder_alloc: 29232: binder_alloc_buf, no vma [ 1347.488366] binder: 29235:29244 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.491808] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.491815] binder: 29231:29245 ioctl 40046207 0 returned -16 [ 1347.492480] binder_alloc: 29232: binder_alloc_buf, no vma [ 1347.492497] binder: 29231:29245 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.495003] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.502999] binder: 29237:29246 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.503031] binder: 29237:29246 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.519404] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.528542] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.528551] binder: 29257:29261 ioctl 40046207 0 returned -16 [ 1347.538694] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.547726] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.552555] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.555909] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.555917] binder: 29253:29264 ioctl 40046207 0 returned -16 [ 1347.556632] binder: 29253:29264 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.556661] binder: 29253:29264 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.560045] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.560053] binder: 29262:29269 ioctl 40046207 0 returned -16 [ 1347.560793] binder: 29262:29269 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.560827] binder: 29262:29269 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.571332] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.577507] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.580884] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.580891] binder: 29272:29275 ioctl 40046207 0 returned -16 [ 1347.581226] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.581232] binder: 29270:29274 ioctl 40046207 0 returned -16 [ 1347.582216] binder: 29270:29274 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.582248] binder: 29270:29274 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.583990] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.590120] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.590127] binder: 29266:29273 ioctl 40046207 0 returned -16 [ 1347.590831] binder: 29266:29273 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.590861] binder: 29266:29273 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.596494] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.596501] binder: 29268:29276 ioctl 40046207 0 returned -16 [ 1347.597436] binder: 29268:29276 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.597466] binder: 29268:29276 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.598931] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.622763] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.630902] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.643577] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.665303] binder: 29288:29291 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.665336] binder: 29288:29291 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.673831] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.673838] binder: 29286:29293 ioctl 40046207 0 returned -16 [ 1347.674702] binder: 29286:29293 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.674734] binder: 29286:29293 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.676446] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.676454] binder: 29285:29289 ioctl 40046207 0 returned -16 [ 1347.677193] binder: 29285:29289 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.677226] binder: 29285:29289 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.680285] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.680291] binder: 29287:29297 ioctl 40046207 0 returned -16 [ 1347.681214] binder: 29287:29297 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.681243] binder: 29287:29297 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.688918] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.688926] binder: 29284:29298 ioctl 40046207 0 returned -16 [ 1347.689750] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.689756] binder: 29290:29295 ioctl 40046207 0 returned -16 [ 1347.689903] binder: 29284:29298 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.689935] binder: 29284:29298 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.689988] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.689994] binder: 29294:29296 ioctl 40046207 0 returned -16 [ 1347.690816] binder: 29294:29296 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.690848] binder: 29294:29296 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.704575] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.704583] binder: 29292:29300 ioctl 40046207 0 returned -16 [ 1347.706544] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.707004] binder: 29292:29300 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.707042] binder: 29292:29300 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.715553] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.725011] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.734249] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.747831] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.747838] binder: 29314:29319 ioctl 40046207 0 returned -16 [ 1347.748617] binder: 29314:29319 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.748651] binder: 29314:29319 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.753220] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.753227] binder: 29316:29320 ioctl 40046207 0 returned -16 [ 1347.754096] binder: 29316:29320 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.754124] binder: 29316:29320 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.756346] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.761531] binder_alloc: 29306: binder_alloc_buf, no vma [ 1347.761546] binder: 29306:29317 transaction failed 29189/-3, size 0-16 line 3133 [ 1347.762369] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.762377] binder: 29322:29324 ioctl 40046207 0 returned -16 [ 1347.763069] binder_alloc: 29306: binder_alloc_buf, no vma [ 1347.763084] binder: 29322:29324 transaction failed 29189/-3, size 40-16 line 3133 [ 1347.766950] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.767113] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.780384] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.783113] binder: 29327:29331 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.783147] binder: 29327:29331 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.786811] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.795029] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.795035] binder: 29318:29328 ioctl 40046207 0 returned -16 [ 1347.795867] binder: 29318:29328 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.795899] binder: 29318:29328 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.802434] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.814992] binder: undelivered TRANSACTION_ERROR: 29189 [ 1347.825244] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.829340] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.850055] binder: 29340:29344 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.850090] binder: 29340:29344 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.851770] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.851777] binder: 29342:29346 ioctl 40046207 0 returned -16 [ 1347.851877] binder: 29342:29346 got transaction with invalid offset (0, min 0 max 0) or object. [ 1347.851901] binder: 29342:29346 transaction failed 29201/-22, size 0-16 line 3196 [ 1347.859334] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.859341] binder: 29343:29349 ioctl 40046207 0 returned -16 [ 1347.860074] binder: 29343:29349 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.860107] binder: 29343:29349 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.863301] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.863307] binder: 29345:29350 ioctl 40046207 0 returned -16 [ 1347.864310] binder: 29345:29350 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.864341] binder: 29345:29350 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.865335] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.865341] binder: 29339:29347 ioctl 40046207 0 returned -16 [ 1347.866057] binder: 29339:29347 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.866088] binder: 29339:29347 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.869526] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.869892] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.869898] binder: 29348:29352 ioctl 40046207 0 returned -16 [ 1347.874852] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.874859] binder: 29338:29354 ioctl 40046207 0 returned -16 [ 1347.875623] binder: 29338:29354 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.875656] binder: 29338:29354 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.877234] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.877241] binder: 29341:29351 ioctl 40046207 0 returned -16 [ 1347.877962] binder: 29341:29351 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.877993] binder: 29341:29351 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.881130] binder: 29348:29352 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.881162] binder: 29348:29352 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.884078] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.904675] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.904682] binder: 29361:29366 ioctl 40046207 0 returned -16 [ 1347.904745] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.905681] binder: 29361:29366 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.905713] binder: 29361:29366 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.924947] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.924954] binder: 29358:29369 ioctl 40046207 0 returned -16 [ 1347.927172] binder: 29358:29369 got transaction with invalid offset (0, min 0 max 0) or object. [ 1347.927198] binder: 29358:29369 transaction failed 29201/-22, size 0-16 line 3196 [ 1347.935872] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.936054] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.937411] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.939510] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.939516] binder: 29372:29374 ioctl 40046207 0 returned -16 [ 1347.940234] binder: 29372:29374 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.940268] binder: 29372:29374 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.945524] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.950155] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.961374] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.967673] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.974728] binder: undelivered TRANSACTION_ERROR: 29201 [ 1347.980277] binder: 29378:29383 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.980311] binder: 29378:29383 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.984150] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.984157] binder: 29376:29380 ioctl 40046207 0 returned -16 [ 1347.986883] binder: 29376:29380 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.986914] binder: 29376:29380 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.987856] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.987862] binder: 29377:29381 ioctl 40046207 0 returned -16 [ 1347.989098] binder: 29377:29381 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.989128] binder: 29377:29381 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.996061] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.996068] binder: 29384:29386 ioctl 40046207 0 returned -16 [ 1347.997843] binder: BINDER_SET_CONTEXT_MGR already set [ 1347.997850] binder: 29387:29390 ioctl 40046207 0 returned -16 [ 1347.998567] binder: 29387:29390 got transaction with invalid offset (0, min 24 max 40) or object. [ 1347.998597] binder: 29387:29390 transaction failed 29201/-22, size 40-16 line 3196 [ 1347.999554] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.007039] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.007046] binder: 29379:29385 ioctl 40046207 0 returned -16 [ 1348.007954] binder: 29379:29385 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.007985] binder: 29379:29385 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.009533] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.009541] binder: 29388:29391 ioctl 40046207 0 returned -16 [ 1348.009816] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.009823] binder: 29375:29382 ioctl 40046207 0 returned -16 [ 1348.010611] binder: 29375:29382 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.010637] binder: 29375:29382 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.010677] binder: 29388:29391 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.010753] binder: 29388:29391 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.011195] binder: release 29384:29386 transaction 31827 out, still active [ 1348.011199] binder: unexpected work type, 4, not freed [ 1348.011202] binder: undelivered TRANSACTION_COMPLETE [ 1348.015331] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.036320] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.041178] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.052581] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.060701] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.060728] binder: send failed reply for transaction 31827, target dead [ 1348.081583] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.102982] binder: 29409:29412 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.103015] binder: 29409:29412 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.103152] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.103159] binder: 29408:29414 ioctl 40046207 0 returned -16 [ 1348.103381] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.103387] binder: 29406:29411 ioctl 40046207 0 returned -16 [ 1348.104501] binder: 29406:29411 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.104531] binder: 29406:29411 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.109155] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.109161] binder: 29413:29417 ioctl 40046207 0 returned -16 [ 1348.110115] binder: 29413:29417 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.110143] binder: 29413:29417 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.118905] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.118913] binder: 29405:29422 ioctl 40046207 0 returned -16 [ 1348.119871] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.119878] binder: 29410:29416 ioctl 40046207 0 returned -16 [ 1348.120767] binder: 29410:29416 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.120798] binder: 29410:29416 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.122476] binder: 29405:29422 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.122506] binder: 29405:29422 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.123567] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.123575] binder: 29415:29419 ioctl 40046207 0 returned -16 [ 1348.124400] binder: 29415:29419 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.124435] binder: 29415:29419 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.130117] binder: release 29408:29414 transaction 31846 out, still active [ 1348.130122] binder: unexpected work type, 4, not freed [ 1348.130124] binder: undelivered TRANSACTION_COMPLETE [ 1348.130250] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.130273] binder: send failed reply for transaction 31846, target dead [ 1348.131034] binder: 29407:29418 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.131067] binder: 29407:29418 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.149018] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.157587] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.162952] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.177020] binder_alloc: 29431: binder_alloc_buf, no vma [ 1348.177038] binder: 29431:29439 transaction failed 29189/-3, size 40-8 line 3133 [ 1348.179760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.182152] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.184858] binder_alloc: 29440: binder_alloc_buf, no vma [ 1348.184875] binder: 29440:29444 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.198761] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.198769] binder: 29430:29438 ioctl 40046207 0 returned -16 [ 1348.199108] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.199115] binder: 29435:29443 ioctl 40046207 0 returned -16 [ 1348.199854] binder_alloc: 29440: binder_alloc_buf, no vma [ 1348.199871] binder: 29430:29438 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.200263] binder_alloc: 29440: binder_alloc_buf, no vma [ 1348.200278] binder: 29435:29443 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.203817] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.211814] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.214412] binder: 29445:29449 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.214445] binder: 29445:29449 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.218711] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.222950] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.224605] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.224611] binder: 29436:29446 ioctl 40046207 0 returned -16 [ 1348.228764] binder: 29436:29446 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.228799] binder: 29436:29446 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.246397] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.254143] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.259611] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.284925] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.284933] binder: 29458:29466 ioctl 40046207 0 returned -16 [ 1348.286045] binder: 29458:29466 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.286137] binder: 29458:29466 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.286705] binder: 29460:29463 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.286735] binder: 29460:29463 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.286883] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.286890] binder: 29457:29465 ioctl 40046207 0 returned -16 [ 1348.288107] binder: 29457:29465 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.288135] binder: 29457:29465 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.288338] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.288345] binder: 29462:29467 ioctl 40046207 0 returned -16 [ 1348.289167] binder: 29462:29467 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.289199] binder: 29462:29467 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.296337] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.296344] binder: 29461:29470 ioctl 40046207 0 returned -16 [ 1348.297340] binder: 29461:29470 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.297368] binder: 29461:29470 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.297639] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.297645] binder: 29459:29469 ioctl 40046207 0 returned -16 [ 1348.298528] binder: 29459:29469 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.298554] binder: 29459:29469 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.303649] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.303657] binder: 29456:29473 ioctl 40046207 0 returned -16 [ 1348.304855] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.304861] binder: 29464:29468 ioctl 40046207 0 returned -16 [ 1348.305713] binder: 29464:29468 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.305742] binder: 29464:29468 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.324856] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.328584] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.336567] binder: release 29456:29473 transaction 31900 out, still active [ 1348.336571] binder: unexpected work type, 4, not freed [ 1348.336574] binder: undelivered TRANSACTION_COMPLETE [ 1348.347125] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.347153] binder: send failed reply for transaction 31900, target dead [ 1348.365513] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.368610] binder: 29487:29492 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.368641] binder: 29487:29492 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.372589] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.373971] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.373979] binder: 29490:29495 ioctl 40046207 0 returned -16 [ 1348.377818] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.384986] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.384995] binder: 29494:29497 ioctl 40046207 0 returned -16 [ 1348.386208] binder: 29494:29497 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.386239] binder: 29494:29497 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.388722] binder: release 29490:29495 transaction 31910 out, still active [ 1348.388727] binder: unexpected work type, 4, not freed [ 1348.388729] binder: undelivered TRANSACTION_COMPLETE [ 1348.390389] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.390395] binder: 29488:29491 ioctl 40046207 0 returned -16 [ 1348.391310] binder: 29488:29491 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.391341] binder: 29488:29491 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.396028] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.399856] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.399863] binder: 29498:29499 ioctl 40046207 0 returned -16 [ 1348.400637] binder: 29498:29499 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.400676] binder: 29498:29499 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.402402] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.411351] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.411376] binder: send failed reply for transaction 31910, target dead [ 1348.414160] binder: 29500:29504 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.414196] binder: 29500:29504 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.417779] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.417785] binder: 29501:29506 ioctl 40046207 0 returned -16 [ 1348.418509] binder: 29501:29506 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.418539] binder: 29501:29506 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.436058] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.439132] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.448522] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.468169] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.494879] binder_alloc: 29514: binder_alloc_buf, no vma [ 1348.494896] binder: 29514:29522 transaction failed 29189/-3, size 40-8 line 3133 [ 1348.496165] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.496173] binder: 29518:29524 ioctl 40046207 0 returned -16 [ 1348.497235] binder_alloc: 29514: binder_alloc_buf, no vma [ 1348.497249] binder: 29518:29524 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.497505] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.497510] binder: 29515:29525 ioctl 40046207 0 returned -16 [ 1348.498192] binder_alloc: 29514: binder_alloc_buf, no vma [ 1348.498207] binder: 29515:29525 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.499733] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.499738] binder: 29516:29523 ioctl 40046207 0 returned -16 [ 1348.500667] binder_alloc: 29514: binder_alloc_buf, no vma [ 1348.500681] binder: 29516:29523 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.503554] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.503561] binder: 29519:29526 ioctl 40046207 0 returned -16 [ 1348.503784] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.503791] binder: 29521:29528 ioctl 40046207 0 returned -16 [ 1348.504686] binder_alloc: 29514: binder_alloc_buf, no vma [ 1348.504702] binder: 29519:29526 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.504970] binder_alloc: 29514: binder_alloc_buf, no vma [ 1348.504984] binder: 29521:29528 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.505082] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.505093] binder: 29520:29529 ioctl 40046207 0 returned -16 [ 1348.507112] binder_alloc: 29514: binder_alloc_buf, no vma [ 1348.507128] binder: 29520:29529 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.513392] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.513399] binder: 29517:29527 ioctl 40046207 0 returned -16 [ 1348.514039] binder_alloc: 29514: binder_alloc_buf, no vma [ 1348.514054] binder: 29517:29527 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.515316] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.519446] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.544448] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.551327] binder_alloc: 29541: binder_alloc_buf, no vma [ 1348.551344] binder: 29541:29550 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.566708] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.567061] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.578191] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.579947] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.579955] binder: 29538:29551 ioctl 40046207 0 returned -16 [ 1348.580868] binder_alloc: 29541: binder_alloc_buf, no vma [ 1348.580882] binder: 29538:29551 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.587183] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.588326] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.596150] binder: 29552:29556 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.596226] binder: 29552:29556 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.597858] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.602415] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.606306] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.606313] binder: 29553:29561 ioctl 40046207 0 returned -16 [ 1348.607183] binder: 29553:29561 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.607215] binder: 29553:29561 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.611219] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.611225] binder: 29560:29563 ioctl 40046207 0 returned -16 [ 1348.611945] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.611952] binder: 29554:29558 ioctl 40046207 0 returned -16 [ 1348.612014] binder: 29560:29563 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.612054] binder: 29560:29563 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.613830] binder: 29554:29558 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.613861] binder: 29554:29558 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.615694] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.615700] binder: 29555:29557 ioctl 40046207 0 returned -16 [ 1348.616569] binder: 29555:29557 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.616828] binder: 29555:29557 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.623137] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.623143] binder: 29562:29567 ioctl 40046207 0 returned -16 [ 1348.623879] binder: 29562:29567 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.623908] binder: 29562:29567 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.632996] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.638344] binder_alloc: 29564: binder_alloc_buf, no vma [ 1348.638362] binder: 29564:29568 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.640583] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.646335] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.646342] binder: 29559:29571 ioctl 40046207 0 returned -16 [ 1348.648909] binder_alloc: 29564: binder_alloc_buf, no vma [ 1348.648926] binder: 29559:29571 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.652787] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.659986] binder: 29574:29581 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.660021] binder: 29574:29581 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.670571] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.670580] binder: 29577:29583 ioctl 40046207 0 returned -16 [ 1348.671371] binder: 29577:29583 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.671406] binder: 29577:29583 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.683044] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.690388] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.691190] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.705935] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.707246] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.713205] binder_alloc: 29585: binder_alloc_buf, no vma [ 1348.713221] binder: 29585:29588 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.719919] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.721547] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.726586] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.726593] binder: 29594:29597 ioctl 40046207 0 returned -16 [ 1348.727340] binder_alloc: 29585: binder_alloc_buf, no vma [ 1348.727356] binder: 29594:29597 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.727432] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.727438] binder: 29595:29598 ioctl 40046207 0 returned -16 [ 1348.728135] binder_alloc: 29585: binder_alloc_buf, no vma [ 1348.728296] binder: 29595:29598 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.732338] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.732346] binder: 29590:29596 ioctl 40046207 0 returned -16 [ 1348.733242] binder_alloc: 29585: binder_alloc_buf, no vma [ 1348.733260] binder: 29590:29596 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.734147] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.734574] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.740828] binder: 29599:29603 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.740858] binder: 29599:29603 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.746513] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.746519] binder: 29600:29605 ioctl 40046207 0 returned -16 [ 1348.747330] binder: 29600:29605 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.747360] binder: 29600:29605 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.759321] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.770095] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.774914] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.787812] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.815716] binder: 29611:29619 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.815752] binder: 29611:29619 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.816253] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.816260] binder: 29618:29621 ioctl 40046207 0 returned -16 [ 1348.817316] binder: 29618:29621 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.817345] binder: 29618:29621 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.819231] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.819237] binder: 29616:29620 ioctl 40046207 0 returned -16 [ 1348.820032] binder: 29616:29620 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.820061] binder: 29616:29620 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.824191] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.824198] binder: 29614:29622 ioctl 40046207 0 returned -16 [ 1348.824867] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.824873] binder: 29613:29626 ioctl 40046207 0 returned -16 [ 1348.825247] binder: 29614:29622 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.825280] binder: 29614:29622 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.825745] binder: 29613:29626 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.825775] binder: 29613:29626 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.831679] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.831685] binder: 29612:29623 ioctl 40046207 0 returned -16 [ 1348.832701] binder: 29612:29623 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.832730] binder: 29612:29623 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.837736] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.843965] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.843972] binder: 29617:29625 ioctl 40046207 0 returned -16 [ 1348.843988] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.844643] binder: 29615:29624 ioctl 40046207 0 returned -16 [ 1348.844695] binder: 29617:29625 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.844727] binder: 29617:29625 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.845001] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.847035] binder: 29615:29624 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.847115] binder: 29615:29624 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.852620] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.864504] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.877662] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.880964] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.888001] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.892577] binder_alloc: 29632: binder_alloc_buf, no vma [ 1348.892593] binder: 29632:29641 transaction failed 29189/-3, size 40-16 line 3133 [ 1348.894604] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.899630] binder: undelivered TRANSACTION_ERROR: 29189 [ 1348.925146] binder: 29646:29652 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.925181] binder: 29646:29652 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.926537] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.926544] binder: 29642:29648 ioctl 40046207 0 returned -16 [ 1348.927241] binder: 29642:29648 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.927272] binder: 29642:29648 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.930822] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.930829] binder: 29645:29654 ioctl 40046207 0 returned -16 [ 1348.932686] binder: 29645:29654 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.932716] binder: 29645:29654 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.932852] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.932858] binder: 29643:29655 ioctl 40046207 0 returned -16 [ 1348.933775] binder: 29643:29655 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.933802] binder: 29643:29655 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.939267] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.939275] binder: 29647:29656 ioctl 40046207 0 returned -16 [ 1348.939336] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.939342] binder: 29649:29653 ioctl 40046207 0 returned -16 [ 1348.940372] binder: 29649:29653 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.940397] binder: 29649:29653 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.940587] binder: 29647:29656 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.940623] binder: 29647:29656 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.941753] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.941759] binder: 29651:29657 ioctl 40046207 0 returned -16 [ 1348.943955] binder: 29651:29657 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.943985] binder: 29651:29657 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.947978] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.947986] binder: 29644:29650 ioctl 40046207 0 returned -16 [ 1348.948791] binder: 29644:29650 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.948822] binder: 29644:29650 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.950648] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.971709] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.973335] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.980802] binder: BINDER_SET_CONTEXT_MGR already set [ 1348.980808] binder: 29664:29669 ioctl 40046207 0 returned -16 [ 1348.981672] binder: 29664:29669 got transaction with invalid offset (0, min 24 max 40) or object. [ 1348.981704] binder: 29664:29669 transaction failed 29201/-22, size 40-16 line 3196 [ 1348.987052] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.993374] binder: undelivered TRANSACTION_ERROR: 29201 [ 1348.995310] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.003450] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.004470] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.013479] binder: 29671:29674 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.013513] binder: 29671:29674 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.016516] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.020347] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.020354] binder: 29673:29679 ioctl 40046207 0 returned -16 [ 1349.021109] binder: 29673:29679 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.021139] binder: 29673:29679 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.024401] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.024408] binder: 29672:29675 ioctl 40046207 0 returned -16 [ 1349.026827] binder: 29672:29675 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.026859] binder: 29672:29675 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.030939] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.030945] binder: 29676:29681 ioctl 40046207 0 returned -16 [ 1349.031496] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.031661] binder: 29676:29681 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.031694] binder: 29676:29681 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.035949] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.035956] binder: 29678:29682 ioctl 40046207 0 returned -16 [ 1349.036686] binder: 29678:29682 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.036718] binder: 29678:29682 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.042401] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.048238] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.064384] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.064423] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.083830] binder: 29692:29695 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.083861] binder: 29692:29695 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.092476] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.092484] binder: 29688:29696 ioctl 40046207 0 returned -16 [ 1349.093370] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.093377] binder: 29686:29697 ioctl 40046207 0 returned -16 [ 1349.094003] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.094009] binder: 29690:29694 ioctl 40046207 0 returned -16 [ 1349.094046] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.094051] binder: 29693:29698 ioctl 40046207 0 returned -16 [ 1349.095043] binder: 29688:29696 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.095075] binder: 29688:29696 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.095778] binder: 29690:29694 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.095787] binder: 29693:29698 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.095806] binder: 29690:29694 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.095819] binder: 29693:29698 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.095926] binder: 29686:29697 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.095956] binder: 29686:29697 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.099028] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.099036] binder: 29691:29701 ioctl 40046207 0 returned -16 [ 1349.099934] binder: 29691:29701 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.099965] binder: 29691:29701 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.102246] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.102253] binder: 29687:29702 ioctl 40046207 0 returned -16 [ 1349.103182] binder: 29687:29702 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.103204] binder: 29687:29702 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.110673] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.110681] binder: 29689:29700 ioctl 40046207 0 returned -16 [ 1349.111525] binder: 29689:29700 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.111556] binder: 29689:29700 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.114117] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.115005] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.118181] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.127457] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.140501] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.140508] binder: 29710:29715 ioctl 40046207 0 returned -16 [ 1349.141226] binder_alloc: 29692: binder_alloc_buf, no vma [ 1349.141244] binder: 29710:29715 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.141386] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.142285] binder_alloc: 29708: binder_alloc_buf, no vma [ 1349.142300] binder: 29708:29716 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.149162] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.164998] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.168533] binder_alloc: 29709: binder_alloc_buf, no vma [ 1349.168549] binder: 29709:29719 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.172110] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.172838] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.186187] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.186195] binder: 29714:29724 ioctl 40046207 0 returned -16 [ 1349.187068] binder_alloc: 29709: binder_alloc_buf, no vma [ 1349.187085] binder: 29714:29724 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.188939] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.194145] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.194154] binder: 29722:29727 ioctl 40046207 0 returned -16 [ 1349.194916] binder_alloc: 29709: binder_alloc_buf, no vma [ 1349.194934] binder: 29722:29727 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.195023] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.195030] binder: 29721:29726 ioctl 40046207 0 returned -16 [ 1349.195749] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.195861] binder: 29721:29726 transaction failed 29189/-22, size 40-16 line 3010 [ 1349.204961] binder: 29725:29728 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.204994] binder: 29725:29728 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.206130] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.211375] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.211383] binder: 29730:29733 ioctl 40046207 0 returned -16 [ 1349.212398] binder: 29730:29733 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.212430] binder: 29730:29733 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.213409] binder: 29729:29736 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.213437] binder: 29729:29736 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.220329] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.225816] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.225824] binder: 29732:29738 ioctl 40046207 0 returned -16 [ 1349.226523] binder: 29732:29738 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.226762] binder: 29732:29738 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.232967] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.254501] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.256524] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.273113] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.273434] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.309969] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.309977] binder: 29754:29756 ioctl 40046207 0 returned -16 [ 1349.311048] binder: 29753:29761 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.311081] binder: 29753:29761 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.311214] binder: 29754:29756 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.311244] binder: 29754:29756 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.311356] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.311363] binder: 29750:29762 ioctl 40046207 0 returned -16 [ 1349.312235] binder: 29750:29762 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.312268] binder: 29750:29762 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.312507] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.312512] binder: 29749:29757 ioctl 40046207 0 returned -16 [ 1349.313456] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.313462] binder: 29752:29758 ioctl 40046207 0 returned -16 [ 1349.313543] binder: 29749:29757 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.313573] binder: 29749:29757 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.314888] binder: 29752:29758 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.314917] binder: 29752:29758 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.323142] binder: 29755:29763 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.323173] binder: 29755:29763 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.324771] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.324778] binder: 29748:29760 ioctl 40046207 0 returned -16 [ 1349.325784] binder: 29748:29760 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.325818] binder: 29748:29760 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.334725] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.334731] binder: 29751:29759 ioctl 40046207 0 returned -16 [ 1349.334894] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.336197] binder: 29751:29759 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.336226] binder: 29751:29759 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.354455] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.358065] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.361912] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.369281] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.369287] binder: 29778:29779 ioctl 40046207 0 returned -16 [ 1349.370091] binder: 29778:29779 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.370196] binder: 29778:29779 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.373599] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.376042] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.393931] binder_alloc: 29780: binder_alloc_buf, no vma [ 1349.393948] binder: 29780:29786 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.401882] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.405973] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.406526] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.413615] binder_alloc: 29777: binder_alloc_buf, no vma [ 1349.413636] binder: 29777:29788 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.419548] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.422310] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.428354] binder: 29783:29787 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.428389] binder: 29783:29787 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.429478] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.429484] binder: 29784:29789 ioctl 40046207 0 returned -16 [ 1349.430255] binder: 29784:29789 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.430283] binder: 29784:29789 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.431916] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.431924] binder: 29794:29796 ioctl 40046207 0 returned -16 [ 1349.432695] binder: 29794:29796 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.432822] binder: 29794:29796 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.432834] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.432840] binder: 29785:29791 ioctl 40046207 0 returned -16 [ 1349.433583] binder: 29785:29791 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.433613] binder: 29785:29791 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.438010] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.451252] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.459180] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.466835] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.469084] binder: 29792:29801 transaction failed 29189/-22, size 40-16 line 3010 [ 1349.483409] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.508071] binder: 29806:29813 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.508104] binder: 29806:29813 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.514255] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.514262] binder: 29812:29819 ioctl 40046207 0 returned -16 [ 1349.516291] binder: 29812:29819 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.516321] binder: 29812:29819 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.516493] binder: 29810:29818 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.517258] binder: 29810:29818 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.521831] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.521838] binder: 29809:29815 ioctl 40046207 0 returned -16 [ 1349.522500] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.522506] binder: 29808:29817 ioctl 40046207 0 returned -16 [ 1349.522769] binder: 29809:29815 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.522801] binder: 29809:29815 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.522965] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.522972] binder: 29811:29816 ioctl 40046207 0 returned -16 [ 1349.523484] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.523491] binder: 29807:29814 ioctl 40046207 0 returned -16 [ 1349.523569] binder: 29808:29817 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.523599] binder: 29808:29817 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.524342] binder: 29807:29814 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.524595] binder: 29807:29814 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.530428] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.530435] binder: 29805:29821 ioctl 40046207 0 returned -16 [ 1349.531114] binder: 29805:29821 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.531153] binder: 29805:29821 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.538328] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.547466] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.567008] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.567016] binder: 29831:29837 ioctl 40046207 0 returned -16 [ 1349.569168] binder: 29831:29837 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.569202] binder: 29831:29837 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.575265] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.582689] binder_alloc: 29835: binder_alloc_buf, no vma [ 1349.582707] binder: 29835:29840 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.583450] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.588722] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.598057] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.613569] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.613578] binder: 29844:29848 ioctl 40046207 0 returned -16 [ 1349.614546] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.614553] binder: 29843:29849 ioctl 40046207 0 returned -16 [ 1349.615038] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.615499] binder: 29844:29848 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.615532] binder: 29844:29848 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.616392] binder: 29843:29849 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.616422] binder: 29843:29849 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.618992] binder: 29845:29850 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.619022] binder: 29845:29850 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.624774] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.635938] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.636585] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.643111] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.666702] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.667530] binder: 29847:29852 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.667561] binder: 29847:29852 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.684807] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.714450] binder: 29860:29869 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.714479] binder: 29860:29869 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.717662] binder: 29861:29867 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.717691] binder: 29861:29867 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.719958] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.719965] binder: 29865:29872 ioctl 40046207 0 returned -16 [ 1349.720945] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.720951] binder: 29864:29868 ioctl 40046207 0 returned -16 [ 1349.722081] binder: 29864:29868 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.722111] binder: 29864:29868 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.722559] binder: 29865:29872 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.722581] binder: 29865:29872 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.723301] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.723307] binder: 29863:29870 ioctl 40046207 0 returned -16 [ 1349.724017] binder: 29863:29870 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.724046] binder: 29863:29870 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.727041] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.727048] binder: 29859:29873 ioctl 40046207 0 returned -16 [ 1349.727897] binder: 29859:29873 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.727925] binder: 29859:29873 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.731240] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.731455] binder: 29866:29874 ioctl 40046207 0 returned -16 [ 1349.734486] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.744430] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.744438] binder: 29862:29871 ioctl 40046207 0 returned -16 [ 1349.747658] binder: 29862:29871 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.747692] binder: 29862:29871 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.750343] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.759467] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.759474] binder: 29880:29886 ioctl 40046207 0 returned -16 [ 1349.759818] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.760276] binder: 29880:29886 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.760311] binder: 29880:29886 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.782436] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.782444] binder: 29887:29889 ioctl 40046207 0 returned -16 [ 1349.783313] binder: 29887:29889 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.783347] binder: 29887:29889 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.784061] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.790405] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.793020] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.807298] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.807305] binder: 29890:29895 ioctl 40046207 0 returned -16 [ 1349.808054] binder: 29890:29895 got transaction with invalid offset (0, min 24 max 40) or object. [ 1349.808088] binder: 29890:29895 transaction failed 29201/-22, size 40-16 line 3196 [ 1349.814668] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.815075] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.818349] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.823973] binder: undelivered TRANSACTION_ERROR: 29201 [ 1349.830184] binder_alloc: 29896: binder_alloc_buf, no vma [ 1349.830200] binder: 29896:29898 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.837907] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.859291] binder_alloc: 29901: binder_alloc_buf, no vma [ 1349.859309] binder: 29901:29906 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.861831] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.861841] binder: 29903:29908 ioctl 40046207 0 returned -16 [ 1349.864127] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.864133] binder: 29899:29909 ioctl 40046207 0 returned -16 [ 1349.864776] binder_alloc: 29901: binder_alloc_buf, no vma [ 1349.864794] binder: 29899:29909 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.866675] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.866681] binder: 29904:29910 ioctl 40046207 0 returned -16 [ 1349.867343] binder_alloc: 29901: binder_alloc_buf, no vma [ 1349.867358] binder: 29904:29910 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.878931] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.878938] binder: 29905:29912 ioctl 40046207 0 returned -16 [ 1349.879078] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.879085] binder: 29902:29911 ioctl 40046207 0 returned -16 [ 1349.879922] binder_alloc: 29901: binder_alloc_buf, no vma [ 1349.879939] binder: 29905:29912 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.879986] binder_alloc: 29901: binder_alloc_buf, no vma [ 1349.880069] binder: 29902:29911 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.881167] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.881173] binder: 29907:29913 ioctl 40046207 0 returned -16 [ 1349.882328] binder_alloc: 29901: binder_alloc_buf, no vma [ 1349.882345] binder: 29907:29913 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.886831] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.887644] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.890052] binder_alloc: 29900: binder_alloc_buf, no vma [ 1349.890072] binder: 29900:29914 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.896786] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.898059] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.902502] binder_alloc: 29921: binder_alloc_buf, no vma [ 1349.902520] binder: 29921:29924 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.926478] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.929700] binder_alloc: 29928: binder_alloc_buf, no vma [ 1349.929718] binder: 29928:29934 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.932406] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.932414] binder: 29929:29935 ioctl 40046207 0 returned -16 [ 1349.933250] binder_alloc: 29928: binder_alloc_buf, no vma [ 1349.933266] binder: 29929:29935 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.942287] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.942294] binder: 29923:29925 ioctl 40046207 0 returned -16 [ 1349.943113] binder_alloc: 29928: binder_alloc_buf, no vma [ 1349.943129] binder: 29923:29925 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.952038] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.953609] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.963866] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.967095] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.973868] binder_alloc: 29941: binder_alloc_buf, no vma [ 1349.973886] binder: 29941:29944 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.978564] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.984018] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.987829] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.987837] binder: 29942:29945 ioctl 40046207 0 returned -16 [ 1349.988654] binder_alloc: 29941: binder_alloc_buf, no vma [ 1349.988669] binder: 29942:29945 transaction failed 29189/-3, size 40-16 line 3133 [ 1349.994958] binder: BINDER_SET_CONTEXT_MGR already set [ 1349.994965] binder: 29939:29949 ioctl 40046207 0 returned -16 [ 1349.995738] binder: undelivered TRANSACTION_ERROR: 29189 [ 1349.996296] binder: 29939:29949 transaction failed 29189/-22, size 40-16 line 3010 [ 1350.001165] binder: 29940:29943 got transaction with invalid offset (0, min 0 max 0) or object. [ 1350.001186] binder: 29940:29943 transaction failed 29201/-22, size 0-16 line 3196 [ 1350.003372] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.003378] binder: 29947:29953 ioctl 40046207 0 returned -16 [ 1350.004181] binder: 29947:29953 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.004211] binder: 29947:29953 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.009031] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.009038] binder: 29951:29956 ioctl 40046207 0 returned -16 [ 1350.009778] binder: 29951:29956 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.009804] binder: 29951:29956 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.014265] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.016357] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.016362] binder: 29948:29957 ioctl 40046207 0 returned -16 [ 1350.017150] binder: 29948:29957 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.017182] binder: 29948:29957 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.021076] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.021084] binder: 29946:29954 ioctl 40046207 0 returned -16 [ 1350.021346] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.021351] binder: 29955:29960 ioctl 40046207 0 returned -16 [ 1350.022447] binder: 29955:29960 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.022477] binder: 29955:29960 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.029891] binder: 29946:29954 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.029922] binder: 29946:29954 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.039486] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.043856] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.043865] binder: 29964:29969 ioctl 40046207 0 returned -16 [ 1350.044704] binder: 29964:29969 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.044736] binder: 29964:29969 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.052082] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.053104] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.068977] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.072215] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.077756] binder_alloc: 29971: binder_alloc_buf, no vma [ 1350.077773] binder: 29971:29974 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.079145] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.084731] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.086970] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.086978] binder: 29975:29977 ioctl 40046207 0 returned -16 [ 1350.087652] binder_alloc: 29971: binder_alloc_buf, no vma [ 1350.087670] binder: 29975:29977 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.091739] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.099767] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.104429] binder_alloc: 29976: binder_alloc_buf, no vma [ 1350.104450] binder: 29976:29979 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.106387] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.111845] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.138957] binder: 29984:29988 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.138991] binder: 29984:29988 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.141516] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.141522] binder: 29987:29989 ioctl 40046207 0 returned -16 [ 1350.142656] binder: 29987:29989 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.142689] binder: 29987:29989 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.144037] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.144044] binder: 29985:29993 ioctl 40046207 0 returned -16 [ 1350.144698] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.144705] binder: 29980:29990 ioctl 40046207 0 returned -16 [ 1350.144763] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.144768] binder: 29986:29994 ioctl 40046207 0 returned -16 [ 1350.145623] binder: 29985:29993 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.145656] binder: 29985:29993 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.145867] binder: 29986:29994 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.145894] binder: 29986:29994 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.146194] binder: 29980:29990 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.146314] binder: 29980:29990 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.148546] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.148553] binder: 29983:29995 ioctl 40046207 0 returned -16 [ 1350.149306] binder: 29983:29995 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.149334] binder: 29983:29995 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.150416] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.150422] binder: 29981:29991 ioctl 40046207 0 returned -16 [ 1350.151196] binder: 29981:29991 got transaction with invalid offset (0, min 0 max 0) or object. [ 1350.151218] binder: 29981:29991 transaction failed 29201/-22, size 0-16 line 3196 [ 1350.161877] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.169096] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.169103] binder: 29982:29992 ioctl 40046207 0 returned -16 [ 1350.170036] binder: 29982:29992 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.170068] binder: 29982:29992 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.174185] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.183748] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.185876] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.185883] binder: 30001:30006 ioctl 40046207 0 returned -16 [ 1350.187066] binder: 30001:30006 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.187100] binder: 30001:30006 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.193104] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.193310] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.206970] binder: 30009:30012 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.207138] binder: 30009:30012 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.213043] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.219286] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.227061] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.233031] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.241390] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.261590] binder_alloc: 30015: binder_alloc_buf, no vma [ 1350.261608] binder: 30015:30017 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.272611] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.272618] binder: 30016:30025 ioctl 40046207 0 returned -16 [ 1350.274352] binder_alloc: 30015: binder_alloc_buf, no vma [ 1350.274368] binder: 30016:30025 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.275601] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.278578] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.278583] binder: 30020:30029 ioctl 40046207 0 returned -16 [ 1350.280622] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.280629] binder: 30023:30030 ioctl 40046207 0 returned -16 [ 1350.281737] binder: 30020:30029 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.281773] binder: 30020:30029 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.281999] binder: 30019:30026 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.282282] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.282288] binder: 30022:30027 ioctl 40046207 0 returned -16 [ 1350.282529] binder: 30023:30030 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.282559] binder: 30023:30030 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.282689] binder: 30022:30027 got transaction with invalid offset (0, min 0 max 0) or object. [ 1350.282708] binder: 30022:30027 transaction failed 29201/-22, size 0-16 line 3196 [ 1350.282979] binder: 30019:30026 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.298906] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.308924] binder: 30021:30028 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.309057] binder: 30021:30028 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.311086] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.311094] binder: 30031:30036 ioctl 40046207 0 returned -16 [ 1350.314332] binder: 30031:30036 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.314365] binder: 30031:30036 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.316239] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.316247] binder: 30038:30043 ioctl 40046207 0 returned -16 [ 1350.316983] binder: 30038:30043 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.317015] binder: 30038:30043 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.344317] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.352026] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.357702] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.364926] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.367619] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.370812] binder: 30051:30054 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.370845] binder: 30051:30054 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.374578] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.374583] binder: 30052:30055 ioctl 40046207 0 returned -16 [ 1350.375861] binder: 30052:30055 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.375894] binder: 30052:30055 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.381007] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.394075] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.397912] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.397997] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.398004] binder: 30056:30062 ioctl 40046207 0 returned -16 [ 1350.403621] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.403630] binder: 30058:30060 ioctl 40046207 0 returned -16 [ 1350.404400] binder: 30058:30060 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.404433] binder: 30058:30060 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.405903] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.405909] binder: 30059:30063 ioctl 40046207 0 returned -16 [ 1350.406758] binder: 30059:30063 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.406785] binder: 30059:30063 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.426885] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.426910] binder: send failed reply for transaction 32322 to 30056:30062 [ 1350.439567] binder: undelivered TRANSACTION_COMPLETE [ 1350.439575] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.439917] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.448593] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.469925] binder_alloc: 30072: binder_alloc_buf, no vma [ 1350.469944] binder: 30072:30080 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.472083] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.472091] binder: 30074:30078 ioctl 40046207 0 returned -16 [ 1350.472981] binder_alloc: 30072: binder_alloc_buf, no vma [ 1350.472996] binder: 30074:30078 transaction failed 29189/-3, size 40-8 line 3133 [ 1350.480315] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.480321] binder: 30076:30084 ioctl 40046207 0 returned -16 [ 1350.481258] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.481274] binder: 30076:30084 transaction failed 29189/-22, size 40-16 line 3010 [ 1350.482110] binder_alloc: 30071: binder_alloc_buf, no vma [ 1350.482126] binder: 30073:30085 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.482825] binder_alloc: 30071: binder_alloc_buf, no vma [ 1350.482841] binder: 30071:30081 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.483908] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.483915] binder: 30075:30083 ioctl 40046207 0 returned -16 [ 1350.484704] binder_alloc: 30071: binder_alloc_buf, no vma [ 1350.484720] binder: 30075:30083 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.493000] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.493008] binder: 30077:30082 ioctl 40046207 0 returned -16 [ 1350.494626] binder_alloc: 30071: binder_alloc_buf, no vma [ 1350.494641] binder: 30077:30082 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.498074] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.498080] binder: 30079:30086 ioctl 40046207 0 returned -16 [ 1350.499194] binder_alloc: 30071: binder_alloc_buf, no vma [ 1350.499212] binder: 30079:30086 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.506008] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.522092] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.542817] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.544486] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.546380] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.547637] binder_alloc: 30089: binder_alloc_buf, no vma [ 1350.547653] binder: 30089:30096 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.556187] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.556194] binder: 30098:30108 ioctl 40046207 0 returned -16 [ 1350.557253] binder_alloc: 30089: binder_alloc_buf, no vma [ 1350.557269] binder: 30098:30108 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.560832] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.572678] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.574893] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.574902] binder: 30111:30114 ioctl 40046207 0 returned -16 [ 1350.576298] binder: 30111:30114 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.576329] binder: 30111:30114 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.576633] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.576640] binder: 30110:30115 ioctl 40046207 0 returned -16 [ 1350.577509] binder: 30110:30115 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.577532] binder: 30110:30115 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.589455] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.596747] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.597001] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.597007] binder: 30112:30121 ioctl 40046207 0 returned -16 [ 1350.600717] binder: 30112:30121 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.600752] binder: 30112:30121 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.604216] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.604223] binder: 30117:30122 ioctl 40046207 0 returned -16 [ 1350.605092] binder: 30117:30122 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.606597] binder: 30117:30122 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.607315] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.612330] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.624174] binder: release 30105:30109 transaction 32345 out, still active [ 1350.624178] binder: unexpected work type, 4, not freed [ 1350.624181] binder: undelivered TRANSACTION_COMPLETE [ 1350.624213] binder: send failed reply for transaction 32345, target dead [ 1350.626176] binder: 30113:30120 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.626205] binder: 30113:30120 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.639351] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.648196] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.655544] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.679428] binder: 30136:30144 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.679463] binder: 30136:30144 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.681228] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.681236] binder: 30137:30142 ioctl 40046207 0 returned -16 [ 1350.682978] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.682984] binder: 30139:30141 ioctl 40046207 0 returned -16 [ 1350.683893] binder: 30137:30142 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.683923] binder: 30137:30142 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.684265] binder: 30139:30141 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.684292] binder: 30139:30141 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.684692] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.684698] binder: 30133:30143 ioctl 40046207 0 returned -16 [ 1350.686109] binder: 30133:30143 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.686137] binder: 30133:30143 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.693991] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.693998] binder: 30138:30147 ioctl 40046207 0 returned -16 [ 1350.694122] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.694127] binder: 30135:30145 ioctl 40046207 0 returned -16 [ 1350.694813] binder: 30138:30147 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.694889] binder: 30138:30147 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.697916] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.698836] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.698843] binder: 30140:30148 ioctl 40046207 0 returned -16 [ 1350.706788] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.706795] binder: 30134:30146 ioctl 40046207 0 returned -16 [ 1350.707748] binder: 30134:30146 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.707777] binder: 30134:30146 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.715661] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.715668] binder: 30157:30161 ioctl 40046207 0 returned -16 [ 1350.716354] binder: 30157:30161 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.716530] binder: 30157:30161 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.717261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.740675] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.745480] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.754293] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.762402] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.762410] binder: 30164:30170 ioctl 40046207 0 returned -16 [ 1350.765946] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.767995] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.768020] binder: send failed reply for transaction 32380 to 30140:30148 [ 1350.768673] binder: 30164:30170 transaction failed 29189/-22, size 40-16 line 3010 [ 1350.776508] binder: undelivered TRANSACTION_COMPLETE [ 1350.776516] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.781583] binder: 30172:30175 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.781622] binder: 30172:30175 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.783557] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.797323] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.797330] binder: 30180:30186 ioctl 40046207 0 returned -16 [ 1350.800490] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.800497] binder: 30171:30174 ioctl 40046207 0 returned -16 [ 1350.801235] binder: 30171:30174 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.801282] binder: 30171:30174 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.806914] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.806920] binder: 30173:30182 ioctl 40046207 0 returned -16 [ 1350.807798] binder: 30173:30182 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.807829] binder: 30173:30182 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.810962] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.810969] binder: 30177:30181 ioctl 40046207 0 returned -16 [ 1350.811924] binder: 30177:30181 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.811956] binder: 30177:30181 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.813632] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.813639] binder: 30178:30184 ioctl 40046207 0 returned -16 [ 1350.816315] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.816321] binder: 30176:30185 ioctl 40046207 0 returned -16 [ 1350.817239] binder: 30176:30185 got transaction with invalid offset (0, min 24 max 40) or object. [ 1350.817270] binder: 30176:30185 transaction failed 29201/-22, size 40-16 line 3196 [ 1350.818739] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.819335] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.819361] binder: send failed reply for transaction 32403 to 30178:30184 [ 1350.850082] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.854164] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.858705] binder: undelivered TRANSACTION_COMPLETE [ 1350.858712] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.873653] binder: undelivered TRANSACTION_ERROR: 29201 [ 1350.897727] binder_alloc: 30200: binder_alloc_buf, no vma [ 1350.897745] binder: 30200:30202 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.899278] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.899286] binder: 30206:30209 ioctl 40046207 0 returned -16 [ 1350.900020] binder_alloc: 30200: binder_alloc_buf, no vma [ 1350.900032] binder: 30206:30209 transaction failed 29189/-3, size 40-8 line 3133 [ 1350.900731] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.900738] binder: 30199:30212 ioctl 40046207 0 returned -16 [ 1350.901425] binder_alloc: 30200: binder_alloc_buf, no vma [ 1350.901439] binder: 30199:30212 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.906563] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.906570] binder: 30205:30214 ioctl 40046207 0 returned -16 [ 1350.908380] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.908386] binder: 30201:30208 ioctl 40046207 0 returned -16 [ 1350.910017] binder_alloc: 30200: binder_alloc_buf, no vma [ 1350.910034] binder: 30201:30208 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.911190] binder_alloc: 30200: binder_alloc_buf, no vma [ 1350.911205] binder: 30207:30210 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.911482] binder: BINDER_SET_CONTEXT_MGR already set [ 1350.911488] binder: 30204:30213 ioctl 40046207 0 returned -16 [ 1350.912491] binder_alloc: 30200: binder_alloc_buf, no vma [ 1350.912505] binder: 30204:30213 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.916194] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.924255] binder_alloc: 30203: binder_alloc_buf, no vma [ 1350.924272] binder: 30203:30211 transaction failed 29189/-3, size 40-16 line 3133 [ 1350.930092] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.938921] binder: undelivered TRANSACTION_ERROR: 29189 [ 1350.945280] INFO: task init:25961 blocked for more than 120 seconds. [ 1350.945285] Not tainted 4.9.91-gcc88c05 #69 [ 1350.945287] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1350.945306] init D28976 25961 1 0x00000000 [ 1350.945317] ffff8801ca8bb000 ffff8801be8ca4c0 ffff8801cd2a79c0 ffff88013f040000 [ 1350.945326] ffff8801db221b98 ffff8801d74af580 ffffffff838a75cb ffff8801d74af6e0 [ 1350.945335] 0000000000000046 00ffffff8107c7fd ffff8801db222468 ffff8801db222490 [ 1350.945337] Call Trace: [ 1350.945352] [] ? __schedule+0x67b/0x1ba0 [ 1350.945359] [] schedule+0x7f/0x1b0 [ 1350.945366] [] schedule_timeout+0x56c/0x10b0 [ 1350.945372] [] ? usleep_range+0x140/0x140 [ 1350.945380] [] ? do_dentry_open+0x607/0xc60 [ 1350.945389] [] ? mark_held_locks+0xaf/0x100 [ 1350.945397] [] ? _raw_spin_unlock_irq+0x27/0x50 [ 1350.945403] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 1350.945410] [] __down+0x128/0x1c0 [ 1350.945417] [] ? ww_mutex_unlock+0x300/0x300 [ 1350.945425] [] down+0x5e/0x80 [ 1350.945433] [] console_lock+0x2c/0x80 [ 1350.945441] [] ? kmem_cache_alloc_trace+0xfb/0x2a0 [ 1350.945447] [] console_device+0x1c/0xc0 [ 1350.945456] [] tty_open+0x425/0xdf0 [ 1350.945463] [] ? tty_init_dev+0x4b0/0x4b0 [ 1350.945470] [] ? chrdev_open+0xc7/0x4c0 [ 1350.945477] [] ? tty_init_dev+0x4b0/0x4b0 [ 1350.945482] [] chrdev_open+0x22b/0x4c0 [ 1350.945489] [] ? cdev_put.part.0+0x50/0x50 [ 1350.945496] [] do_dentry_open+0x607/0xc60 [ 1350.945503] [] ? cdev_put.part.0+0x50/0x50 [ 1350.945509] [] vfs_open+0x105/0x220 [ 1350.945516] [] ? may_open+0x231/0x2e0 [ 1350.945523] [] path_openat+0x5ac/0x2910 [ 1350.945530] [] ? path_lookupat+0x3f0/0x3f0 [ 1350.945537] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 1350.945545] [] ? __lock_is_held+0xa1/0xf0 [ 1350.945552] [] do_filp_open+0x197/0x290 [ 1350.945558] [] ? may_open_dev+0xe0/0xe0 [ 1350.945565] [] ? _raw_spin_unlock+0x2c/0x50 [ 1350.945572] [] ? __alloc_fd+0x1d7/0x510 [ 1350.945580] [] do_sys_open+0x366/0x620 [ 1350.945596] [] ? proc_sid_connector+0x36/0x200 [ 1350.945603] [] ? filp_open+0x70/0x70 [ 1350.945609] [] ? proc_clear_tty+0xd9/0x140 [ 1350.945616] [] ? _raw_write_unlock_irq+0x27/0x50 [ 1350.945624] [] SyS_open+0x2d/0x40 [ 1350.945630] [] ? do_sys_open+0x620/0x620 [ 1350.945638] [] do_syscall_64+0x1a4/0x490 [ 1350.945645] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 1350.945649] [ 1350.945649] Showing all locks held in the system: [ 1350.945654] 2 locks held by kworker/u4:0/6: [ 1350.945670] #0: ("events_unbound"){.+.+.+}, at: [] process_one_work+0x6f2/0x1610 [ 1350.945683] #1: ((&sub_info->work)){+.+.+.}, at: [] process_one_work+0x72c/0x1610 [ 1350.945689] 2 locks held by khungtaskd/514: [ 1350.945702] #0: (rcu_read_lock){......}, at: [] watchdog+0x125/0xa70 [ 1350.945715] #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x70/0x280 [ 1350.945732] 1 lock held by rsyslogd/3658: [ 1350.945744] #0: (&f->f_pos_lock){+.+.+.}, at: [] __fdget_pos+0x9f/0xc0 [ 1350.945747] 2 locks held by getty/3754: [ 1350.945759] #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 [ 1350.945772] #1: (&ldata->atomic_read_lock){+.+...}, at: [] n_tty_read+0x1f4/0x16c0 [ 1350.945780] 2 locks held by kworker/u4:3/20176: [ 1350.945792] #0: ("events_unbound"){.+.+.+}, at: [] process_one_work+0x6f2/0x1610 [ 1350.945804] #1: ((&sub_info->work)){+.+.+.}, at: [] process_one_work+0x72c/0x1610 [ 1350.945808] 2 locks held by kworker/u4:8/12257: [ 1350.945821] #0: ("events_unbound"){.+.+.+}, at: [] process_one_work+0x6f2/0x1610 [ 1350.945833] #1: ((&sub_info->work)){+.+.+.}, at: [] process_one_work+0x72c/0x1610 [ 1350.945837] 2 locks held by kworker/u4:9/12857: [ 1350.945850] #0: ("events_unbound"){.+.+.+}, at: [] process_one_work+0x6f2/0x1610 [ 1350.945862] #1: ((&sub_info->work)){+.+.+.}, at: [] process_one_work+0x72c/0x1610 [ 1350.945866] 2 locks held by kworker/u4:10/29531: [ 1350.945879] #0: ("events_unbound"){.+.+.+}, at: [] process_one_work+0x6f2/0x1610 [ 1350.945891] #1: ((&sub_info->work)){+.+.+.}, at: [] process_one_work+0x72c/0x1610 [ 1350.945894] 2 locks held by kworker/u4:11/31133: [ 1350.945907] #0: ("events_unbound"){.+.+.+}, at: [] process_one_work+0x6f2/0x1610 [ 1350.945919] #1: ((&sub_info->work)){+.+.+.}, at: [] process_one_work+0x72c/0x1610 [ 1350.945923] 1 lock held by init/25961: [ 1350.945935] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x407/0xdf0 [ 1350.945938] 1 lock held by init/25962: [ 1350.945949] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x407/0xdf0 [ 1350.945953] 1 lock held by init/25963: [ 1350.945965] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x407/0xdf0 [ 1350.945968] 1 lock held by init/25964: [ 1350.945979] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x407/0xdf0 [ 1350.945983] 1 lock held by init/25965: [ 1350.945994] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x407/0xdf0 [ 1350.945998] 1 lock held by init/25966: [ 1350.946010] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x407/0xdf0 [ 1350.946014] 2 locks held by kworker/u4:12/6105: [ 1350.946027] #0: ("events_unbound"){.+.+.+}, at: [] process_one_work+0x6f2/0x1610 [ 1350.946039] #1: ((&sub_info->work)){+.+.+.}, at: [] process_one_work+0x72c/0x1610 [ 1350.946042] [ 1350.946044] ============================================= [ 1350.946044] [ 1350.946047] NMI backtrace for cpu 1 [ 1350.946053] CPU: 1 PID: 514 Comm: khungtaskd Not tainted 4.9.91-gcc88c05 #69 [ 1350.946056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1350.946067] ffff8801d85ffd00 ffffffff81d95109 0000000000000000 0000000000000001 [ 1350.946075] 0000000000000001 0000000000000001 ffffffff810bb8f0 ffff8801d85ffd38 [ 1350.946083] ffffffff81da025d 0000000000000001 0000000000000000 ffff8801ca8bb418 [ 1350.946084] Call Trace: [ 1350.946093] [] dump_stack+0xc1/0x128 [ 1350.946100] [] ? irq_force_complete_move+0x390/0x390 [ 1350.946107] [] nmi_cpu_backtrace+0xfd/0x120 [ 1350.946114] [] ? irq_force_complete_move+0x390/0x390 [ 1350.946121] [] nmi_trigger_cpumask_backtrace+0x117/0x190 [ 1350.946128] [] arch_trigger_cpumask_backtrace+0x14/0x20 [ 1350.946134] [] watchdog+0x6f0/0xa70 [ 1350.946140] [] ? watchdog+0x125/0xa70 [ 1350.946148] [] kthread+0x26d/0x300 [ 1350.946154] [] ? reset_hung_task_detector+0x20/0x20 [ 1350.946160] [] ? kthread_park+0xa0/0xa0 [ 1350.946168] [] ? kthread_park+0xa0/0xa0 [ 1350.946174] [] ? kthread_park+0xa0/0xa0 [ 1350.946180] [] ret_from_fork+0x5c/0x70 [ 1350.946185] Sending NMI from CPU 1 to CPUs 0: [ 1350.946694] NMI backtrace for cpu 0 [ 1350.946696] CPU: 0 PID: 30219 Comm: modprobe Not tainted 4.9.91-gcc88c05 #69 [ 1350.946700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1350.946702] task: ffff8801161e9800 task.stack: ffff880141890000 [ 1350.946704] RIP: 0010:[] c [] memcmp+0x7f/0x160 [ 1350.946707] RSP: 0018:ffff880141897ab0 EFLAGS: 00000287 [ 1350.946709] RAX: 0000000000000000 RBX: ffff880141897b68 RCX: 00000000000000ff [ 1350.946712] RDX: ffff880141897ba8 RSI: ffff8801ce15edb0 RDI: 0000000000000007 [ 1350.946714] RBP: ffff880141897ad8 R08: ffffed0028312f60 R09: ffff880141897b60 [ 1350.946717] R10: 0000000000000008 R11: ffffed0028312f5f R12: dffffc0000000000 [ 1350.946719] R13: ffff8801ce15ed90 R14: 0000000000000048 R15: 0000000000000009 [ 1350.946722] FS: 0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 1350.946724] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1350.946726] CR2: 00007f4f12e83638 CR3: 00000001d92a4000 CR4: 0000000000160670 [ 1350.946729] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1350.946731] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1350.946732] Stack: [ 1350.946735] ffff880141897b28c ffffffff8107c7fdc 0000000000000000c 00000000580e1357c [ 1350.946737] ffff880141897b48c ffff880141897b38c ffffffff81e47a92c ffff8801024000c0c [ 1350.946740] 00000000000e1357c ffff880141897b60c 0000000000000000c fba96ff095704f5fc [ 1350.946742] Call Trace: [ 1350.946744] [] ? __save_stack_trace+0x7d/0xf0 [ 1350.946746] [] depot_save_stack+0x122/0x4a0 [ 1350.946748] [] save_stack+0xa3/0xd0 [ 1350.946750] [] ? save_stack_trace+0x16/0x20 [ 1350.946752] [] ? save_stack+0x43/0xd0 [ 1350.946754] [] ? kasan_kmalloc+0xad/0xe0 [ 1350.946756] [] ? kasan_slab_alloc+0x12/0x20 [ 1350.946758] [] ? kmem_cache_alloc+0xba/0x290 [ 1350.946760] [] ? prepare_creds+0x28/0x300 [ 1350.946762] [] ? SyS_access+0x9b/0x6c0 [ 1350.946765] [] ? do_syscall_64+0x1a4/0x490 [ 1350.946767] [] ? entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 1350.946769] [] ? filemap_map_pages+0x607/0xd70 [ 1350.946772] [] ? filemap_map_pages+0xfa/0xd70 [ 1350.946774] [] ? find_lock_entry+0x3e0/0x3e0 [ 1350.946776] [] ? handle_mm_fault+0x1b41/0x2460 [ 1350.946778] [] ? _raw_spin_unlock+0x2c/0x50 [ 1350.946780] [] ? handle_mm_fault+0x4ad/0x2460 [ 1350.946782] [] ? kasan_unpoison_shadow+0x35/0x50 [ 1350.946784] [] kasan_kmalloc+0xad/0xe0 [ 1350.946786] [] ? prepare_creds+0x28/0x300 [ 1350.946789] [] kasan_slab_alloc+0x12/0x20 [ 1350.946791] [] kmem_cache_alloc+0xba/0x290 [ 1350.946793] [] prepare_creds+0x28/0x300 [ 1350.946795] [] ? SyS_faccessat+0x6c0/0x6c0 [ 1350.946797] [] SyS_access+0x9b/0x6c0 [ 1350.946799] [] ? __do_page_fault+0x3bd/0xd40 [ 1350.946801] [] ? SyS_faccessat+0x6c0/0x6c0 [ 1350.946804] [] ? do_syscall_64+0x48/0x490 [ 1350.946806] [] ? SyS_faccessat+0x6c0/0x6c0 [ 1350.946808] [] do_syscall_64+0x1a4/0x490 [ 1350.946810] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 1350.946818] Code: c0c c0f c48 c89 cf7 c83 ce7 c07 c40 c38 cf9 c7f c08 c84 cc9 c0f c85 c87 c00 c00 c00 c0f cb6 c0e c29 cc8 c75 c5d c49 cbc c00 c00 c00 c00 c00 cfc cff cdf c48 c01 cda ceb c3f c<48> c89 cd8 c48 c89 cd9 c48 cc1 ce8 c03 c83 ce1 c07 c42 c0f cb6 c04 c20 c38 cc8 c7f c [ 1350.947199] Kernel panic - not syncing: hung_task: blocked tasks [ 1350.947206] CPU: 1 PID: 514 Comm: khungtaskd Not tainted 4.9.91-gcc88c05 #69 [ 1350.947209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1350.947220] ffff8801d85ffcb8 ffffffff81d95109 ffffffff83a8b220 ffff8801d85ffd90 [ 1350.947228] ffff8801ca8bb400 dffffc0000000000 ffffffff84409000 ffff8801d85ffd80 [ 1350.947237] ffffffff8142e791 0000000041b58ab3 ffffffff8418b7b0 ffffffff8142e5d5 [ 1350.947238] Call Trace: [ 1350.947246] [] dump_stack+0xc1/0x128 [ 1350.947254] [] panic+0x1bc/0x3a8 [ 1350.947263] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 1350.947270] [] ? printk_nmi_flush+0xb1/0xe0 [ 1350.947278] [] ? nmi_trigger_cpumask_backtrace+0x100/0x190 [ 1350.947284] [] watchdog+0x701/0xa70 [ 1350.947290] [] ? watchdog+0x125/0xa70 [ 1350.947296] [] kthread+0x26d/0x300 [ 1350.947303] [] ? reset_hung_task_detector+0x20/0x20 [ 1350.947309] [] ? kthread_park+0xa0/0xa0 [ 1350.947316] [] ? kthread_park+0xa0/0xa0 [ 1350.947323] [] ? kthread_park+0xa0/0xa0 [ 1350.947328] [] ret_from_fork+0x5c/0x70 [ 1350.948149] Dumping ftrace buffer: [ 1350.948204] (ftrace buffer empty) [ 1350.948206] Kernel Offset: disabled