0bce17e8a8822264290be3e2c35d9d84dea2f21ca860394113b680b9c54f2403dd07d863e375d14c91340a1b00336ab45916efeba0632e896e5683829dca56d4fc8f58df22275d17763dcf59ba5bf0602a9c23f80401df581d0ce8c1df51423947912a3b1e6de62302059d5245c31b3664b678a1bf1") ioctl$KVM_GET_DIRTY_LOG(r2, 0x4010ae42, &(0x7f0000000100)={0x10004, 0x0, &(0x7f0000ffc000/0x4000)=nil}) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r2, 0x4008ae48, &(0x7f00000000c0)=0x2000) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f0000000540)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000002880)={0x0, 0x20, &(0x7f0000002840)=[@in={0x2, 0x4e23, @multicast2=0xe0000002}, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}]}, &(0x7f00000028c0)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000002900)={r3, @in6={{0xa, 0x4e23, 0x1000, @remote={0xfe, 0x80, [], 0xbb}, 0x6}}, 0x200, 0x3ff}, &(0x7f00000029c0)=0x90) syz_genetlink_get_family_id$ipvs(&(0x7f0000002680)='IPVS\x00') setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000340)={0x2, {{0xa, 0x4e24, 0x5, @mcast2={0xff, 0x2, [], 0x1}, 0x4}}}, 0x88) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000efb000)='/dev/sequencer2\x00', 0x0, 0x0) 2018/04/13 16:41:10 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffea], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1007.520897] binder: 5350:5351 ioctl 40046207 0 returned -16 2018/04/13 16:41:10 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000ffffffff00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:10 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f00000000c0)={0x10}, 0x8, &(0x7f0000000000)={&(0x7f000075b000)=@ipv6_newroute={0x2c, 0x18, 0x301, 0x0, 0x0, {0xa}, [@RTA_ENCAP_TYPE={0x8, 0x15, 0x7}, @RTA_ENCAP={0x8, 0x16, @nested={0x4, 0x1}}]}, 0xfffffe9d}, 0x1}, 0x0) 2018/04/13 16:41:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000000000000fffffdfd000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:10 executing program 2: perf_event_open(&(0x7f00004b2000)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000799000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x100) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f00000000c0)={0x2, {{0x2, 0x4e22, @loopback=0x7f000001}}}, 0x88) io_setup(0x5d3, &(0x7f0000000080)) 2018/04/13 16:41:10 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xf00, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1007.638943] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:10 executing program 6: perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0x2275, &(0x7f0000000000)) getsockopt$inet_dccp_int(r0, 0x21, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x4) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.threads\x00', 0x2, 0x0) 2018/04/13 16:41:10 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1007.702666] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1007.721934] binder: 5389:5392 got transaction with invalid offsets ptr [ 1007.764344] binder: 5389:5392 transaction failed 29201/-14, size 40-8 line 2991 [ 1007.798637] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1007.822469] binder: BINDER_SET_CONTEXT_MGR already set [ 1007.859322] binder: 5389:5392 ioctl 40046207 0 returned -16 2018/04/13 16:41:10 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f000076c000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000774ff6)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f0000777000)=@file={0x1, './file0\x00'}, 0xa) r2 = perf_event_open(&(0x7f0000000180)={0x7, 0x70, 0x101, 0x2, 0x4000000000, 0x3, 0x0, 0x401, 0x4, 0x5, 0x0, 0x52, 0x76, 0x5, 0x80, 0x2, 0x8000, 0x7, 0x40, 0x5, 0x7ff, 0x0, 0x7, 0x7, 0x7, 0x6, 0x6, 0xf3, 0x8b, 0x3, 0x10001, 0x1f, 0x7, 0xffffffff, 0x75d, 0x100, 0x20, 0x8, 0x0, 0xffffffff80000001, 0x0, @perf_bp={&(0x7f0000000140), 0x8}, 0x400, 0x0, 0x0, 0x0, 0x8001, 0xffffffff00000001, 0x9}, 0x0, 0x4, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0x6) connect$unix(r0, &(0x7f000071eff8)=@file={0x1, './file0\x00'}, 0xa) socketpair$inet6(0xa, 0x0, 0x80000000, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_dccp_buf(r3, 0x21, 0x0, &(0x7f0000000280)=""/103, &(0x7f0000000240)=0x67) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={0xffffffffffffffff, 0x28, &(0x7f0000000100)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r4, 0x2, 0x8}, 0xc) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x47, 0x0) 2018/04/13 16:41:10 executing program 4: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x480042, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f0000014000)='/dev/snd/timer\x00', 0x0, 0x0) getresuid(&(0x7f00000000c0), &(0x7f00000007c0)=0x0, &(0x7f0000000800)) getresgid(&(0x7f0000000180)=0x0, &(0x7f00000001c0), &(0x7f0000000200)) chown(&(0x7f0000000100)='./file0\x00', r2, r3) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f0000000000)={0x3, 0x0, 0x0, 0x3}) fallocate(r1, 0x3, 0x0, 0x0) readv(r1, &(0x7f0000000740)=[{&(0x7f00000002c0)=""/199, 0xc7}, {&(0x7f00000003c0)=""/165, 0xa5}, {&(0x7f0000000480)=""/252, 0xfc}, {&(0x7f0000000580)=""/138, 0x8a}, {&(0x7f0000000640)=""/210, 0xd2}], 0x5) fstat(r0, &(0x7f0000000240)) 2018/04/13 16:41:10 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:10 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xa00, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:10 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fchdir(r0) r1 = syz_open_procfs(0x0, &(0x7f0000044000)='ns/mnt\x00') ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f0000000040)={0x1, 0x4, 0x8, 0x9, 0xa26a, 0x8680}) 2018/04/13 16:41:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:10 executing program 6: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x4000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000159fe4)={0x5, 0x1, 0x7d, 0x200000000000000c}, 0x1c) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x200, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r2, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0xd, 0x4, 0x4, 0x80bd, 0x0, r1}, 0x2c) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000000), &(0x7f0000001080)=0x4) ioctl$DRM_IOCTL_DROP_MASTER(r2, 0x641f) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f00000010c0)={0x20, {{0xa, 0x4e23, 0x8b8, @dev={0xfe, 0x80, [], 0x12}, 0x40}}}, 0x88) 2018/04/13 16:41:10 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1007.908230] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:10 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1007.979485] binder: 5424:5425 got transaction with invalid offsets ptr [ 1008.001189] binder: 5424:5425 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:10 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x2, 0x20010, 0xffffffffffffffff, 0x2) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000180)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000838fe0)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) readv(0xffffffffffffffff, &(0x7f0000debfd8), 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) futex(&(0x7f0000012ffc), 0x1, 0x0, &(0x7f0000000000), &(0x7f00003cfffc), 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000f8d000)={&(0x7f0000012000/0x2000)=nil, 0x2000}) 2018/04/13 16:41:10 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x2, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1008.034252] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1008.039424] binder: BINDER_SET_CONTEXT_MGR already set [ 1008.058459] binder: 5424:5425 ioctl 40046207 0 returned -16 2018/04/13 16:41:10 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:10 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000080)="0f01b4c6af51c465b9fe030000b800000100ba000000000f30660f38802a0f01f3c4e1e65a14b28fe828b6480d00f20f001666ba420066b80c6666ef66baf80cb888018b8bef66bafc0cb083eec4e2f9237c9705", 0x54}], 0x1, 0x30, &(0x7f0000000100), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2018/04/13 16:41:10 executing program 2: r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x80000, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20000000000000, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6af7, 0x0, 0x0, 0x6, 0x0, 0x0, 0x8, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, r0, 0x3) setrlimit(0x7, &(0x7f000046eff0)) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e20, 0x401, @mcast1={0xff, 0x1, [], 0x1}, 0x7}, 0x1c) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x1, &(0x7f0000001fe8)=ANY=[@ANYBLOB="c1b801006b9b3a8d77"], &(0x7f0000003ff6)='syzkaller\x00', 0xffffffff, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) ioctl$TIOCMSET(r0, 0x5418, &(0x7f00000003c0)=0x101) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="b4000000000000002500000000000000070000000000000000000000000000009500000000000000e70e369056c6d5272d0606c04e943d388c358bc4dd21875b8f75e2d8c59ecfe3eb5c57a4898848fbf9a8a79ee6c092587df96a877c4d7b7ddd9d0ee4ac89524a0dd6735490bcff0aecc7cf1ba241cb54d925a8e1960ea3e3366c0e0a0b8c1cd0b2b93335ebd110e613896785e16a21faaa59bd9b4af3db0e36f38505924968b45a2d6b2bcfde3db43d1cfe03237c718df675621379ac158e8052f096af5fc96086236917d6c5aac4"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x437, &(0x7f000000cf3d)=""/195}, 0x48) r1 = socket$inet6_sctp(0xa, 0x80000000005, 0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000001000)={0x0, @in6={{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x98) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001000)={{{@in=@rand_addr, @in6=@mcast1={0xff, 0x1, [], 0x1}}}, {{@in=@multicast2=0xe0000002}, 0x0, @in6=@mcast1={0xff, 0x1, [], 0x1}}}, 0xe8) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x30, &(0x7f0000001000)=""/144, &(0x7f0000001ffc)=0x90) set_thread_area(&(0x7f0000000280)={0x6, 0x100000, 0x2000, 0x53, 0x7ff, 0x80000001, 0x2053, 0x3, 0x400, 0xfffffffffffffe01}) mq_notify(r0, &(0x7f0000000380)={0x0, 0x17, 0x4, @thr={&(0x7f00000002c0)="d64f6bf3e1f33aafe3d517f3522643dc36f0cafbb99d1ff74128b64562fa3c74660e28aa7e20007d2311daa1150be88a0eeb402269f173209e59414bc70e6f3a66a0637fee41f59f0097f5978d114077ba3100f8c54835f4", &(0x7f0000000340)="7cc5"}}) [ 1008.136221] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000d0cd010000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1008.188673] binder: undelivered TRANSACTION_ERROR: 29201 [ 1008.233693] binder: 5453:5454 got transaction with invalid offsets ptr [ 1008.264766] binder: 5453:5454 transaction failed 29201/-14, size 40-8 line 2991 [ 1008.320422] binder: BINDER_SET_CONTEXT_MGR already set [ 1008.333286] binder: 5453:5454 ioctl 40046207 0 returned -16 [ 1008.360105] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:11 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465e4ffffff00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:11 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x34000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:11 executing program 2: r0 = socket$inet6(0xa, 0x2100000000000002, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in=@multicast2=0xe0000002, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14}, 0x0, 0x33}, 0x0, @in=@broadcast=0xffffffff}}, 0xe8) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x4000, 0x0) accept4$packet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000000c0)=0x14, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x4}, 0x1c) 2018/04/13 16:41:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:11 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000280)={0xfff, 0x3, 0x5bf8, 'queue1\x00', 0x2}) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='io\x00') bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'crct10dif\x00'}, 0x58) r3 = accept4$alg(r0, 0x0, 0x0, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f00000001c0), &(0x7f0000000100)=0xfffffffffffffd19) sendfile(r3, r2, &(0x7f0000000080)=0xfffffffffffffffd, 0x3f) 2018/04/13 16:41:11 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00009c8000)="636c6561725f72656673007edb") r2 = socket(0xa, 0x2, 0x88) r3 = fcntl$dupfd(r2, 0x0, r2) connect$unix(0xffffffffffffffff, &(0x7f0000fa8000)=@abs={0xfffffffffffffffe}, 0x8) r4 = socket$netlink(0x10, 0x3, 0x4) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x2, 0x0, [0x20000380, 0x0, 0x0, 0x200003b0, 0x200003e0], 0x0, &(0x7f0000000080), &(0x7f0000000780)=ANY=[@ANYBLOB]}, 0x78) sendmsg$netrom(r2, &(0x7f0000000300)={&(0x7f0000000140)=@ax25={0x3, {"babcc3a81b7f94"}}, 0x10, &(0x7f00000004c0)=[{&(0x7f00000001c0)="705857a91a6c68d86a6b4cc3417ef74c77b6d0762cd475473645e83491a2b2773c2dff2e9aea0e125766f12981de36bf6a75df2dd2ac4da517692c808d6055892aaddac30d999e43e465b9ead0dbbd254206dc747097c11e7aaa31868b60877414ed69e80de20f862a3cb1535d271c13bfc313a41167a3b1f15330ce715904656afafe7e0f8a42e48738d4837a113bce014569ced980d3d7c9fd9b84431b0da351751139a5740398d88e1c7279f565ca5776e3651318bce1", 0xb8}], 0x1, 0x0, 0x0, 0x20044800}, 0x10) writev(r4, &(0x7f00001a5ff0)=[{&(0x7f0000086fa8)="480000001400197f00bb4b01fd0d8c560a880000f217e0020000001d000000a2bc560000000000000200000028213ee206000000000000ffff5bffff001ce1ed5e00000000000000", 0x48}], 0x1) ioctl$DRM_IOCTL_ADD_CTX(r3, 0xc0086420, &(0x7f0000000540)={0x0}) ioctl$DRM_IOCTL_UNLOCK(r3, 0x4008642b, &(0x7f0000000580)={r5, 0x8}) clock_nanosleep(0x0, 0x0, &(0x7f00006ba000)={0x0, 0x1c9c380}, &(0x7f0000daaff8)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000180)=0x0) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000280)=0x0) kcmp$KCMP_EPOLL_TFD(r6, r7, 0x7, r1, &(0x7f0000000380)={r1, r2, 0x4}) modify_ldt$write2(0x11, &(0x7f0000000000)={0x200, 0xffffffff, 0x0, 0x10, 0x0, 0x0, 0x6, 0x3}, 0x10) writev(r1, &(0x7f0000000340)=[{&(0x7f00000002c0)='4', 0x1}], 0x1) getsockopt$inet_tcp_int(r0, 0x6, 0xb, &(0x7f0000000040), &(0x7f0000000ffc)=0x4) 2018/04/13 16:41:11 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='gid_map\x00') getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x80000001, 0xa, [0x7fffffff, 0x0, 0x95, 0x2, 0xfffffffffffffffd, 0xdaa, 0x0, 0x8, 0x15, 0x20]}, &(0x7f00000001c0)=0x1c) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f00000002c0)={0x0, 0x1f}) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000280)={r2, 0x5}, 0xc) write$vnet(r1, &(0x7f0000000140)={0x1, {&(0x7f0000000040)=""/100, 0x64, &(0x7f00000000c0)=""/107}}, 0x68) 2018/04/13 16:41:11 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1009.067446] binder: 5473:5474 got transaction with invalid offsets ptr [ 1009.088646] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1009.106270] binder: 5473:5474 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:11 executing program 2: ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000100)={0x0, 0x80000, 0xffffffffffffff9c}) ioctl$DRM_IOCTL_VERSION(r1, 0xc0406400, &(0x7f0000000380)={0x4, 0x3, 0x1ff, 0xdd, &(0x7f0000000140)=""/221, 0x95, &(0x7f0000000240)=""/149, 0x77, &(0x7f0000000300)=""/119}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x8a) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000040)={0xfffffffffffffffb, 0x4, 0x9, 0x0, 0x6, 0xb6c, 0x8, 0x6, 0x3ff, 0x0, 0x0, 0x1, 0x0, 0x3, 0x19f7, 0x0, 0x1, 0x4, 0x4}) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4040aea0, &(0x7f0000460fe4)={0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x805, 0x0, 0x1}) ioctl$DRM_IOCTL_GEM_CLOSE(r3, 0x40086409, &(0x7f00000003c0)={r0}) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x100, 0x0, 0x9000}, 0x4) [ 1009.123823] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x500000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:11 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000006ff6)='/dev/dsp#\x00', 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$int_in(r0, 0x800000c0045003, &(0x7f0000000000)) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) [ 1009.164361] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1009.179601] binder: 5473:5474 ioctl 40046207 0 returned -16 [ 1009.297293] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:12 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:12 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute0\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000000000000000006cc000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:12 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000b9bff0)={0x2, 0x4e21, @multicast1=0xe0000001}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) sendto$inet(r0, &(0x7f0000000180), 0x230, 0x20020003, &(0x7f0000385ff0)={0x2, 0x4e21, @loopback=0x7f000001}, 0x10) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x0, 0x0) fallocate(r1, 0x2, 0x80000001, 0x80000000) setsockopt$netrom_NETROM_T2(r1, 0x103, 0x2, &(0x7f00000000c0)=0x10000, 0x4) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x7, 0x0, 0xa000}, 0x4) connect$netlink(r1, &(0x7f0000000100)=@kern={0x10, 0x0, 0x0, 0x40000000}, 0xfffffffffffffef0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000180)={0x0, 0x8001}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000200)={r2, 0x800}, &(0x7f0000000240)=0x8) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x1, 0x7, 0x8000}, 0x4) 2018/04/13 16:41:12 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xe00000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:12 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x1d, 0xffffffffffffffff, 0xfffffffffffffffc) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f000082ef0a)=""/246) ioctl$EVIOCGREP(r0, 0x8004745a, &(0x7f0000000000)=""/174) 2018/04/13 16:41:12 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x102) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000440), &(0x7f0000000480)=0x8) write$evdev(r0, &(0x7f0000000040), 0x0) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000140)=""/253) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffff9c}) getpeername$ax25(r1, &(0x7f0000000080), &(0x7f00000000c0)=0x10) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000400)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 2018/04/13 16:41:12 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(aes-generic)\x00'}, 0x80) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000024c0)=[{0x0, 0x0, &(0x7f0000002480)=[{&(0x7f0000002380)="c36012ab54fcefa9bd72fc401b83da787ecab0da949ebd15807138bfd587a0c063", 0x21}], 0x1}], 0x1, 0x0) [ 1009.582439] binder: 5513:5526 got transaction with invalid offsets ptr [ 1009.604757] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1009.616846] binder: 5513:5526 transaction failed 29201/-14, size 40-8 line 2991 [ 1009.651869] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:12 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1009.678891] binder: 5513:5526 ioctl 40046207 0 returned -16 [ 1009.706985] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:12 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1009.830178] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:12 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465980300", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1009.896566] binder: 5538:5539 got transaction with invalid offsets ptr 2018/04/13 16:41:12 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x20010010, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:12 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000505000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = dup3(r3, r2, 0x0) r5 = fcntl$getown(0xffffffffffffff9c, 0x9) syz_open_procfs(r5, &(0x7f0000000040)='net/tcp\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000decfe0)={0x10005, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000460fe4)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f00000d5000/0x18000)=nil, &(0x7f0000de9000)=[@text64={0x40, &(0x7f0000bfefbf)="0f20d835200000000f22d80f0118470f35f3ab77644ebe0f59128182818201bc8c6a000000674b0f015e9dc483996ba7d900f300004f4f21ae5ddc", 0x3b}], 0x1, 0x0, &(0x7f0000753ff0), 0x0) ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f0000000000)={0xfffffffffffffffa}) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 1009.946232] binder: 5538:5539 transaction failed 29201/-14, size 40-8 line 2991 [ 1010.000996] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:12 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:12 executing program 4: mmap(&(0x7f0000000000/0xd17000)=nil, 0xd17000, 0x3, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket(0x10, 0x4000000002, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f00000000c0)=@add_del={0x2, &(0x7f0000000040)='nr0\x00', 0x22}) pwritev(r0, &(0x7f0000000580)=[{&(0x7f0000000180)="c7b7281966de0359b83f3476de82297798d12d450e7a8e6210caee02ad9ea5f8382007c1afa0583572283e7144f7360c749d8b2ded2dbf066fb642665bc573bc1cfb0c0f790bca3cfc70835688a3d86fef", 0x51}, {&(0x7f00000002c0)="de1e02b8da67c060287896aea150fd77ba0ff167bf21e87035002dcdce6db49c0bc78701af696cd29ef147d162fb5f575569d12b1586e87902ca7691f20cf3b3bdc594929f18f8b0a2f56fb78c9f4f991e7212e5f7dbb12fda1d5d988b2c9ce090a4c564081639f7604437482011c5f772eb24c0e3805462afac91f2b66eb92904ed01f33e60f387de038f3bafac42b0a3b705b4375e8769ccb4e11592738b16ab75af18daa8cbbfaa09175f3eaa25f2ee3588a0955ac9d76a1a2ca2f8e06a3f3ceb849efe964141c1f6f73413b241a3cff323", 0xd3}, {&(0x7f00000003c0)="e9d356c62aa2f63dd75c3c49253379948cf0e60a3fdfc7d46c33264e9a54a4f8519dc39f82fc861da2eb335217a097f9717e87c9e739f06b91b84c638c917a6dc66ea20dc095ae", 0x47}, {&(0x7f0000000100)="2eaa17975f4dd3a391faaed66deb787b8d879260e2fdbf9ab50c9fa0a39f", 0x1e}, {&(0x7f0000000440)="0eda11aeb1e980d5cc69133d05e88592c90c803fed1e0f0a1c62ae49122957ad9da892b6b7104f59ca0258e604b1bf6c6260615a96a52673fcdf95af05df725b761f79d20d7ecaba388cbbd712552a35168f0a9f01ae84efb4cece8203bc3e8af59e5ea7c240797d0569e258e7f77ec7452907d4cb3845b9354774", 0x7b}, {&(0x7f00000004c0)="22167a3fec0e91d2c0185213c851ecf1924c1256fae487edcadc549cfc2eb742817f045fee2cbcdadcddb4f2fd8809a4d8c015ab8d5f24d749126bcd6a18148962cf21519874c83765dad9e1a000cedb4e4ed5cb0499301bfa5038a5f4664b11b0893dbffd5add1af38a38b5714fac658ee6da25f059b8ef95c0fce2033fa60d7a601606ba74bf1fe9", 0x89}], 0x6, 0x0) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000000), 0x10) sendmsg$nl_route(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001500010c000000000000000000000000"], 0x1}, 0x1}, 0x0) accept4$inet(r1, &(0x7f0000000200), &(0x7f0000000600)=0x10, 0x80000) setsockopt$inet_tcp_int(r0, 0x6, 0x13, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f00005ceffc)=0xffffffffffff8001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[{0x2, 0x6}, {0x7}, {0x0, 0xd5}], 0x3) [ 1010.029238] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1010.046730] binder: 5538:5539 ioctl 40046207 0 returned -16 2018/04/13 16:41:12 executing program 6: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x100, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r1 = socket$netlink(0x10, 0x3, 0x18) sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv4_delroute={0x2c, 0x19, 0x0, 0x70bd27, 0x25dfdbfd, {0x2, 0x94, 0x80, 0x8, 0xff, 0x0, 0xff, 0x0, 0x1000}, [@RTA_PREFSRC={0x8, 0x7, @local={0xac, 0x14, 0x14, 0xaa}}, @RTA_ENCAP_TYPE={0x8, 0x15, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000800) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x800, 0x0) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r0, 0x111, 0x5, 0x5, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000999000)="390000001300094700bb61e1c3e4ffff0600000001000000450000002000000019000a000d0000000000280f00000007fd17e9ffff06060400", 0x39}], 0x1) [ 1010.079817] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:13 executing program 6: keyctl$restrict_keyring(0x1d, 0xfffffffffffffffe, &(0x7f0000128ff6)='id_legacy\x00', &(0x7f0000242000)='logon\x00') r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x10) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000080)=0xfffffffffffffff8, 0x4) 2018/04/13 16:41:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000001ce1c00000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:13 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500ffffffe400", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1010.278674] binder: undelivered TRANSACTION_ERROR: 29201 [ 1010.578688] binder: 5572:5580 got transaction with invalid offsets ptr [ 1010.587590] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1010.602329] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1010.614201] binder: 5572:5580 transaction failed 29201/-14, size 40-8 line 2991 [ 1010.649966] binder: BINDER_SET_CONTEXT_MGR already set [ 1010.655449] binder: 5572:5580 ioctl 40046207 0 returned -16 [ 1010.699697] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:13 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x8000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:13 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:13 executing program 4: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x4e21}, 0x10) syz_emit_ethernet(0x423, &(0x7f000018f000)={@link_local={0x1, 0x80, 0xc2}, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0xffffffffffffffff, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @dccp={{0x4e20, 0x4e21, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d73cde", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) syz_emit_ethernet(0x423, &(0x7f000018f000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0xffffffffffffffff, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @dccp={{0x4e20, 0x4e21, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d73cde", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) poll(&(0x7f0000a5b000)=[{r0}], 0x1, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000000)={'filter\x00'}, &(0x7f0000000080)=0x78) 2018/04/13 16:41:13 executing program 6: r0 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000002ec0)) r1 = syz_open_dev$evdev(&(0x7f0000003280)='/dev/input/event#\x00', 0x81c, 0x200) ioctl$TIOCSCTTY(r0, 0x540e, 0x727) r2 = perf_event_open(&(0x7f0000223000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1000000000001, 0x5, 0x8400000000003, 0xffffffff00000005}, 0x2c) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000002f00)={0x0, &(0x7f0000002ec0)}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000200)="fefa0900000000000000cd3339d576e0847e867e064f9c7bc75a49409e0a58348ea6d88f0124ec004614cf6c2833803e4195ba888618945411194bf24c555e1488cce8", &(0x7f0000000180), 0x1}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r3, &(0x7f0000000280), &(0x7f0000000340)=""/214}, 0x18) sync_file_range(r1, 0x9, 0x8, 0x1) ioctl$PPPOEIOCSFWD(r1, 0x4008b100, &(0x7f00000035c0)={0x18, 0x0, {0x2, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x17}, 'lo\x00'}}) connect$netrom(r0, &(0x7f00000038c0)=@ax25={0x3, {"c76d01a010fcb0"}, 0x3b498999}, 0x10) clock_gettime(0x0, &(0x7f0000003840)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003700)=[{{&(0x7f0000000180)=@llc, 0x80, &(0x7f0000000900)=[{&(0x7f0000000280)=""/9, 0x9}, {&(0x7f00000002c0)=""/55, 0x37}, {&(0x7f0000000440)=""/212, 0xd4}, {&(0x7f0000000540)=""/68, 0x44}, {&(0x7f00000005c0)=""/254, 0xfe}, {&(0x7f00000006c0)=""/145, 0x91}, {&(0x7f0000000780)=""/139, 0x8b}, {&(0x7f0000000840)=""/192, 0xc0}], 0x8, &(0x7f0000000980)=""/239, 0xef, 0x9}, 0x20000}, {{&(0x7f0000000a80)=@nfc_llcp, 0x80, &(0x7f0000001c00)=[{&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000000300)=""/3, 0x3}, {&(0x7f0000001b00)=""/245, 0xf5}], 0x3, &(0x7f0000001c40)=""/161, 0xa1}, 0x3}, {{&(0x7f0000001d00)=@generic, 0x80, &(0x7f0000002e80)=[{&(0x7f0000001d80)=""/40, 0x28}, {&(0x7f0000001dc0)=""/69, 0x45}, {&(0x7f0000001e40)=""/4096, 0x1000}, {&(0x7f0000002e40)=""/35, 0x23}], 0x4, &(0x7f0000003a00)=""/215, 0xd7, 0x4}, 0xda}, {{&(0x7f0000002fc0)=@nfc, 0x80, &(0x7f0000003300)=[{&(0x7f0000003040)=""/210, 0xd2}, {&(0x7f0000003140)=""/42, 0x2a}, {&(0x7f0000003180)=""/123, 0x7b}, {&(0x7f0000003200)=""/97, 0x61}, {&(0x7f0000003280)}, {&(0x7f00000032c0)=""/16, 0x10}], 0x6, &(0x7f0000003380)=""/10, 0xa, 0x38}, 0xfffffffffffffffb}, {{&(0x7f00000033c0)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000003600)=[{&(0x7f0000003440)=""/86, 0x56}, {&(0x7f00000034c0)=""/183, 0xb7}, {&(0x7f0000003580)=""/40, 0x28}, {&(0x7f00000035c0)}], 0x4, &(0x7f0000003640)=""/162, 0xa2, 0x2}, 0x81}], 0x5, 0x10000, &(0x7f0000003880)={r4, r5+30000000}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f00000039c0)="45f42a795c57250100000002") r6 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r6, 0x84, 0x6e, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x5, @local={0xfe, 0x80, [], 0xaa}, 0x5}, @in6={0xa, 0x4e23, 0xb3fe, @mcast1={0xff, 0x1, [], 0x1}, 0x400}], 0x38) 2018/04/13 16:41:13 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500980300", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:13 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = getpgrp(0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000040)={0x0, r1}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f0000000280), 0xfffffffffffffe74, 0x20008045, &(0x7f0000000240)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f0000260000)="11a58fde7649496403db92ed306004b3d3cbfc195485c3b895d864ab91a3aebde4f70a917a91ec9612d004000a7b43a35bb73249ede41bf5c05ab608fb7b74ffd57f6e8e43cf9cb723fc0d8d8cabbbbae3a5fde8ad6f52d667c512596f50b9962aa2193688d872a7eeca57801742d74d39c4b003a5e292e077ed102e7999329aab95a3d96363505f76c86a6d2352dd8025207ae531701f1ce353d6b017eb64000000bc2e9f8b66fe4a8e64f0fc7a0aa55d4103e1d7d5b0dd5750071e9b3a786021678a86fcbb0b9f9364ec0f0310306fef9c21b3b20d8b44423b495299cea2c6f40c377a72534453ad7f5af27b1efb2514ace1f9a68cf205a9ddb8fd954e34bde3612e6e05686cf3b968a14bd3a356f7b8d20214c0f7a388ef5ea8d063c65f2aabff685e69f86b4a0b3697f8bfbfe66796f0489ad2e49bdbc1742941c28c88cb93e1f8ccc3db4782cdf9cbd797ddc8d7b1364da50ad48e081a38622280169eba09000000b5f15bdf8a8b6483340a3297c31154905db209195c28f15d10153204fbe0586516c714ddc939e0eb68c73969e81fc6f215b476ddf3fcf1a604603360089dadba2779cfed9027ac163067fc0d7592ac8a013b907372a42b242405241ac1f63f85a52fff2d78b30e87a156b5cfa133dabc259bb027bec5eb8c8eb623e9776a13d3ce972a6769de8a78153f498084a244b0146b77be3d1cba7b02fe8906ed8a88f105c763d1772825b986d52823bf38b6f95eca494fd9c64497874b9f450bec65311493cc108b27611eaa6819305a3730d29368f25f7e816d60884a1e0271c3c786ad36391366ac3b65f04c148974f6973005c5ff73d6f0b3f7e44c65da7c4115c4ee543991e4ad26938384cafffffffc8f7e79aaf1b8ef80f627e3c7168ecda2cf224a491bea6129fcd954b88dbb2d29464931bcd5378041db67ddc70ee856ae09c1b26b9ada008a7d52bf1a160606865a29794f36b2a3811c66e9fe27af8fc8356374e37f3eca244367fb535dde71fae4683710761b89e28820d4f06065450c3d1f76fa26ef28320edf6c36480af14f4444edb40ebb3f8ea264486e351c40c7e43c7a69c24da10db6f60da3e648f16b5fc6b5a5c6217e46c1f3ff354a8b49beb3b46a69dcb4c5d547a7b7ba8fe22da0173f9fe80f4bd47afbec4d2e0d3c91b1a326d8bb9fded873e87f847032af52bd6d129f3ce3f11ea9d0b4250af7eaa2649d9972b9b8dc773c869b3a431eac7f55d6bb92dc29f0eb7d8959e2af7571efb7ec88eac4b62850e8f6b60d4a5d06d66875b4bd260a9014a2eb88621f4c6eb3f9ed2190b48acf0358d8b82fb4794535fcb8dd50ba86d23d230a94f07a768142ff3b4c8558dac21726b6279980c238041f26e86c8e3fa83028345999ff4e5a37d610ab7c15daaffb744a505a3dd9802b3721f29553ee23e1cf376f12cc3fe6b7ac76bd13da44356855be096155e355c9cad31fcdeedc6679c531bc1a2765dc8777108ec5e31d793005e718a9ced77d6505e44f649128a29f5264fecba132f9f5016eaf690751edd64d903b36ceb2b08042c60e9e97f8bc985476e6088a5ebd3743c2358171b30b16d730a5dd49c92fa19cc267e2c1927f200fc3d23a804f0a12b06a6a88a2685051ab28f1721209ada2c14b557a49423795b07040d510bb21ce5d15acedd18cb7cb7a93389c8d934206e4ffb220048a7a82fb3c251d0a31ba5af9eb0c16e29f33f9d0a78f5e6300cf04d17eb5f67711cafa0d4e99eeaf0f8fdbd34170318879a0d12c01891127ba7b677d204268524c5af1d7dc27176826302e34f9d35d2f2eefad5f22f68929d3456c11d5f00d4a8ce8b784bca8088805731eff2d47024c2da68abc2d2c0f7806d7d76cdf489f3bffa75cb826bc0809331d89a3255a498b8150d4ae31d03414ab244939455b6377c2917cb2d8a9f9ebf282657e417860e49ac94f4a838aefd34f28960a78da47933252d8cb2fdb27d413ee54502cd1bf75585468b77b8dca627cab29ef0a5297ee3dcb4c987520804e9a5f45e8241019281bab7e30f4b008bf0edf3b6fb5e8d1c2ab619b2eb84293d636a6a37d716cd8e102b7099676693cb7b01031b57ee93fd22cb18229893fd4d4ef87f1596879ac9f61b2f0c35be34cb6e6f75087ff963c188d43bcb464a95e956e75559eb1f6f2224fb2ca8f0bdc90ae5c2ce712498ee4026b13b8f3137000aa1545a75e5b48e80da30e6dac5529cac1099244e79ad542f45dcfbf16c62b5eb63daee8185c5e79ebfa1ca60880f9e2895f54ab95bbae38ae62200c1e439d73fa63d0bff75935a8ad2ae73b82132e8d4eb4bd55844b2f55c65d5ffa0c65aaf0cc5bc73925d05cf7c1c4383af074feb3a53919d2a3b5bef96115aab966821dbfc4577d19d85911a485c58a5b87cf44d230cfdc255486bb09d5c16f2164397f0fc5f652a171f0269bdcd98291410c010cc377d2690a6032fe5701117adbd0f6b847c9617a9b3d20529024d8d9749b9c49827694d346d3b1bbe434122331986b9f6e84430dfd75d123f3e307d6f5514f3da09b527408bfb6816da54beeefad160e4b095517f3292c2e17fb3bba47527671d0afe7c35d54d25ab307b15d069a05395a9cddd4b519224fe3c689d14827ede6d91ebace2a80afaad3dcd1f8ce20e92012b8934d7ff3ebdd285cc24202a86d70b96674a6af05a3c29065afa4e38b9c34006cb3eb9c87985cfc511a8c261cdeb0c7a3c7a682c40c5b9f1d7d5ef6f97e32d02fdd3f2ded413f4a36c4db899b96c8e40d91c2743cd1d435010300000000000000345b66cce79fa49f10baa4ef28535eee8c5c1a4b38bace2fb14ec11d34d620b1cc2396dc1fa857ac6ac9f5689b5935f2f25184edd40f8f5c70714f941beae3e1bc9af757edd9d68fb24218e2a02aad4dc0b3c2e54694ce547fc38f38e52673473fd0e57497978324aee16559e9cdbe5b3a0b96dd69fe5bc97e644487274b6158a0412bd60172bb66f774b8eae7bc1f52ed64d44c553bdc26823e35f18683554e7359802173d1fa86a66104abb1977c3e9fa6970ed7ee483b14b65673a81786fe0ed301f8edb0669fd25bfa0d565e3e93b19b8572c98dbacb103053527a95ee758be002e03df756bbc486def0db079124db72fadc26f0a26b42e21f260f902bb4cd881baae57eff1c3cc15063be17e48208b9a69622adfc03991d204fe0f5ae2528b22c7743f97e0669a1c3c0d0d90f39846fd954d681be0265d14b12285fb1b20bcbaa95915ad51ab8f84094674cbac0071021b261c39a46b0177b98f1662100ef31a3e981236d51e6c1429144a89d46b149301873ef99959f8ab15c12309620d5d548b62ff92233a3f200e0d0a9c2122be615dd91e6a6cd89290d24895540635fead9a56f481ee3fd7890852e271fa7c37b1836a3e1764574960e1ab9fda1d25693cfc33defea84f65c08cce479c66dc16b28d453a1b717fdd9f6ff46b1fa1b6866b4a8c1ad53439c5958403953b3a844b660b28b11d427b392a7c710edbf25725a65e6b94e4c64ae458a8c97c9f7a05a7d8ebf6c76e36cc0204ced97be84986da5403ef31eff1790c039fe00a89976ccab7638d2e217fc64609a41f3a008ed78b25d1a9420b782deef6ce2db2c6d427580087b69c75c1357ed2908c32cffee1c6ddd08510562ab015507a4eb4f54ae5c097cdca34f521f9fa8df7667645a696a472650c1ca9c035e95f34db54722897159c31dc6be5693a5f3871ccbb48a7ead233d03b76875590fa20bae4f37a2011622d0203a3e9d9e198cb075aba26f5e78a8f0b0cd27052527daf0f8e77858dbddec7038c198b868e93ae32f1745d166afed4129460e07af8cb6c3debb6503e87f3cb309e39ed3d682d24adec48ea22702c4d8d48386977a89b73e585f8c2c5fcb0a693cd5028a601b04b833a41ec705735c767c70d316b60aba2da24bd6523533f3180accade90f47e412b393ee1d2456cf8bb430289ddb824350764985c5e35f738f830a378bfa65fd167c7307c13acb912beefa69e499d4a750e820a7af08a7c204ffb64e09fcc921a4e79999757d608837bfd52255bbc16369af4f779edfd9439cfcd17fcc02d5aaa81bac66fa2e551cef55779bd90e8be587ee698575918fced59ec652af26718b3afd1471379132ba0b5143a78f84605b1ef51e49e820a8a8c1639f66bca5afd83602287e982eb125a3a032e4cc5b5be91ab4d8d958fd4dc4cbd310eddc91d89ada4d33fcc963d259e222520281d14e13577906e33665a31afa7cb501cc0c1198d1f755005e82f29bcda62bbf8680bc23d09cac6a8c89709b30c91d27ea148f01ba745346f1ba9ce89cd9b71ff18668a0254c07479762dbb78117c50450506e2a0a606309aa383ec55a49d2569c3a3fef8aad456aa81cb859519765de18a4b92194e8a6a43f1dade801f71eb56699bc021fa48f320f4128d6c153a2ec1fba1c5ca55c5058641692365d311c8902aaf1428d83281aa970af5d98591cd3af30fbb5ee4a1b697491ff6dd727a329feb17b7846254d691f949baf96afa195c62f2c3fd1855a79b25268cef9822e3c6a1b3aa226ec494b070a8774426a5f8877714fe206e569635805208ac7823c8546ec33e4482a85d6fddf86a37a1c60f0a19b5dfe88031b7541af0e93cac8a3bb1ff3e60190b96faedc3b6f63d38f3ee4286fbaa053e8e27ed13b77b2c576d824d777ca53df76d9572e71f74ff180778bf57458b37fe9dbaa6f9927b48b059e5c7fd908ac826aed8f68764285022f4b5cb6b73ef7222ecb0d701c782ed5c16a7c94235fe7c3e0bef9da7310c5f3cda407c5ae7ecfb6b392ad576610b48af17b3fc8a2fd6cd2eee1153cc48a21ba6768a88367a807be008bea547402da4c92c2006c83d74c9d0ef2ca711c54036c8e76ac26c7d22060c9bfc2e67f1d1c6f6bd2f751879295ee21fcf8588c9504cacb02fa3e3fc6e2bed352447a5c2677caba0538960357d6d1706adef5e7d4f6298ed4ecacb7776de15d9bbd672f9991f4bdc4f07401f67cf3a74c0495ea58d0f76a2e6060cecc1d04b93808dc8d61130305740b408359d5552cc23a7b1eff4285d563b4b6b011a4a11372a2bb01cbda724482f95c4487b02c85cc121012b3213041ff6a689072daa4d86a4c125b110f4e2eeed2dd73db0f94ce995896e0b8a9f8f3e9559024251a5b1726b0b3775bac9fabed968d2d4ea31bbdfb2910331d92cb4ff5cc9037cc08cd35f88c4d7b89e46a8cbd05e3c35732b5046b33060dce5372b171daa526a46c3444b331e71f0455fb8b43dc46e2c9f2c4effccf040e56de00000007b16de337f13e7a610feac2f336e75405a530815366e7edfbb429babfd0e68db56892b94621edd9df6ff454ab1dcdb8d39d282fa7932ec7ba5203df2f4196538a1fa040c8014d20ff57fdb8515325a6997b9b71f2094e053f126402a47e628eeb7d8f665fbabe8f1a409ca9c7c5c25baaa0e9945acf27e96f8241a445f7d3352494ba4210b348fa0ec11ea67dead4fc1e5e4f9202931386468882bee59f8d12174198142ef7764d6b930e937e20d018c0cc5a780490356f5521aac74d2c1736e20ae5e0cd8cf6676ac337e8a8976aac75a698e34e72bac561038f228c13b6e974bc21bb79618111db507f3ba314dd2d05fd050d684cf33d8da5f8e5f723a092098ac5b180a6579d543515c2e1d0eb502193aedab526d354b625990c7d5a9f90d86c4e374054f1d14270b603065293e7fa3840de575413b74bfbc4f8c139947ade9a", 0xff7, 0x3fff, 0x0, 0x0) r2 = socket$inet(0x2, 0x3, 0x2) r3 = socket$inet(0x2, 0x803, 0x81) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000001b40)=@nat={'nat\x00', 0x19, 0x2, 0x260, [0x200015c0, 0x0, 0x0, 0x200017c0, 0x200017f0], 0x0, &(0x7f0000001580), &(0x7f00000015c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff02000000050000000100000008006c6f0000000000000000000000000000626f6e64300000000000000000000000697036746e6c5d42b5fd00000000000069703667726574617030000000000000aaaaaaaaaaaa000000000000ffffffffffff0000000000000000b8000000f00000002801000069700000000000000000000000000000000000000000000000000000000000002000000000000000ac141400ffffffff000000000000000000063000000000004e220000000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa000000000000000000001b000000000000000000736974300000000000000000000000007663616e3020000000000000000000006c6f0000000000000000000000000000cabaca6d7a0bceb600000000000000005703a99868490000000000000180c200000000000000000000007000000070000000a80000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000000000000000fdffffff00000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff0000000000000000000000000000000000000000000005000000000000000000000000000000000002000000ffffffff00000000"]}, 0x2d8) setsockopt$inet_int(r2, 0x0, 0xd1, &(0x7f000038f000), 0x2c) 2018/04/13 16:41:13 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000493000)=[{&(0x7f0000bae000)="58000000140019f700db4b01040d8c560a06000000000410489619c3001158a2e04a03ca8164243e8900000028215a0004fbf50dfff90004a50b00ff001c0843000000000000221f080001000a000400000100ec6b0f076e", 0x58}], 0x1) r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, @local}, &(0x7f0000000040)=0x1c, 0x80000) getpeername$inet6(r1, &(0x7f0000000080), &(0x7f00000000c0)=0x1c) 2018/04/13 16:41:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00pP\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1011.231908] binder: 5590:5592 got transaction with invalid offsets ptr [ 1011.262346] binder: 5590:5592 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:14 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:14 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f0000000000)) ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f0000000400)) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x4000000003, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0}) ioctl$sock_bt_hidp_HIDPCONNDEL(r3, 0x400448c9, &(0x7f0000000040)={{0xfb, 0x236f0cf0, 0x2ec, 0x81, 0x0, 0xffffffffffffffd8}, 0x1}) rt_sigsuspend(&(0x7f0000000100)={0x2}, 0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000180)={0x0, 0x5}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000200)={r5, 0x6}, &(0x7f0000000240)=0x8) futimesat(r3, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)={{r4}}) [ 1011.301591] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:14 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003c3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = dup2(r0, r0) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000aa0ffc)) fremovexattr(r0, &(0x7f0000000000)=@random={'security.', '{\x00'}) 2018/04/13 16:41:14 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f000060c000)='oom_score_adj\x00') r1 = syz_open_procfs(0x0, &(0x7f000067fff8)='syscall\x00') connect$rds(r1, &(0x7f0000000040)={0x2, 0x4e22, @broadcast=0xffffffff}, 0x10) sendfile(r0, r1, &(0x7f0000000000)=0x3, 0x3) 2018/04/13 16:41:14 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x7000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1011.324297] binder: 5590:5592 ioctl 40046207 0 returned -16 2018/04/13 16:41:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00pP\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1011.394732] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1011.429171] binder: undelivered TRANSACTION_ERROR: 29201 [ 1011.472784] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1011.488444] binder: 5626:5627 got transaction with invalid offsets ptr [ 1011.506655] binder: 5626:5627 transaction failed 29201/-14, size 40-8 line 2991 [ 1011.543661] binder: BINDER_SET_CONTEXT_MGR already set [ 1011.552920] binder: 5626:5627 ioctl 40046207 0 returned -16 [ 1011.590193] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:15 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000629000)) r1 = syz_open_pts(r0, 0x1) fcntl$setstatus(r1, 0x4, 0x2800) ioctl$TCXONC(r1, 0x540a, 0x0) write(r1, &(0x7f0000fd6000)='z', 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000b3a000)=0x19) ioctl$TCXONC(r1, 0x540a, 0x1) syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x400, 0x0) 2018/04/13 16:41:15 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000590fa8)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000100}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="9acd06dcb307c0e7ffff0b000000"], 0x14}, 0x1}, 0x8000) sendmmsg(r1, &(0x7f00000063c0)=[{{&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa}}}, 0x3a, &(0x7f0000000080), 0x5}}, {{&(0x7f0000000000)=@nl=@proc={0x10}, 0xc, &(0x7f00000020c0), 0x0, &(0x7f0000002140)=[{0x10}], 0x10}}], 0x2, 0x0) 2018/04/13 16:41:15 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xfc, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:15 executing program 0: r0 = socket$inet6(0xa, 0x805, 0x0) sendto$inet6(r0, &(0x7f0000000000)="c6", 0x1, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x5}, 0x1c) connect$inet6(r0, &(0x7f00006f7000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x1}, 0x1c) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f00000000c0)=0x10001, 0x8) sendto$inet6(r0, &(0x7f0000000240)="93", 0x1, 0x0, &(0x7f0000001240)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x1}, 0x1c) close(r1) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000100)) 2018/04/13 16:41:15 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00@\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000000930000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:15 executing program 6: r0 = syz_open_dev$mice(&(0x7f000057d000)='/dev/input/mice\x00', 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000057fee)='/dev/input/event#\x00', 0xafd, 0x8000040000001) write$evdev(r1, &(0x7f00008c1fd0)=[{{}, 0x2, 0x0, 0x1}, {}], 0x30) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f0000000180)) r2 = syz_open_dev$evdev(&(0x7f0000057fee)='/dev/input/event#\x00', 0xafc, 0x8000040000001) write$evdev(r2, &(0x7f00008c1fd0)=[{{}, 0x0, 0x1}, {}], 0x30) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendmsg$FOU_CMD_GET(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40004}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r3, 0x720, 0x70bd27, 0x25dfdbfd, {0x3}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4, 0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040010) [ 1012.355675] binder: 5639:5641 got transaction with invalid offsets ptr 2018/04/13 16:41:15 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:15 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x700000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1012.410145] binder: 5639:5641 transaction failed 29201/-14, size 40-8 line 2991 [ 1012.419170] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1012.442710] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:15 executing program 2: r0 = socket$inet(0x2, 0x80001, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) ptrace$poke(0x5, r1, &(0x7f0000000040), 0x800) setsockopt$inet_int(r0, 0x0, 0x32, &(0x7f0000965ffc)=0x8000000000007, 0x4) syz_mount_image$btrfs(&(0x7f00000000c0)='btrfs\x00', &(0x7f0000000100)='./file0\x00', 0xb3e1, 0x2, &(0x7f00000002c0)=[{&(0x7f0000000140)="a447ea2d8b81231fff3c82d2a83a7f4210f94def21166c204bc1ea56bf97f4082c62620822799195efe126080e3a7e73313dee4cf1b804cc692f2589946c697ff97d55030076139e260776b6502f74815fd6219fa3f5bcf4a252e2d4a1c774981f48b0e926c730184ce4f6b6f2f2e33240427d085938db5d7559a04dcce133b4634e72ca96612c9a80a6b6623cd97b1f0d97d0c60f96b0c85f79493d9a3e5994a8908628add4431a2a3abc60878a09f52c8598568ae2491f25a4a83a2272b2e296237979de33d9366768132d99e1949a82c813be97d1612d6cfa68bbd5b0896f6ccd86f8ae73305b01bcb8bff4fd", 0xee, 0xfff}, {&(0x7f0000000240)="96e74a21fecf290f7834d2c1b7bee3021919e6de412a262432f8e03c5a06827ce60a32a40131b2f97a1173debca030b5a15ee720141229d9d5d346dba176e532ff15fdb4a580699d3618af12131ee2a35455deb2c2b6706fe4af88e62a9b1654386bdd7611", 0x65, 0x2}], 0x1001420, &(0x7f0000000300)={[{@notreelog='notreelog', 0x2c}, {@fragment_all='fragment=all', 0x2c}, {@skip_balance='skip_balance', 0x2c}, {@discard='discard', 0x2c}, {@check_int_print_mask={'check_int_print_mask', 0x3d, [0x39, 0x0, 0x31]}, 0x2c}]}) sendmsg(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f00000003c0)="e594bd82497a16f45088f0b4c426b34baef11b6ac83fca60b479891a95ea1e81c93a34f99177f7ba54b07469c1245f07681ac40d6c691f9cfa0dd4c027f6f671f9fe75c2d85f6187e654f90cfff848337cdb13f092317113b409b32f82081b1cf773e52e033c85614fcdee11086140bb2b3ab9448dacb908abfa6f26a71946c7222af2b209bc43c565cd1572251370c4ae37284d2559c4dd9b02a14c5d88f77314b61c3a7337a86049b9579868aef3c87269c0466f83d76fdd9755b8d4c0dca5d2a94ad2e9ba3d0982f7b8238f07f5823c45", 0xd2}, {&(0x7f00000004c0)="02b74487dcfba392c281b8b5c023839be80ea5dfb490853a1934ef2c82faefe8228ce99a25c99d76e7a8d10128b8d1aea77c430cde82802faae2d7abdb3fcc98dfbed4b7411d6a2468287425164452470448e681c3f0530439a382ef48d9d1e5c2f0f041f7eeefcefe6ab5e53015ef082897a4dbfd8298ddb5547c8fc784e0bfe2fd0309c109c7acee961cc1ad5b0fec26f99a85414eeb48c904d02fdb8e45475b6f37ed1d257d7881742ec7b3d9ade9a08f6971c7a0f85d49bd71bf192e90889954de41958fdd8ea6f7d52883913942670c370508c126d4443ec5527a96320345a5dba992fb", 0xe6}, {&(0x7f00000005c0)="a9dc8daf68a31f62a457a3ec8107702a8c1a9b7d1bb7dc4ae8e76fe389eb94ef3c3e1a08a01fe9603be069073e4d6b88414b67e250d777bc07c585b6fccdb6233394b737d65b4927ffa613c057ea9530f12a7259d2690c9c0a8af62b8b839e57e63ed22bfebc7519ad42113bee6a60f15fc8e598329e8e3ae56d4625d78988271c4485d9e97407bb7c7a421818f93d775750a946f0aea41f663ebe346949fa3b72e226622485062a3af9f15491b2bd8cd3a1e1cbb3c8c5d72cf15a4fffca688032e8869a6a1088d6be53298b9e928e3f9ce0", 0xd2}], 0x3}, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000080)={0x73, @rand_addr=0x8, 0x4e21, 0x0, 'none\x00', 0x8, 0x836, 0x77}, 0x2c) poll(&(0x7f0000000380)=[{r0, 0x1000}, {r0}, {r0, 0x60}, {r0, 0x2200}, {r0, 0x400}], 0x5, 0x5a2) [ 1012.460340] binder: 5639:5641 ioctl 40046207 0 returned -16 [ 1012.495321] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:15 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:15 executing program 6: r0 = socket$can_raw(0x1d, 0x3, 0x1) flock(r0, 0x4) close(r0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x20000, 0x0) fcntl$lock(r0, 0x7, &(0x7f0000000100)={0x1}) lseek(r1, 0x0, 0x204) 2018/04/13 16:41:15 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe2(&(0x7f0000e3eff8)={0x0, 0x0}, 0x0) mount(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='adfs\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000340)=ANY=[@ANYBLOB="e2410f7fb5b856450e92459bd1dc8067dbd2b3cc884afe2205b3333a56326904611ee9d4549e3156c33e3a8f5c8d2413eb5e7f2463cae08ef17e11718cb91b2aacdf873ff073241ba8d6cecd39d34e7eb1958cacaaaa34dc72b1d83252b5416db4c275e2dfa700053c5ae8e57a2c2bcfdc7a00bef3f22ec2b503a63170123a651dbfb16a1f364b4c2b56030f3db2f2de"], &(0x7f0000000440)=0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000decfe0)={0x10005, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SMI(r3, 0xaeb7) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000300)=[@textreal={0x8, &(0x7f0000000500)="0f005c0666b8ef0000000f23d00f21f86635300000010f23f866b9770b000066b80000008066ba000000000f30f20f35f30f1bcff4650f01cabaf80c66b8c261a58266efbafc0cb874daef0f236d0f32", 0x50}], 0x0, 0x0, &(0x7f0000000280), 0x100) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) [ 1012.565132] binder: undelivered TRANSACTION_ERROR: 29201 [ 1012.661115] binder: 5681:5683 got transaction with invalid offsets ptr [ 1012.685021] binder: 5681:5683 transaction failed 29201/-14, size 40-8 line 2991 [ 1012.731398] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:15 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000000)={@random="cdbf0e000084", @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "02290f", 0x30, 0x29, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @icmpv6=@pkt_toobig={0x3a, 0x0, 0x0, 0x0, {0x0, 0x6, "9433df", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @dev={0xfe, 0x80}}}}}}}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 2018/04/13 16:41:15 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xb80b000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:15 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000039800", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:15 executing program 0: r0 = socket(0xa, 0x802, 0x0) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000040)=0x8855, 0x2) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x4e20, 0x74b, @empty, 0x7f}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x18, &(0x7f0000000000)=0x200, 0x4) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}, 0x1c) getsockopt$inet6_mreq(r0, 0x29, 0x1d, &(0x7f0000000080)={@mcast1, 0x0}, &(0x7f00000000c0)=0x14) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r2, 0xc0a85352, &(0x7f00000001c0)={{0x7, 0x7}, 'port0\x00', 0x29, 0x0, 0x1, 0x5, 0x5, 0xbc7, 0x6, 0x0, 0x3, 0x5}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x1f, r1, 0x1, 0x9, 0x6}, 0x14) 2018/04/13 16:41:15 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:15 executing program 6: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x0, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x1c, &(0x7f0000000140)="e2f5c856f205f28d8b41d738b2b5da825970042b60d424376c68e80aad4e0a25d5e9dac9bd797b70414b1f20128852e577408251bb0e8f60dec2ec9f7aa5211b13a22f80fd6419712cdfe31230f34a9633ed0ef3107f7c01aaf2d581eeedc8cd2b464a4c792de76d6373c886b62f6553bf4107efd65bdf8ce39bb86adaa305b1926712f0d8e18fc5b7ee65bd9b53af581208c551", 0x94) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00'}, 0xfffffffffffffdb8) bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x104d}, 0xfffffffffffffef3) epoll_wait(r0, &(0x7f0000000080)=[{}, {}, {}, {}], 0x4, 0x9e3b) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000040)={'team_slave_0\x00', {0x2, 0x4e20, @multicast1=0xe0000001}}) ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f0000000200)=@ioapic) 2018/04/13 16:41:15 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x7fffffff, 0x20000) connect(r0, &(0x7f0000000080)=@rc={0x1f, {0x3e8, 0x7, 0x7, 0x6, 0x1, 0x4}, 0xfffffffffffff4b8}, 0x80) mmap(&(0x7f0000000000/0xb000)=nil, 0xb000, 0x0, 0x4031, 0xffffffffffffffff, 0x0) prctl$setname(0xf, &(0x7f0000000040)='-wlan1.--\'&--}{[\x00') 2018/04/13 16:41:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1012.752568] binder: 5681:5683 ioctl 40046207 0 returned -16 [ 1012.787691] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:15 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1012.854342] binder: 5701:5702 got transaction with invalid offsets ptr [ 1012.881418] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1012.893474] binder: 5701:5702 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:15 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000200)=0x6) lseek(r0, 0x0, 0x2) setsockopt$sock_void(r0, 0x29, 0x0, 0x7fffffffefff, 0x13000000) clone(0x40000, &(0x7f0000000240)="605bbdc55fc53540ca072b76800dbb33ea97b9e922e8ac0f5d5f4fe7f12d1744d3e1bda80e69e5072cadd4b09f5eba03ac03c840c96d0fb9ffbe0409df99c91138be7c986d12eaf4af26ce7054651ed2265c2aa097a1b9aad715f157aca369f1cdcf44021d3cf5564793782243a62d5edcc10f7109a278d0f1caee3691fd2372187ea6bbb63a76498a4dfbb55dc3a25b0c7107d3d85c2948651468e2b57025202951d2ffc15c4b9ba94a9db6ea78a51d498d01a1f01de6e90fb03371fcd626b447c7f8100510c92012731d3f52cea223b4d7cf743bf54ac6af95217a", &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)="8da952c6acabd1810fb1f79a28e618791573d0d0f6ef9e4fd466eb049dce5d3b8a73a4b1d9ae1383a8c60f5f613afa03b9adad8f364c0aa721a578b72450f4f98f2f61b24b92970c883b78cf27efdf4e76d5b592fbec3996033ae56d42638d2e") [ 1012.912352] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1012.928177] binder: BINDER_SET_CONTEXT_MGR already set [ 1012.946943] binder: 5701:5702 ioctl 40046207 0 returned -16 2018/04/13 16:41:15 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x5000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000006cb000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:15 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:15 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x40681, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x2, 0x30}, &(0x7f0000000100)=0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000140)={r2, @in={{0x2, 0x4e22}}, [0x8, 0x6, 0xfffffffffffffff9, 0x4, 0x6, 0x2, 0x4, 0x9, 0x9, 0xffffffff, 0x10000, 0x80000001, 0xfff, 0x8000, 0x1]}, &(0x7f0000000240)=0x100) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x0, 0x0) ioctl$TIOCGSOFTCAR(r3, 0x5419, &(0x7f0000000040)) sendmsg$nl_route(r0, &(0x7f00000f4fc8)={&(0x7f0000108000)={0x10}, 0xc, &(0x7f00000edff0)={&(0x7f0000000280)=ANY=[@ANYBLOB="28430d9a669f82cadeffffffffffddfb0700000021d1a0bd821ed26c0238abbfbce785b4f88fdee7ab6e2d8ea81e2ddfff29c3b80d4acb5a3c16cf5b178541ca63b910d07693edd644efef1bfb01cc813d03382cb01d8d2e3ef11cab3a4a7ab23906ceacad0a4fef05aa0359e06d1cdc31bec58c4ea74faf88", @ANYRES32=0x0, @ANYBLOB="000000000000000008000a0003000008"], 0x28}, 0x1}, 0x0) 2018/04/13 16:41:15 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000240)={[0x10000, 0x112000, 0x2000], 0x4, 0x62}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'salsa20-asm\x00'}, 0x58) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, &(0x7f00000002c0)) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000600)={[{0xe1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) getsockname$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, @multicast1}, &(0x7f0000000100)=0x10) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000f000/0x18000)=nil, &(0x7f00000004c0)=[@text16={0x10, &(0x7f0000000440)="66f20f79ccb832018ee0ba2100edbaf80c66b825f5db8c66efbafc0cb0fcee360f0139b80f008ee0f30f221e6766c7442400e00000006766c7442402000000006766c744240600000000670f011424f00fb01e726d3e0fc76996", 0x5a}], 0x1, 0x5, &(0x7f0000000500)=[@flags={0x3}, @efer={0x2}], 0x2) 2018/04/13 16:41:15 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1013.040950] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:15 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000289000)={&(0x7f0000cf1ff4)={0x10}, 0xc, &(0x7f0000703000)={&(0x7f000023f000)=ANY=[@ANYBLOB="84000000000000000000000000000000005b659a62290ffc380c2dbfc75e8917e101000006000000001cb4e2bf501db1bb948decd8337f6d63cc8769c29c4d91b0325df0be48b748d3050bc1700612dbc3080c91125fa158cf0d70309f7f19cc7c8262d73294c0351575a9e8aa5944f2a432a15b3fe56aa566ce5ccee13b17c20b032e"], 0x83}, 0x1}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000000)=@generic={0x9, 0x6, 0x7fffffff}) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f000023f000)=0xa, 0x20b) connect$inet6(r0, &(0x7f000053b000)={0xa}, 0x1c) r1 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x12, 0x0, @thr={&(0x7f0000000080), &(0x7f0000000100)}}, &(0x7f0000000180)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) tkill(r1, 0x15) [ 1013.122375] binder: 5731:5733 got transaction with invalid offsets ptr 2018/04/13 16:41:15 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:15 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) sendmsg(r0, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000029c0)="a9", 0x1}], 0x1}, 0x0) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000040)=0x3, 0x4) sendmsg(r0, &(0x7f00000014c0)={&(0x7f0000000240)=ANY=[], 0x0, &(0x7f0000000340)=[{&(0x7f0000001200)="a9", 0x1}], 0x1, &(0x7f00000012c0)}, 0x1) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @broadcast=0xffffffff}, 0x10) recvmsg(r0, &(0x7f00000003c0)={&(0x7f0000000180)=@alg, 0x58, &(0x7f0000000240)=[{&(0x7f0000001500)=""/4096, 0x1000}], 0x1, &(0x7f0000000300)=""/45, 0x2d}, 0x0) sendmsg(r0, &(0x7f0000000380)={&(0x7f0000000540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}}}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)="a6", 0x1}], 0x1}, 0x1) 2018/04/13 16:41:16 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x900, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1013.176562] binder: 5731:5733 transaction failed 29201/-14, size 40-8 line 2991 [ 1013.179653] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1013.200139] binder: BINDER_SET_CONTEXT_MGR already set [ 1013.218364] binder: 5731:5733 ioctl 40046207 0 returned -16 2018/04/13 16:41:16 executing program 2: r0 = socket$inet(0x2, 0x803, 0x81) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x2, 0x260, [0x200015c0, 0x0, 0x0, 0x200017c0, 0x200017f0], 0x0, &(0x7f0000001580), &(0x7f00000015c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff02000000050000000100000008006c6f0000000000000000000000000000626f6e64300000000000000000000000697036746e6c5d42b5fd00000000000069703667726574617030000000000000aaaaaaaaaaaa000000000000ffffffffffff0000000000000000b8000000f00000002801000069700000000000000000000000000000000000000000000000000000000000002000000000000000ac141400ffffffff000000000000000000063000000000004e220000000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa000000000000000000001b000000000000000000736974300000000000000000000000007663616e3000000000000000000000006c6f0000000000000000000000000000726f73653000000000000000000000005703a99868490000000000000180c200000000000000000000007000000070000000a80000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff00000000"]}, 0x2d8) [ 1013.297192] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1013.329755] binder: undelivered TRANSACTION_ERROR: 29201 [ 1013.345247] pit: kvm: requested 188571 ns i8254 timer period limited to 500000 ns 2018/04/13 16:41:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:16 executing program 4: clone(0x200, &(0x7f0000151000), &(0x7f0000000080), &(0x7f0000f8b000), &(0x7f0000000100)) mknod(&(0x7f0000b75ff8)='./file0\x00', 0x2001001, 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240), &(0x7f0000000200)=[&(0x7f00000000c0)='securityGPL,^\x00', &(0x7f0000000140)='syscall\x00', &(0x7f0000000180)="6367726f7570e973797374656d47504c7d00", &(0x7f00000001c0)='syscall\x00']) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='syscall\x00') lseek(r0, 0x2, 0x0) pread64(r0, &(0x7f0000000100)=""/53, 0x35, 0x0) creat(&(0x7f0000b7a000)='./file0\x00', 0x0) 2018/04/13 16:41:16 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:16 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500490c0200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:16 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x3f00, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:16 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000013000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0xe, 0x802, 0x2, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40042409, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000002fe8)=[{0x35, 0x0, 0x0, 0xfffffffffffffffc}, {0x6}]}, 0x10) socket$l2tp(0x18, 0x1, 0x1) r4 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x2, 0x402000) ioctl$PERF_EVENT_IOC_REFRESH(r4, 0x2402, 0x5) sendmmsg(r1, &(0x7f0000008180)=[{{0x0, 0x0, &(0x7f0000004e80), 0x0, &(0x7f0000008000)}}], 0x1, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f0000000080)='eth1*}+.\'vmnet0\x00') 2018/04/13 16:41:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) fchmod(r0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={&(0x7f0000000000)={0x10}, 0x7, &(0x7f000000d379)={&(0x7f0000008fec)={0x14, 0x12, 0x301, 0x0, 0x0, {0x80}}, 0x14}, 0x1}, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x1, 0x4eb}, 0x8) 2018/04/13 16:41:16 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f0000030ff8)='pagemap\x00') lseek(r0, 0x0, 0x3) sysfs$3(0x3) syncfs(r0) [ 1014.157169] binder: 5771:5775 got transaction with invalid offsets ptr [ 1014.178523] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:16 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1014.201161] binder: 5771:5775 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:17 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha512_mb\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000500)=""/4096, 0x1000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="f09066b6dbf2eff5b4aaab9099bec9d5cbe544c06c4bccdf7eb580a52f1c41967fd522bb4eb53fe73f40da9073c31a56666948bc4e85c0e3f03cd0dbceda69dc77ec450d1d62e6fdb7324813d5131619c7f1e2db", 0x54) r2 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x0, r2) 2018/04/13 16:41:17 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x9004, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1014.243075] binder: BINDER_SET_CONTEXT_MGR already set [ 1014.256985] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1014.268459] binder: 5771:5775 ioctl 40046207 0 returned -16 [ 1014.351895] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:17 executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x2, 0x80000) setsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000040)="d539c60953012abd744ac0e1c39e68b7174dcd4ecdbcdf61844f7a5f1772c14570d09455c1d9c9c09066b84963f3c60b855f1a591fba956a09da66666f28a7e125c2ef2087cc10436434147bec014820ccc99144d758f49242670b42b4b683da2b34aa58015678e87f691713c0a34ef6a9726a8f52c59adcb1171de2b5700110b346306acd2640c3988e38611614bd6ffd955d91e8bbe8902df5971fc97ad6f6c4f48a5aba48f78350fb152836f35b1e396f25c5dc05e5e4f164b020ed934289e2c8bc3afeebd7236a47aa", 0xcb) r1 = socket(0x40000000015, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000480)={@mcast1={0xff, 0x1, [], 0x1}, @dev={0xfe, 0x80, [], 0x1a}, @dev={0xfe, 0x80, [], 0x1d}, 0x8000, 0x10001, 0x1, 0x100, 0x7fff, 0x80000, r2}) bind$vsock_stream(r0, &(0x7f0000000500)={0x28, 0x0, 0x2710, @my=0x1}, 0x10) setsockopt(r0, 0x9, 0x0, &(0x7f0000000700)="f0ac6e7f34c42d837444e4ba86034decb6271ef805173f0600a0560b41050000005fb20a010000000000217a66bc3c109cfe630eb584f500000000000000000000000000", 0xffd5) ioctl$sock_netdev_private(r1, 0x89f6, &(0x7f00000003c0)="5564c4ea12d4a10f4c6f7beec9d1ca013d8542ce2f365d69e98145bc55f50aab9fc73f0d97ddd90e698ac1facc221cc88a1ef90dcbec29946bccf42f2313b69237") bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000380)={r0, &(0x7f0000000180)="ed2a7d7e2bd33e7156523cf3acff663d6705cf7eaeb37a684ffafb5fda623aedd1a71332711449bea9aff62398b3991616711c67f6c15aea3e1c60cda417479b91e76e2f6de8dc98fa93f0778aeedc1b72c390afa59c42005ed0e33ec601ab6f4e1aca79ed16c655cdbf95c2f471e9d1be2b8d927b8a6ce7ecff86c9fdee7241800f3e560be2fccc268e5f077e9d1c7ce759cedceed7600a1b99272fbb818c1058e29bd3db075758cbee85c36ee336d34e392d895b7df860962376902a202fc0183b4761ab696c2a733c519c5d60b593a6bd8dc0ae9553a7778471b52a5ee6", &(0x7f0000000600)=""/193}, 0x18) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000540)={0xd7, 0x8, 0x4, 0x5, 0x0}, &(0x7f0000000280)=0x10) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f00000005c0)={r3, 0x83b}, 0x8) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000140)=0x0) fcntl$setownex(r0, 0xf, &(0x7f00000002c0)={0x0, r4}) 2018/04/13 16:41:17 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650073ab0100", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:17 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:17 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) connect$inet6(r0, &(0x7f0000012000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) fdatasync(r0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc\x00', 0x400000, 0x0) getpeername(r0, &(0x7f00000000c0)=@can={0x0, 0x0}, &(0x7f0000000200)=0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000240)={'vcan0\x00', r2}) r3 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x2, 0x200) ioctl$KVM_GET_NR_MMU_PAGES(r3, 0xae45, 0x4) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000001200)={0x0, 0x0, 0x37}, 0x10) getsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000140)={@multicast2, @dev, 0x0}, &(0x7f0000000180)=0xc) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000001c0)={@local={0xfe, 0x80, [], 0xaa}, r4}, 0x14) 2018/04/13 16:41:17 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xf5ffffff00000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000000000000169e000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:17 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$sndctrl(&(0x7f000090cfed)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r1, 0xc0045540, &(0x7f0000000100)=0xffc) io_setup(0x1f, &(0x7f0000000000)=0x0) io_destroy(r2) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140)={0x0, 0x2}, &(0x7f0000000180)=0x8) sendmsg$inet_sctp(r0, &(0x7f00000001c0)={&(0x7f0000000040)=@in={0x2, 0x4e21, @broadcast=0xffffffff}, 0x5d, &(0x7f00000003c0)=[{&(0x7f0000000340)="f3bd6a010088ede92babbdf123c5532fff2ca36c363d5c0bd63651c8d0d0f556023c061435754342e4e231b7ec0c36b198a874c3e9e05f640243d8a0ad3262a0819e0540c678e9432e681b222fd75669db86720927f219f6a591e1449c3123f172c7b1a66ed47134a6a6e34376a6251891a1cd530bf049b9408c7ffed7da", 0x3dd}], 0x0, &(0x7f0000000280)=[@sndrcv={0x30, 0x84, 0x1, {0x6, 0x7, 0x8, 0x5cf, 0x1, 0x8a, 0x2, 0x2a, r3}}, @init={0x18, 0x84, 0x0, {0xe49, 0x8, 0x4, 0x5}}], 0x60, 0x810}, 0x80) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000300)={0x1000, 0x5, 0x209, 0x0, 0x100000000, 0x8001, 0x2, 0x6, r3}, 0x20) 2018/04/13 16:41:17 executing program 6: r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000000)={0x3, 0x0, 0x6a74}) r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x4, 0x404080) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x53}) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000000, 0x1005e, r1, 0x10) 2018/04/13 16:41:18 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1015.219266] binder: 5818:5820 got transaction with invalid offsets ptr 2018/04/13 16:41:18 executing program 2: r0 = socket$inet6(0xa, 0x80005, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f000022a000)=0x100008001, 0x4) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x10001, 0x1, 0xd3, 0x5}, 0xc) bind$inet6(r0, &(0x7f0000002000)={0xa, 0x4e20}, 0x1c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1015.263494] binder: 5818:5820 transaction failed 29201/-14, size 40-8 line 2991 [ 1015.275677] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1015.308728] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x4, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:18 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB='i\b\x00\x00\x00'], 0x5) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000010000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, &(0x7f0000000100)="0f09c744240000380000c74424028f000000c7442406000000000f0114240f9a9f00800000670f209a642e3e0f01f7670f080fc7aeb2440000660f388153940f30ad", 0x42}], 0x1, 0x0, &(0x7f00000001c0), 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000240)=ANY=[@ANYBLOB="000025d200f8ea00"]) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r3, &(0x7f0000003d80)="b0", 0x1, 0x0, &(0x7f0000003e00)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000000040)=[@in={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}], 0x2c) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x0, 0x103800) getpeername$ipx(r4, &(0x7f00000000c0), &(0x7f0000000180)=0x10) 2018/04/13 16:41:18 executing program 6: r0 = perf_event_open(&(0x7f0000348f88)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x0, 0x0) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000240)) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) recvmmsg(r1, &(0x7f0000001880)=[{{&(0x7f0000000280)=@hci, 0x80, &(0x7f0000000440)=[{&(0x7f0000000300)=""/26, 0x1a}, {&(0x7f0000000340)=""/174, 0xae}, {&(0x7f0000000400)=""/35, 0x23}], 0x3, &(0x7f0000000480)=""/74, 0x4a, 0x200}, 0x1}, {{&(0x7f0000000500)=@ipx, 0x80, &(0x7f0000000580), 0x0, &(0x7f00000005c0)=""/4, 0x4, 0x2}, 0x3}, {{&(0x7f0000000a80)=@generic, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000b00)=""/35, 0x23}, {&(0x7f0000000b40)=""/158, 0x9e}, {&(0x7f0000000c00)=""/31, 0x1f}], 0x3, 0x0, 0x0, 0xffffffffffffff88}, 0x9}, {{&(0x7f0000000c80)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000d80)=[{&(0x7f0000000d00)=""/67, 0x43}], 0x1, &(0x7f0000000dc0)=""/113, 0x71, 0x9}, 0x1}, {{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000e40)=""/151, 0x97}, {&(0x7f0000001000)=""/249, 0xf9}, {&(0x7f0000000f00)=""/21, 0x15}], 0x3, &(0x7f0000001100)=""/247, 0xf7, 0x3f}, 0x400}, {{&(0x7f0000001200)=@vsock={0x0, 0x0, 0x0, @my}, 0x80, &(0x7f0000001800)=[{&(0x7f0000001280)=""/79, 0x4f}, {&(0x7f0000001300)=""/103, 0x67}, {&(0x7f0000001380)=""/213, 0xd5}, {&(0x7f0000000680)=""/240, 0xf0}, {&(0x7f0000001580)=""/94, 0x5e}, {&(0x7f0000001600)=""/168, 0xa8}, {&(0x7f0000000f80)=""/44, 0x2c}, {&(0x7f00000016c0)=""/41, 0x29}, {&(0x7f0000001700)=""/231, 0xe7}], 0x9, 0x0, 0x0, 0xffffffffffffff63}, 0x1000}], 0x6, 0x2000, 0x0) connect$can_bcm(r2, &(0x7f0000001ff0)={0x1d, r3}, 0x10) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ashmem\x00', 0x800000000, 0x0) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f00000008c0), &(0x7f0000000900)=0x4) sendmsg$can_raw(r2, &(0x7f0000001fc8)={&(0x7f000000a000)={0x1d}, 0xffd1, &(0x7f0000000ff0)={&(0x7f000000a000)=@canfd={{0x1}, 0x0, 0x0, 0x0, 0x0, "0327e1b22b5fcef7739c699f5ff986ca08990039576a7d5cb2bdac3fa80acf584ecb5fee496e6866856b76b5f700000000000000004e2f9663a918fa1efd9b0b"}, 0xfeb8}, 0x1}, 0x0) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, &(0x7f00000007c0)={0x7, {0x2, 0x4e23, @rand_addr=0xfff}, {0x2, 0x4e23}, {0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x12, 0x7, 0x91e, 0xff, 0x1, &(0x7f0000000780)='irlan0\x00', 0x10000, 0x79b0, 0x9}) dup2(r0, r2) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)}) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000180)=""/161, 0x401}) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000600)={0x59, 0x0, 0x8, {r5, r6+10000000}, 0x7, 0x8}) r7 = gettid() waitid(0x0, r7, 0x0, 0xa0000001, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000000840), &(0x7f0000000880)=0x14) 2018/04/13 16:41:18 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1015.353407] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1015.364065] binder: 5818:5820 ioctl 40046207 0 returned -16 2018/04/13 16:41:18 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f00000003c0)}}, {{&(0x7f00000004c0)=@in6={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000000680), 0x3ba, &(0x7f0000002000)=[{0x10, 0x29}], 0x10}}], 0x2, 0x8000) r1 = dup(r0) r2 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, r2) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000040)={0x0, 0x7, "5aace7b310eba5"}, &(0x7f0000000080)=0xf) setsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000000c0)={r3, 0x9, 0x401, 0x5}, 0x10) ioctl$TIOCNXCL(r1, 0x540d) 2018/04/13 16:41:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x5, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000002000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:18 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000000ffffffe400", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:18 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1015.494958] binder: undelivered TRANSACTION_ERROR: 29201 [ 1015.559830] binder: 5865:5866 got transaction with invalid offsets ptr 2018/04/13 16:41:18 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1015.603753] binder: 5865:5866 transaction failed 29201/-14, size 40-8 line 2991 [ 1015.615800] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1015.625653] binder: BINDER_SET_CONTEXT_MGR already set [ 1015.634507] binder: 5865:5866 ioctl 40046207 0 returned -16 2018/04/13 16:41:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xe, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:18 executing program 4: mkdir(&(0x7f000082f000)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x10000}, @time=@time={0x77359400}}], 0x30) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000003c0)={'ip6gre0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}) geteuid() unlink(&(0x7f00000000c0)='./control/file0\x00') rename(&(0x7f0000000040)='./control/file0\x00', &(0x7f0000000080)='./control\x00') mount(&(0x7f0000000300)='./file0\x00', &(0x7f00000006c0)='./file0/file0\x00', &(0x7f0000000780)='pstore\x00', 0x201030, &(0x7f00000007c0)="f77ee893c0dacf1469939730dd0d69be615896c69eeb0eddc13f") ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000580)=""/148) mknod(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='btrfs\x00', 0x1000, &(0x7f0000000240)) semget(0xffffffffffffffff, 0x0, 0x0) times(&(0x7f0000000500)) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000240)={0x1, 0x3, 0x7fffffff, 0x7, 0x8, 0xfff}) umount2(&(0x7f0000000200)='./file0\x00', 0x0) syz_mount_image$minix(&(0x7f0000000680)='minix\x00', &(0x7f0000000340)='./control/file0\x00', 0x0, 0x0, &(0x7f0000000700), 0x0, 0x0) rename(&(0x7f0000000740)='./file0\x00', &(0x7f0000000380)='./control/file0\x00') close(r0) [ 1015.647558] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000000000007fffffff000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:18 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:18 executing program 6: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa}, 0x1c) sendmmsg(r0, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f0000000380), 0x0, &(0x7f00000003c0)}}, {{&(0x7f00000004c0)=@in6={0xa, 0x4e22, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x80, &(0x7f0000000680), 0x0, &(0x7f0000000180)=[{0x10, 0x29, 0x43}], 0x10}}], 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000000)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000140)=0xe8) sendmmsg(r0, &(0x7f0000000380)=[{{&(0x7f00000001c0)=@can={0x1d, r1}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000240)="9c7ac5075266b2a1ed1a1300c48825e857", 0x11}, {&(0x7f0000000280)="1c46826ba8697e30cced5d606a1c1839daf74619e4a4b735c78963cfb055f22a7049939c37bff78b065f5263e3593a5ad8b724564baf6482d090b776fceaee0c0cf7eaaa268f8fc5e0ca623b5e6c460428ba026157dc5a425c0736a15390e618ccc86e336d09540a3770002231a9f8a2a8bd", 0x72}], 0x2, &(0x7f0000000340)=[{0x28, 0x10f, 0x8, "a441c05b6929dcb7135b889287302412a0abcd9f"}], 0x28, 0x4}, 0x1}], 0x1, 0x8000) [ 1015.722816] binder: undelivered TRANSACTION_ERROR: 29201 [ 1015.792676] binder: 5890:5893 got transaction with invalid offsets ptr [ 1015.811241] binder: 5890:5893 transaction failed 29201/-14, size 40-8 line 2991 [ 1015.860601] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:19 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xffffffc0, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:19 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000100", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1016.323782] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1016.336423] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:19 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:19 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x4) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000140)="636fbdf2e981309bf5604e6d519bb0d1148a6d6d00b1619aa0a51fd7da71ab638cdda88073988d25e12f259878b79b8d92980de2eee986713686e599dcb2987e8cb19226b39e56f34c646ab3de3d1fa8150af07e0300000000000000") 2018/04/13 16:41:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:19 executing program 4: lgetxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000200)=@known='security.ima\x00', &(0x7f00000000c0)=""/113, 0xfffffffffffffee7) recvmsg(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000000)=ANY=[], 0x0, &(0x7f0000000300), 0x0, &(0x7f0000000400)=""/17, 0x11}, 0x0) r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000140)='attr/keycreate\x00') pwritev(r1, &(0x7f0000001400), 0x10d, 0x1) syz_open_dev$tun(&(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x40000) syz_open_dev$tun(&(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x62002) chroot(&(0x7f0000000040)='./file0\x00') 2018/04/13 16:41:19 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) io_setup(0xa3c, &(0x7f0000409000)=0x0) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f00002a8000)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0, r2}]) 2018/04/13 16:41:19 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xa00000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:19 executing program 6: prctl$intptr(0x19, 0x66) setresuid(0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000080)={0x0, 0xa4, 0x81, 0x1, 0x2, 0x0, 0x35102ced, 0x4dc, 0x8, 0x6c}) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000000)={'eql\x00', {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x21}}}) 2018/04/13 16:41:19 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650007fffffe00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1016.915377] binder: 5936:5937 got transaction with invalid offsets ptr [ 1016.947605] binder: 5936:5937 transaction failed 29201/-14, size 40-8 line 2991 [ 1016.989725] binder: BINDER_SET_CONTEXT_MGR already set [ 1017.011441] binder: 5936:5937 ioctl 40046207 0 returned -16 [ 1017.041339] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:19 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:19 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x200000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:19 executing program 2: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000001080)="009000899893fbcb28412f0d8cca3abf395be201bd8ada9e0f8326c2d8a91c1b") exit(0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x7fff, 0xfffffffffffffffa, 0x0, 0x7, 0x18, 0x18, "2d42ff3ee816b6fb25234bda643b493dbecf23135158c3cf2b5a2961a1e93ba0147e9afc759bfe46c4234aee2db7645362a3d71e711f676e2d372f496b61ab12", "6405ace31d2a84805ca23836ede31eaba97573fa59e5652ae62c48793b47382dafe4b1deb80c35e8cf493080edb2f4562cd8d383e501a4ba2a5e0ca57c7505b8", "aa9a02064c1bb532ca09594ed9511f2ded6bc9bc89bc11ba86c9e0b53ca56f76", [0x9, 0x9]}) fstat(r1, &(0x7f00000012c0)) 2018/04/13 16:41:19 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}, 0x1c) sendmsg(r0, &(0x7f0000022000)={0x0, 0x0, &(0x7f0000006000)=[{&(0x7f00000000c0)="87", 0x1}], 0x1, &(0x7f0000004ff0)}, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x9, 0x20000) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x17}}}}, &(0x7f00000001c0)=0x84) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000280)=ANY=[@ANYRES32=r2, @ANYBLOB="060009001300020000100080020004000500000009004fc8e9bd92dbabdbbf9fcc3b84906e25ecf85f6a9ffee1828edd50a355df9ab26f6b3e470062a07df5663435f41d08cf5d55d26dee8ca6750a4d593f9ca4f67ba58d7d7cbdd222bd8683de9a444949026b5f3567"], 0x1a) 2018/04/13 16:41:19 executing program 6: mmap(&(0x7f0000048000/0x1000)=nil, 0x1000, 0x7, 0x31, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xabf, 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000040)={0x0, 0x0, 0x1, 0xd78}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={r1, 0x1}) mmap(&(0x7f000001d000/0x2000)=nil, 0x2000, 0x3, 0x31, 0xffffffffffffffff, 0x0) recvfrom$unix(r0, &(0x7f00000000c0)=""/91, 0x5b, 0x2042, &(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, &(0x7f000000b000)={0x77359400, 0x1}, &(0x7f000001d000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f000000d000), &(0x7f0000048000), 0x0) 2018/04/13 16:41:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:19 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:19 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000fe8)={0xaa}) r1 = epoll_create1(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000040)={'veth1\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x13}}}) sysfs$1(0x1, &(0x7f00000001c0)='veth1\x00') r3 = dup(r2) ioctl$PIO_FONTRESET(r3, 0x4b6d, 0x0) getsockopt$inet6_tcp_int(r3, 0x6, 0x21, &(0x7f0000000080), &(0x7f0000012ffc)=0x4) fcntl$getownex(r3, 0x10, &(0x7f0000000180)={0x0, 0x0}) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x3f, 0x7fff, 0x5, 0x1, 0x0, 0x5b7, 0x80, 0x1, 0x6cd0, 0x9, 0x1, 0x4, 0x2, 0x3, 0x1f, 0x101, 0x3f, 0x8, 0x101, 0x1, 0x3, 0x8000, 0x1ff, 0x7fff, 0x3, 0x0, 0x0, 0x7, 0x1, 0xe7f0, 0x3, 0xcf, 0x2, 0x1208c562, 0x3, 0x9, 0x0, 0x2f2eeab2, 0x1, @perf_bp={&(0x7f00000000c0), 0x2}, 0x0, 0x1000, 0xff, 0x7, 0x3f, 0x2}, r4, 0x4, r3, 0x9) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000200)) fadvise64(r1, 0x0, 0x0, 0x5) socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r1, r0, 0x0) [ 1017.076512] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1017.091893] binder: undelivered TRANSACTION_ERROR: 29201 [ 1017.147734] binder: 5962:5968 got transaction with invalid offsets ptr 2018/04/13 16:41:19 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1017.187974] binder: 5962:5968 transaction failed 29201/-14, size 40-8 line 2991 [ 1017.220763] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:20 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xa000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1017.236237] binder: BINDER_SET_CONTEXT_MGR already set [ 1017.263899] binder: 5962:5968 ioctl 40046207 0 returned -16 [ 1017.290007] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1017.343374] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:20 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:20 executing program 2: syz_emit_ethernet(0x2e, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000008004600002000000000002f9078ac141400ac1414bb0704000000000000000890785dc25cde897954b8f0e5eb14cf0f661500c39dfdd4a2bb023b3d1378e5b81ec2f2f65fb9092cf3d49753ff4461600a463219553eb4223917ccb441c211e0ef5798a1056a260c28cbae6f03362919f06615b545312183395d5b4534c9ac221bff54b8e2fb8e77519292dd7a4eed8a04b4f5756e5ae57d7f3527207f1954452f5be97c60b905221e4c8de995dba48ccddb2a6088f5bacf84116192a7ba7acb21f896644ec67ae0aa1078d29eb532352b862be8014fd000dd85f9db"], &(0x7f0000000080)) 2018/04/13 16:41:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000005000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:20 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000de1fff), 0x0, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x1b1) recvfrom(r0, &(0x7f0000f9cf9b)=""/101, 0xffffffffffffff45, 0x1f4, 0x0, 0xfffffffffffffe05) prctl$getname(0x10, &(0x7f0000000000)=""/50) 2018/04/13 16:41:20 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:20 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00@\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:20 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sysfs$1(0x1, &(0x7f0000000040)='/dev/snd/pcmC#D#c\x00') ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00\x00\x00\x00']) io_submit(0x0, 0x0, &(0x7f0000000700)) 2018/04/13 16:41:20 executing program 6: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000040)='syscall\x00') lseek(r1, 0x2, 0x0) ioctl$VT_ACTIVATE(r1, 0x5606, 0x1) [ 1018.219134] binder: 6003:6004 got transaction with invalid offsets ptr 2018/04/13 16:41:21 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:21 executing program 2: r0 = socket$packet(0x11, 0x800000000000001, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ppp\x00', 0x109000, 0x0) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f0000000400)={0x0, 0x3}) bind$inet(r1, &(0x7f0000653ff0)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={0x0, 0x3ff}, &(0x7f0000000180)=0x8) accept4(r0, &(0x7f0000000240)=@sco, &(0x7f00000002c0)=0x80, 0x0) r4 = syz_open_dev$vcsn(&(0x7f0000000500)='/dev/vcs#\x00', 0x20, 0x200) fanotify_mark(r4, 0x2, 0xa, r2, &(0x7f0000000540)='./file0\x00') getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f00000001c0)=@assoc_value={r3, 0x8}, &(0x7f0000000200)=0x8) socket$packet(0x11, 0x3, 0x300) r5 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendto$inet(r1, &(0x7f0000fd0000), 0xfffffffffffffec1, 0x20000801, &(0x7f0000deaff0)={0x2, 0x4e23, @loopback=0x7f000001}, 0x10) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$KDMKTONE(r2, 0x4b30, 0xffffffff) read(r0, &(0x7f0000000040)=""/239, 0xef) ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000004c0)=0x0) perf_event_open(&(0x7f0000000440)={0x1, 0x70, 0xffffffffffffff7f, 0x1, 0xa8ff, 0x4, 0x0, 0x5, 0x50, 0x2, 0x5, 0x0, 0x4, 0x6, 0x6, 0x7, 0x9, 0x9bb, 0x4, 0x8e9, 0x80000000, 0xffffffe000000000, 0x80, 0x8, 0x0, 0x2, 0x30f, 0xd2, 0x8, 0x5, 0x10001, 0xffff, 0xb5, 0x4, 0x1, 0x10000, 0x0, 0x8, 0x0, 0x2, 0x0, @perf_config_ext={0x6, 0x1}, 0x10000, 0x9, 0x7fffffff, 0x2, 0x4, 0xfffffffffffffffd, 0xffffffff}, r6, 0x2, r5, 0x2) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000005c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x8012}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x28, r7, 0xb11, 0x70bd27, 0x25dfdbfc, {0xb}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40011}, 0x8050) getresgid(&(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)) 2018/04/13 16:41:21 executing program 4: stat(&(0x7f0000000d40)='./file0/file0\x00', &(0x7f0000000d80)) getgroups(0x0, &(0x7f0000000e00)) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000f00)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open$cgroup(&(0x7f0000002b80)={0x5, 0x70, 0x0, 0x0, 0x0, 0x15, 0x0, 0x0, 0x0, 0x1, 0x8, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x9, 0x9, 0x0, 0x0, 0x0, 0x6, 0x100000000, 0x8, 0x0, 0x7, 0x0, 0x0, 0x143, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000002b40)}, 0x1000, 0x0, 0x9, 0x0, 0x0, 0x6}, 0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0) fstat(r0, &(0x7f0000006a40)) socket$can_bcm(0x1d, 0x2, 0x2) fstat(0xffffffffffffff9c, &(0x7f0000006b40)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000006e40)='/dev/kvm\x00', 0x200000, 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) read(r2, &(0x7f0000fb6000)=""/28, 0xfe2f) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f00000004c0)={{0xa, 0x4e24, 0x20, @loopback={0x0, 0x1}, 0x20c41ec1}, {0xa, 0x4e20, 0x3ff, @loopback={0x0, 0x1}, 0x7ff}, 0x6, [0x6, 0x1, 0x6, 0x79, 0x1f, 0xb4, 0x2, 0xffffffffffff3e01]}, 0x5c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r2, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x20000010880a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r2, 0x4040534e, &(0x7f0000000340)={0xbf}) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/mixer\x00', 0x0, 0x0) getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f00000002c0), &(0x7f0000000300)=0x4) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000040)=0x6cd, 0x4) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r3, 0xc058534b, &(0x7f00000003c0)={0x6d64, 0xcd, 0x0, 0x3, 0xdd3, 0x1}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f0000000180)={0x0, 0x0, 0x0, {0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f0000000080)={0x0, 0x0, 'client1\x00', 0x0, "cc36c5dfea70d3d1", "1595862a6e0e4bf25f261005db592b6a10d8d88ce1b407c85cc4b745b574bc89"}) getpeername$llc(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000240)=0x10) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x4058534c, &(0x7f0000000540)={0x1, 0x5eb1, 0xee22}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000480)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r4, 0x80605414, &(0x7f0000000440)=""/47) [ 1018.271678] binder: 6003:6004 transaction failed 29201/-14, size 40-8 line 2991 [ 1018.287054] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1018.305209] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:21 executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000140)=0x3, 0xaa) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23}, 0x1c) connect$inet6(r0, &(0x7f0000966fe4)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x11}}}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000d5affc), 0x4) write(r0, &(0x7f00000002c0)="a5c0d294e10af640a5d4c3ab7a67bd9724e29156f75ddd6bfe53bc50ba3ef9085c6c52cd0e2a6fddd326ec364494acc24ad3e8bf9c690e919681896f4c09a387a36b8c063ef78ddb4306eae01ed10e740d68aa5c7a92939c1fd5a19c5dd3860f7d4de1fd24088df73b72b416a7450caff19dd2779519577c9cf87149c3258dcd9dd2d0bc7e05ea8fa2a678851e021578e71db2b3ab4a0ad6f194332242cec9673d388ec0501720f92b15c3267bd4e3fc700a7a8028a9b7f1969d5aa719debb8b16df77b2cbee45dd90bef410563ce182e355495154e9585d087bda16a9dd02a231354df99325dc3f051dc3dc77efe569211d22fe39faed990263c5db984e1232afe53c71e30146f358cb4c0a202a1964f5387a5d8e6233b0038e30d376a1e80e12137be7733c716144faa53085c731e21009be9339dbb69c4c97580b753db5e6a9af646e3f2bf08cbe13b7a79f44f96a708134207c6b0e5085de94a0c73f29a4352e1b588e6bbc5eaa4a9c4f6fff95bf721972fd36a75d2b91456c192874a98ce1393d19f917b59e7d976549fd1fc7f10b379edbea0aff66de013e9dd762e2f04d7697f49415c1e6ddcdb8ffe3d2fbf064757275e19174f039158edd14a13938af8a908c31d18766373b4f30ac5758494a6a178b5cdead94563120ba65a0a6cef66caeaf7c2681a9c374f1e280b513669559774994ce05832994762465ca5fc39d71b8a0bc8495fc7898f6f80ee4e3850ece618007b5b548f5ea69e2ce4fb27055f1248b100ac1f45dc475963e1e7aff05e49795ed973a27d91aa4703066c6503a216e5d7b5401d5757ba639cf811b4b48b1504457e2db669dc3e51b567a5b9f2b4315162a72abb324488a0f0784d74d86c68413b56bd7bab1679a578d6907f12cc4e68027a68430517d7bb1add436f45fcaf8d98208a84b200606b153a0a76a5d98fc9e4caea6c01bb13ddcd378e6426cc9e15c6fe6d7f058f7d2128728b2e1bc7f6a16d36ae1793d4672977e6e88af63ee2c352221512bd5810225a5884e235fa88512563a25f51b1a269590466d503acfb63fbc7a188eeba92059fa86fc733ef69633b0491d509f2319c760b5c83099ecbbf2f949c7d0ce17f2e14a73752b9ad23f0fd7ca70f96485812d6f4c924507eafbc01eafd295c69f4379746967c97038db1f7440c0ab3553de2bbbcad63f459df71b5f16cfe86e5d20a75769ee04383b573e88e1b4cb30842234469ed63331e9cd05466fdf51d8a5a1a4785e23af42541c01b1f092e96102adf74f27cd1cb457981f1ebe4b18faea58205cde42d0c8aa89f0ef62bae0a3a6f64d0b17ec92b8b948e1c86b21006aa99c988a0c1e744f607d43865c2c58ceda1568295392af43a93edc9a19f4cf5f9b0a84b60e8dd15f0754aaccad00010000fc3c5b27cbbbc4f182321d2c312cbaf611a08fad4c51786c8ea19f6b6504829eb56fbc6cd940f6f67a06ac3982c51199fb58d4a5014628cad0943382765b5ea323b2d1daac67e903ec672f13ba637c11dd0b1ce0e97627a46060c47ec802754ebf9ff6122a3d611a5bd587a65604ac9c73f9c04dffd4bcc25de6bfd96c5a27fddc2bed65669c2f3466236b67c29a920529e9fbe6cc1e9acb9c55f9e03442fd30b1af3a528074b8eb5a1f2bef98cef8989a8f894fa63658c8c886e50f863a6847d3755db4b84c6fe358720aae0291f407901be0d9312a44f4032052ec365a02a8e32cf395ecb4ab10712e73e611d2a28805cc55fe38c3c6af5b431d59551879306b4fc30deb977081b529e1c00cfd5dec1e04e5a748d1c1754523d98889c96997c98987d2191533d5db74798fc45cd79525dd219d2858ab0cc9e4e72576c938a8176ae08408f0725eedf2e55e57f85d8449ac00f53954ecfb5a268d242ed58a11a224786d1bb82d6661db0104000023ce49459c6a5021d394cba4f2d846791e74fd28c1f1e7ec90aebca7ae8fa8844c084850a018ff39db3f0b309364cc481bbf74767c40edb61a5ae94c278ea6d38676a51a1703c2b94fd75f9ae0d725ecad24536565c994442e7428df55cd7de35a109f3c6361edf4a3ae6c3a26d5de87b4284d2ef2140b1bf84a3a73ffa3c5dcfba621414fa2d741d0acc261c05d47138099d82d9971b38f5be6ce1a8f355440709a8c499194d59620617017e4c164cf3696f191984b06207e686c922ef0741b8123dfab52f2f41a7fdc7273ff85ae38ac381369647eca81278522310d3bb8260ce1e7f404fa79d8f8c708ba9f18c36b9459c1a4d3ccb0fd466f2d7752be51e9cb9bb232d1c5be9425bc080146dd58ec10d93d05b276ab46174e9a77de759e571319cdd1cec3370fb76142ef2925ea07276fba192b4c80e83dc7a63b434ec84859f9cb915765b7155b7bbbaecaf0911b2245169c2c414124d3abace74136dbd188201d13b3659d50078c5be7b8c227a4e1363b8da2cafe1c280961c6fe4715b72e16b662", 0x6dc) write(r0, &(0x7f000069efac)="e26d4afed4d3467b7ee66e9ebb4039955b1d97a427cc701c5e5e6447b6510bff58c6313283eae8186bf1c22f39347ebb869277e809a7002f38611d02a6e3d4e4f6b8923c59ff9438d8c3d353b76131b90e044f80", 0x54) read(r0, &(0x7f0000000c00)=""/85, 0x55) r1 = dup(r0) write$sndseq(r1, &(0x7f0000000b80)=[{0x0, 0x0, 0x0, 0x0, @time={0x77359400}, {}, {}, @result}], 0x30) getsockopt$inet_dccp_buf(r1, 0x21, 0xd, &(0x7f0000000c80)=""/4096, &(0x7f0000000100)=0x1000) write$eventfd(r1, &(0x7f0000000280), 0xff93) write(r1, &(0x7f0000000b00)="826605b103000dd65ad204d5e1050705390d6ec575", 0x15) recvfrom(r0, &(0x7f0000000180)=""/226, 0xfffffffffffffff6, 0x0, 0x0, 0xfffffffffffffcd1) write$eventfd(r1, &(0x7f0000000bc0), 0x8) sendmmsg$alg(r1, &(0x7f0000cef000)=[{0x0, 0x0, &(0x7f0000281fc6)=[{&(0x7f0000699f21)="c2", 0x1}], 0x1, &(0x7f00001e4000)}], 0x1, 0x0) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000dc8000)=[{&(0x7f0000000080)="0f", 0x1}], 0x1, &(0x7f0000d57000)}, 0x0) sendto$ipx(r1, &(0x7f0000000000)="a9", 0x1, 0x0, 0x0, 0x0) 2018/04/13 16:41:21 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xfe800000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1018.339312] binder: 6003:6004 ioctl 40046207 0 returned -16 [ 1018.365221] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:21 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:21 executing program 6: mlock2(&(0x7f0000a93000/0x2000)=nil, 0x2000, 0x0) mremap(&(0x7f0000a93000/0x1000)=nil, 0x1000, 0xe000, 0x3, &(0x7f0000b18000/0xe000)=nil) mlock2(&(0x7f0000b23000/0x4000)=nil, 0x4000, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x40, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@dev={0xfe, 0x80, [], 0x21}, 0x6, 0x1, 0x3, 0x8, 0xdf, 0x5, 0x5}, 0x20) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000040)={0x3, 0x5, 0xc34, 0x7, 0xe8, 0x0, 0x79d5}, 0xc) [ 1018.397421] binder_alloc: 6003: binder_alloc_buf, no vma [ 1018.403217] binder: 6003:6016 transaction failed 29189/-3, size 40-8 line 2963 2018/04/13 16:41:21 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:21 executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x1, 0x161000) getsockname$inet6(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, @local}, &(0x7f0000000300)=0x1c) r1 = socket(0x11, 0x100000802, 0x0) r2 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x4001}) fcntl$getown(r1, 0x9) clock_gettime(0x0, &(0x7f00000000c0)={0x0}) ppoll(&(0x7f0000000080)=[{r2, 0x40}], 0x1, &(0x7f00000001c0)={r3}, &(0x7f0000000200), 0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201}) getsockname(r1, &(0x7f0000000240)=@ethernet={0x0, @remote}, &(0x7f0000000100)=0x80) ioctl$VT_ACTIVATE(r0, 0x5606, 0x100) setsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000340)={0x0, 0x1, 0x8000, 0x400}, 0x6) [ 1018.534129] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1018.590148] binder: undelivered TRANSACTION_ERROR: 29189 [ 1018.596337] binder: undelivered TRANSACTION_ERROR: 29201 [ 1018.598336] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:22 executing program 6: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000003c0)={0x2, &(0x7f0000000340)=[{0xc}, {0x6}]}, 0x10) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x140) ioctl$ASHMEM_GET_SIZE(r2, 0x7704, 0x0) sendmsg$unix(r1, &(0x7f0000e4ffc8)={&(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000140), 0x0, &(0x7f000053c000)}, 0x0) 2018/04/13 16:41:22 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:22 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xfc00000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:22 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000080)={0x6, [0x100, 0x5c0, 0x7c37, 0x3ff, 0x8000, 0x1]}, &(0x7f00000000c0)=0x10) syz_open_dev$sg(&(0x7f0000961000)='/dev/sg#\x00', 0x0, 0x0) ioctl$TCSBRKP(r0, 0x2286, 0x22b2) 2018/04/13 16:41:22 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000000000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:22 executing program 4: mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) munlock(&(0x7f0000000000/0x11000)=nil, 0x11000) 2018/04/13 16:41:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000279ffc)=0x6, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f000039c000)=0x400000000000001, 0x4) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @loopback=0x7f000001}, 0x10) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x401, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000040)={0x3, 0x1, 0x4, 0x8, 0x3, 0x8}) syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x400, 0x4000) [ 1019.472689] binder: 6068:6070 got transaction with invalid offsets ptr 2018/04/13 16:41:22 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1019.513402] binder: 6068:6070 transaction failed 29201/-14, size 40-8 line 2991 [ 1019.545255] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1019.551088] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:22 executing program 4: socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast1, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@dev}}, &(0x7f0000000080)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000200)={'team0\x00', r1}) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket(0xa, 0x2, 0x0) r3 = open(&(0x7f00004b8ff8)='./file0\x00', 0x28042, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f00000004c0)=""/193) r4 = getpgrp(0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000380)=0x0) rt_tgsigqueueinfo(r4, r5, 0x17, &(0x7f00000003c0)={0x1, 0x5, 0x3f, 0x6}) ioctl$EVIOCGBITSW(r3, 0x80404525, &(0x7f0000000240)=""/52) bpf$PROG_LOAD(0x5, &(0x7f0000001980)={0xb, 0x4, &(0x7f0000001700)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, @ldst={0x2, 0x0, 0x6, 0x1, 0x0, 0x0, 0xfffffffffffffffc}], &(0x7f00000017c0)='GPL\x00', 0x100, 0x6, &(0x7f0000001800)=""/6, 0x0, 0x1}, 0x48) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@loopback, @in=@remote}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000deefec), 0x14) fallocate(r3, 0x0, 0xffff, 0x1f) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x98) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) sendfile(r2, r3, &(0x7f00005faff8), 0xfffb) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r3, 0x402c5342, &(0x7f0000000400)={0x0, 0x5e3a8b66, 0x4, {}, 0x1, 0x80000001}) 2018/04/13 16:41:22 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fremovexattr(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='systnet1vmnet1\x00\x00\x00\x00\x00\x00\x00\x00\x00']) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00002cb000)={0x0, 0x0}) r2 = syz_open_procfs(r1, &(0x7f00008a1ff7)='loginuid\x00') sysfs$1(0x1, &(0x7f0000000040)='\x00') writev(r2, &(0x7f0000b97000)=[{&(0x7f00004f2fff)='0', 0x1}], 0x1) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f00000001c0)={0x0, 0x3c, "84c4b84d969fa0b139a7ad6041021213e43c36669f6cab156ae3656c85696dbf8b7e7f426a0f58f977154a589dcf69160a7b34f79db625cc13879986"}, &(0x7f0000000240)=0x44) madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x13) socket$packet(0x11, 0x3, 0x300) 2018/04/13 16:41:22 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xffffffff00000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1019.571907] binder: 6068:6070 ioctl 40046207 0 returned -16 [ 1019.577750] QAT: Invalid ioctl [ 1019.602344] QAT: Invalid ioctl 2018/04/13 16:41:22 executing program 6: mkdir(&(0x7f0000021000)='./file0\x00', 0x0) mkdir(&(0x7f0000024ff0)='./file0/control\x00', 0x0) r0 = creat(&(0x7f000037ffea)='./file0/control/file0\x00', 0x0) mkdir(&(0x7f0000d6fff2)='./file0/file0\x00', 0x0) r1 = gettid() setpriority(0x0, r1, 0xffffffff) ioctl$KVM_SET_XCRS(r0, 0x4188aea7, &(0x7f0000000000)={0x0, 0x505}) rename(&(0x7f0000347fea)='./file0/control/file0\x00', &(0x7f00007d7fec)='./file0/file0/file0\x00') [ 1019.638373] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:22 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f000098dffc)=0x6, 0x4) bind$inet6(r0, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000000)={'veth1_to_bond\x00', {0x2, 0x4e24, @broadcast=0xffffffff}}) sendto$inet6(r0, &(0x7f0000976000), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback={0x0, 0x1}}, 0x1c) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f0000000080)) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dsp\x00', 0x2, 0x0) write$cgroup_type(r1, &(0x7f00000002c0)='threaded\x00', 0x9) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f00000000c0)={'filter\x00'}, &(0x7f0000000040)=0xfffffffffffffd06) sendto$inet6(r0, &(0x7f0000ad6fad)='\x00', 0x1, 0x3fffffd, &(0x7f0000254000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:22 executing program 2: getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}}}}, &(0x7f0000000300)=0x98) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x80100, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x10000, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000180)={0x40000000}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000480)="2f70726066006f632f7379731511f270aed1c82f6e65742f6970768363375d27a831a71139a528adb4342f76732f7365030072655f740457d2b9a7ee9f9ebcdf1d95dfad4369dd5a8e2f6c9a7a35199a54e1fb2ff687a0c14787b469fb9bec599a5379b9244e0cf50b0c5a5d4a602ddfe1d1fa20961f8eef0e2488b00cb938e6f72443238031f33a5c37e66510d520efe91b498ac0b2ecc9b548c608338c6b02d0a028e465280141ab01898eefcd7b508036ed6bde4de548b2433747cd79dcbf431c6f06e99a7b98a7d01402e4071d6cbc6c825534f9223b831566418a57377fa61425e47145ae3fc237b977773505f59299b681fdf4bba0c339c5621aa5ef339ec81b1b3159dac477ec78593bcfba91f692daa53645fffc8de8f33a", 0x2, 0x0) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbff}, 0xc) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r2, &(0x7f0000000000)="a300bc5ec17d7445b541ff6dd268cb037d39a923bad11bf7e21ee2d0c43139b3513431a0da78550ad0aba4d87ea0d1b49335d0212615079db4e1e4f8da2f", &(0x7f0000000080)="c3859c317fb2720aabcd0e035f3a61de78977ee07dc878fcd6f04229d0dbb1f996f8", 0x2}, 0x20) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0), 0x79) 2018/04/13 16:41:22 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x4000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1019.697118] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:22 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000000000100", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1019.772395] binder: 6101:6102 got transaction with invalid offsets ptr 2018/04/13 16:41:22 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffea], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:22 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, [0x1]}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x2, 0x0, 0x0, @msi}]}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000e80)={"8a927799b01a029f25061eda96dd379385fc78b28fcbf8eb8455a6fb67a8de46d4d40000a01a47191dc792f414ac8437036bb34b6632c980073c4cdc084a1966c440f15811d016f5b50e90810603f10a2c83eb8c062194269ab67e4bb4b3c5199cadd60d3f6fc72a7eb011b622072532229fbc9d9c4d1e045191ee2b0d584c8fd736ee3e7d73d5267b67a69251b10c050000692d30ecfb80632608000a7a24aa58b111193c88181907d958cb00807d63dfb58775215937ae2b62b46c6d5816f2fc52eeab0000000000000003252929e628ad2c34a0ef717fb2504d9bd66eabce002faf0512145c072f3087a5566c38fda729442c3ebd62e970a9a3eb242747993601a1a186b8376d39c69c4ce503cf638feeae79436a3c00000000000000380fa7b4c9c2d674b80ef220109f8fa8200de4794547b4da6430ac512116d358949a298812c5d54017aa2fc8b814ecf25610d4c83474ba93a8ad32b16371b42359bf984abb465228cfd848e54abc383d21d0a3315f1b8599efa1bf10bd30a1371757b13aed4a19db7c777995fd42ad44b0522755f8552563c7639ce00da8ee3ece9ded52625aa3f0a1d7b76b32536d39eeae1582710632a79bddf1032b6e6ac794f37ec9d0c3b44923cc7b631c6df64f28d75d99443d665bdb3c6b7961190e8f82a233000001002ce4f47168ef93f01aef51c60000000000000006af34b21ed8437a371c0b427cd8c95f3952ee752b758ea9fa443debf5a2d7cdbaf1a2a23d68cb0806925599fbc1361b8ce27b41d79027894b6c0003cc97a64088edf383a51eef947915369bdd4fc3cced2663d17515838f8fa1a284c5b6ffc5251019eaee59d117d34c73e50fbd33ceb4508cfa0100000000000000114a13542dee77b2651783f6a5d9260036ccc70d695101d1ddb56f1ac26584547d8d5cecb3c672068cc7ab31ddc5ae0a253b587d712c6110acdf49fa0100de0f7b3717280d35b7e70733538a8eec8fb17616d2198d02ba4e7690fab7933b676deddb27755d6a8f29c643dfff0e4bd7c2b13b7a57a3120cb2cbb70200339dc0862dafad481a63e5f90d14c54803d8b100e0ad5cae9a0a7b2f329c3b0000000000000002f4b2eebf781ec7ed16d988d46575c9a73d961c13c7cb674ff41cb3c7f6896d41e86bda845164825e28b9fb719e695a9eb9710f924aefde1c96bebe4274594038347691a088f90400000000000000fc24388cc15dffeda1bd610582c5b74fa6c6e789ce440800871a5e8b85000000005806743e8e075b8624686feb21dbdb9afd74dd0067d82a72c099a2d52a599494388cb56ceb5ef9190980f9128e689e07e98b2ed59e1537fc7de144dc2030374b0f5fcfd8f2ef242803f7bcbc07145f65b8912a4a335b858de8acf080852c49d353a00a5aac3d6a33e0075506a1fd25799f1637b1bafaf09954ef"}) r3 = fcntl$dupfd(r2, 0x406, r0) ioctl$VHOST_SET_VRING_NUM(r3, 0x4008af10, &(0x7f00000000c0)={0x0, 0x6}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 1019.823172] binder: 6101:6102 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:22 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_buf(r0, 0x0, 0x28, &(0x7f0000002fe2)=""/30, &(0x7f0000000080)=0x1e) [ 1019.864648] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:22 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x900000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:22 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1019.929980] binder: 6101:6102 ioctl 40046207 0 returned -16 [ 1019.966121] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:22 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x600000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:22 executing program 6: r0 = timerfd_create(0x0, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000280)=""/146, 0x92}], 0x1) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f0000000180)) r1 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x20, 0x1) getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f00000001c0)={'nat\x00', 0x0, 0x4, 0xdb, [], 0x5, &(0x7f0000000080)=[{}, {}, {}, {}, {}], &(0x7f0000000340)=""/219}, &(0x7f0000000100)=0x78) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) pkey_alloc(0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000240)={0x0, 0x1b6, 0x2, [0xfff, 0x8]}, &(0x7f0000000440)=0xc) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000480)=@sack_info={r2, 0x1, 0x6}, &(0x7f00000004c0)=0xc) pkey_alloc(0x0, 0x2) r3 = pkey_alloc(0x0, 0x3) pkey_free(r3) writev(0xffffffffffffffff, &(0x7f0000001680), 0x0) [ 1020.020227] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:22 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000001ab7300", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1020.081527] binder: undelivered TRANSACTION_ERROR: 29201 [ 1020.154368] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1020.179602] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:24 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:24 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000000)={0x105002, 0x3005, 0x0, 0x85b9, 0x5}) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000240)={0x50003}) r3 = dup3(r2, r0, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, &(0x7f0000000040)="440f20c0350e000000440f22c0260f013ab805000000b9078000000f01d9b9321001c0b802000000ba000000000f30c744240000f0d9e8c744240204000000c7442406000000000f011424c4227d0ff70f353e660f38814d0ac4e27d8c07668ec5", 0x61}], 0x1, 0x0, &(0x7f0000000000), 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2018/04/13 16:41:24 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:24 executing program 4: bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(generic-gcm-aesni)\x00'}, 0x58) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000b", 0x10) recvmsg(r0, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x80, &(0x7f0000b9c000), 0x0, &(0x7f0000da2000)}, 0x0) close(r0) 2018/04/13 16:41:24 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x2001001000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:24 executing program 6: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00', 0x20, 0x1, 0x240, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000280], 0x0, &(0x7f0000000240), &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000000000000086dd73797a6b616c6c65723000000000000074756e6c3000000000000000000000007369743000000000000000000000000069666230000000000000000000000000000000000000000000000000ffffffffffff00000000000000002801000060010000b0010000697036000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000ffffac1414aa0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000006d61726b5f6d00000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000646e617400000000000000000000000000000000000000000000b609000000001000000000000000ffffffffffff000000000000000000004c45440000000000000000000000000000000000000000000000000000000000280000000000000073797a30000000000000000000000000000000000000000000000000000000000000000000000000"]}, 0x2b8) setsockopt$inet_tcp_int(r0, 0x6, 0x26, &(0x7f0000000000)=0x9f0, 0x4) 2018/04/13 16:41:24 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_dccp_buf(r0, 0x21, 0x0, &(0x7f00000000c0)=""/39, &(0x7f0000000100)=0x27) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000001000)={{0xa}, {0xa, 0x0, 0x9, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x5c) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000000)={0x4054, {{0x2, 0x4e21, @broadcast=0xffffffff}}}, 0x88) r1 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x7fff, 0x80041) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000000180)) setsockopt$inet_int(r0, 0x0, 0x40, &(0x7f0000000ffc), 0x4) sigaltstack(&(0x7f0000fff000/0x1000)=nil, &(0x7f00000001c0)) 2018/04/13 16:41:24 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1021.541831] binder: 6168:6170 got transaction with invalid offsets ptr [ 1021.570093] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1021.584437] binder: 6168:6170 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:24 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x10000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1021.613452] binder: BINDER_SET_CONTEXT_MGR already set [ 1021.635145] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:24 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0x0) socketpair$inet(0x2, 0x80000, 0x1ff, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x60000000) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000004c0)={{{@in6=@ipv4={[], [], @multicast1}, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@rand_addr}}, &(0x7f00000003c0)=0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000880)=@can={0x1d, r2}, 0x80, &(0x7f0000000780)=[{&(0x7f0000002040)="de3fc33fa3c4881df4857477a4397bb4ca6741c60e1e9ba7101de507de6d4873c906c91a9c8aef13aced1973161ccd7518fc171039de87045c6184f595125cf1de81600dd8283a8187e1679abc81613c78ed47e60e2978bd01a4af5e7a1e58a5af10e4e2d60b6cc5abc7bb0a1cdbda4bccebbfbcf4a77361278fd9dc210e723d9647d69cdc7510fa83cd4c7c4e48b4e3640d35ca33af956594a61431b49bd1e2d06dc069144a46d783564caa52482c8e6d21c46ce860e9356cca3314dc1cb66c4bdb6b82c78bd590f2b862391a0e19f348ba873285861aaaef735ab95e7921ef67640be9fc2ea99d1c7949c8aabd04e26742f671b31bd5343c3fb6fd2c0c6cd9a7fe9b5adabe752f4a2729635872d81834b67e4ba89b50b156a0e8612d81c57960a3bc01581c9a422a2d343076d0316ed79ae34c6f2dd3fff2681ea426fec169f7310a868e74039971b8f7d62d3c31cd4e309356aacd0d596b555e989e0547a2430341404a34deb3f090db6f6e0ff6cce9bb4c3b9850108ad6994caee1cdf65aa16502240f99b947e07fec29d232779ed5e408b9a10e0dca6f8e6f8882ef41d1fbb58d83a5b345b2fa6fca84688db628c828fae5c7d4c2f8ace3fceb88fc2835397865daa6a1aa3ecb2883d3c48fad1721649de3c24ebdc83b44863ad3ba88b223b669eb73ad25dd5337cecca76ea66c91665e588b14369a77e2bda613b981989d9a1cd05676ea4d4d2d5813a805ec3426f5493ee9dcc533bf680803a9c3698ba07c9f908cae702840c1180bcb2d5b37abb7bb6bb97ed107b40fc113ba989dcc2e579eb3439061e610751c1f74cd4fa6971e6fb750ccfb4663300132c841a90f0c1170371a32ea02dedfcc02d119b9120984ca4f5fe6dbeed1d697b9dcb783c0d3b2d5e8c58863bd77f00d63cbae430f57b9763c03979d15a86574813b2f24561f35f2e1e1db8f94abd6282b0ae42bb9bf429b9cad1e704756aace45a2c0326538ad0ad1f134996dc068ed18c66248f420f9355a821903d1cda505a4e236cc435ff8017959d349409687c1d482889eedc058819c9a0812ba8368688268795077da52d073a3d2ebb9f0c38d10ee4047efb96207043040ab57178042352f5e71380f917811cabf6db7ec22a12312c3b7b14528ae2417a6595f9b9b7a7784ed1dc39bb6a0b899631ced81fdd76cd0bf7a040e25c952ce19c59e26c672482ce1a6f7a533784975c6fb466d8c9359a4a159dec58b5d18d26ae341a3c741fa8496931ab5c686236cf929051c05070e8a0e255b5ab7fe441699885525959433628c183b40623f04b006300fcea03ba2be6cfd7286b28b9caeef35fbea096fc73051866fbd0182e6d08bd260d732193c55998d1c2085e8a32101be70070d16cee6bdbde95a231d45f33b61e351baced8d759d4a12867b1a288679db9cf060f43c4c35a99a34edc2750e0bb0d2a4eecd00f1ea2199fd537984765ca989cecae150c167580681f3cada6db7f777f9b5406c4dc76939dad753a5f8788a8fc725c75dd9b76da68ae1322d23d83ad966a6822e52b5aaf29fa0f2ccccffd93d03ea4eb255258189f2bf51fc8b96612cc7fda1b4d1815ccedef7162263af9bbae76903d1c0d2cfa5b651ce9c743932402bbd20c28e0ce3ed170313fa23e00dd14dd19c1a627da54b2f96a42d5777f98cb41b50800b233af59b0198fd1ac4c933fcfd204e4677c0a84f6e9a6ce98f113dab70c40e0ea6390f38750e2cdab79a3366fecf6f4d85961cef66dae2b85be36601471e17d29cc15a2d05f21dc91510948c63c0a07fbaff3d71b49937d18fc4890f8321928ef7d19db3eea8946c02712b7f8938f914284dbc6aaa628cce0d38b0089057578540b967a9d79bfc7a9ad4d1c8540373d9120d58c9e26ce0da9c81e30bd47defd7b893632e94bae2be5f70615ffecd09b36a23401f96db2feb889ee565d4f932c6d41127aa630266073107e930eb40a79bf51245d65003b2193f2e6dd5099a300d3bf72230a8a349021a22fbf7d3357f946a36af57228cba3be2c82dbec4ae981202ce9797b4b395b9a16a55f3d8ae1eaa6a9d8e2d2f98f56cdf2ba20d32876a53e464196e10ebc11b2da94db1cb190d7740519577aabbddbf6b095a93e7d77041a33b318cc3b8347b4dbe3ccf448d46e95640c77e2d410270da11faa8468fa76046d35a662b7f782b213e652ffbf636baf5e3a1a5e25ba141821fe45d035e8281e5ea460af4dc82a8b50da981758eb32363e65b998e26cfa288dfe07eb5d17901233493d3e41af35aa62972540010ba257142c840e119b8ee6f2215501d0fcef3d4f42093992b517c95125db05735ba9a2eea931b654d602dfeb8f1ae81578e7ef53eed1d29f60c3a93cee5839c5773e76ae2721362c5c7114ce3999279f188253f5cd64049ef59ba151fcc17fd76f3cd939cb156f9b14f2c2ace2243958d8faff7396c8543420c95088a131b0104584d238a1a7b2cbd6ffa4d6dc50ad29d970a5b3d68988b94dfbdcd4c573c2ff239fdf6fe6ac830f10fbc74ca62581fd4986a144bdbd9172a5bd74a1e0ef7d884d62f20ff22c8f09869073c6ee9d5e3fa04dcf3f52c26b40f3658ebc586d31c72ac1827f2d9bcd5d794ee8c1b0ee0af8d515fe4be13519b9bffe4c32d6c444f564123f060a6486d1bec832f3f290575929fa1f70f06b6e98575bb6f8a91ae890613e731816ecb0625e95eb5451afe17aebb0b5386847aa761c80af2c07145b1f520a08c5df8cf8a1ac0a8cc86cac9f18c2f2c8ace0116ce55741681be33885f73b4e2588f7c7d2b69dae248fa75a101203dd7eebb3724596fc88024140f0d944d2984c24d0fbc89056b3bc3665f1ca53111943445cab31e65bf7a1d4965983052320130fa849b2545c0b275eafb1bdac8044cbc9e861f8bd6baa116dace3af63e7f02f7a2790b620c872b02fc1b418f42d8ba934a5d33b4c1a386a08a20b4fee161552e897cc6e291ce916246596eba8cb44f43698fad651a52d29cc8da537de676b790bc3c30a2ae1cc9f6bdd5a2d3e6c698075ac6d1b7d5471db1945f250bac5d9595a8b4e9128ac6f7db53e7a4fd1b9809d1879c63a798ceae6c5ed6807cdad21ee1af2002a1770450dae34f27272af643d51021dcea8d7576d24eeacadaaba1906f431ef2208743e338a70e50982e7799e6791315987ce66ff4a6badcd6bbca6cb281c6ac71b98dc73925c2806522bc2eb3af6a39b295300efaa8e9fb6419287c76a6592d88e576fc6db6dbdf99b887715e174ade8a7effe5d241f2e892de85a7e97de58fd0caf2e57f492e53c885ee763c6427bc4d7ea18fb516072c45d78ffc44adc579f114bbf0f47585034295ebcc829721f86bb25f8bddb9728950e47abb3dae31c09e64c6c7acff10fa2806409b037c85435afe8566e805b5ae27aa15e7872a13c76a20ec838cab6a332f1089519ac1cf78f848e3a2bd5236f4179923cffcab34624b3c775ac96b4f861dde2ac6dd0500cbae915bc77e47278e8d685ef6b47b688ef8d70094b60b44506d7a5d98af6609f8779632a37dda459766ac15a92b5544194b81cbabb51fa4c28b81c71de346fc7e0e39c48097aa7b748595c3387cac7ee444834dfc85c572eb779345a34a77bd27830cfc08aaa13f3b534eaadff0da846648556148d057e2f408d0a6745310a24eef994b26f97e56b2a0f20aa0b34c20b0b1a8aa64e60432bc6d576bb4420f60d3efb08ed93a5a1db55574972cc70732573e3c74c576d8d55d5165313749c3cdcd974905ed926b3a1728a719483d7c77f75fd2298852f34734e10054b931d46dc8890da79d0dad5069249065b7eb0798a20ab6da55e916b0e180dbe877298c58997c9e1f0413a3cecd6c9495cb730935a379bb6b528553ea0b75440066517b5d20643fe4b2290520400cbb0ff341545f1c834e8e1e07558f42a2feb5e720b7b8eba21a2027fa9ba021ad5da0b8cd13599de5128aaf63d6d192af8be99858ae895971ba0a103b60804d972923b4f65979ddaec6e034afb8f1c759cad8915903f01cd32ec555ff9b24b9bfd33d68f629cd14087d50745ccc0ebbd56d10be402d75d355f1a7a51ddfff96d585d3e26aab2ce9b966acfc801639a77ddce5f53401e5bcd63e12471779b1782be71d1ab53f439e889a2e8526c0cef29d171d45bc6538c565f161de9e6a2f9d0c610ca956f75e6eed44feac0282a0a2ff105ce85f0cf004645a42b81f6ba011d60b9726256b4ce6fe4365cbf3249df6c3bd2f9948085c90a1ff1243684af201a59b2b87906532b74150b3716d93484f50860c9ac510cd475576f14b603e59a6dbd6beb2926519f4282964e9934a11ce0fc8147dbddddef83f40ea08e68b655f0afe729e13c12d7220724eb01b8fc0edb7f4c1c32b0051e163e17a6e1ef54058737f7403f6ad2d3b9eaeda7a75945da04b86e120afe297db4dccfde82ed8308441a8a59d6acf11ba5693fe3d6a80cb773a2b391e6a27c2bff6b56f579dcf418ce628bcd6cfb8682e123786f2aefa7dca48d25b603b577e3337c3c127f37d737ff4a7b7d081dd25fa7e106657e2d1268cf478254ea8c7db3e1f7c1e39061047f617863d13ff81643e40e92fc990e4b8f1870732e0e9f328e420042108372d4bc69ded056d15b00fac72db777536af7fd3120a446d6c0e3dcbc4f8edc12ecdfc7cdfc64de7925dc2d80e3fccea52212fda72b45de83eeafe9692472d889d52078e5295939786f37148a39aa36f5cc096da930b64c40960e191b2153477c53bdfdda8c7f803277a1ce53ff1ff71b39e37f3572956a4bbaf98df45ced6c51615b5fb0dec3fbe33f9807cedd86c51bef07ad0003b40fe3bf418837450a439adeade52905dd03f77d3f56176d6fa1f009f96ab57ceca15eabfd54b4cd79d768dc3b43d9d763b4189f86b76a088481de4022958dd0566080df7a07bec25b58427e277fc12c85a9fe9d5b19494bc68ae4f3fb7c5d30d7b7125d54e3a7c53303733425ce4d89421e8103d81a17e5e9957c9062fe8ddbb22b1d24e8575add4ba15df564c8c441ea3ab54ca6d1b00c394e053df60eb8d3cae9cf49252272250f7dc45f232f5d619da73438bd1fce9f81320bd2b48db3b823edbafd3841347c5de0bba5ed24c65ce92f5394c2822e27596920b1d8b3053b552bd13f4c1725c213d6fb00d3513ca05dbf909d5a3b0f8bab87a1f27d3b5c32269fd8c12e1bfcdc7d142dd245f75de82c954bf697648f5b300bfc97ed896575220fb3fd9c56942e135091440e80a1acbd2b0b317fb73fa1752030aeb73ffb48e96eb3421d3b9439e6066e614867af172a2c0c71fb2071fea532014f359a2174be6c4b7ac85a84a0413f66d90ccadee8fe44b398df35071f355df31b11ca5c724045d3f9e70c9753f769cc53c761480859bb48ef838f386142c9ce705e33104796d5c6320087c872efcab009bc58871ca50ae1e68d0a300521a88c10ef3ca0d08fac4666c6002010af04a5df8f1e6b830ef449bbf8ff6eecf4b14bb2a21e446ba3c0ef37707ed1bc036b56ff78a6af6a1acf50ad6cccfa2190b8f80dfd7b7d827ee1ae4087c3608263345dc26a6364b56c9e0e0fd6b955a61373e1373fef2813356d2c5a0fb286e2a2ad5fb994c815e4f5548654cbef56b3252f8974c443f3371608e604be73132d0ec6828c0e681ebf43cdad4b4aeb181afe02f6760f496b63270eec4ef932657b424011af355f9fff77b5e98bd1dfc8f44132485f44c147ca895df0b0ed940380f79e392f5eeaa1bf2758e55ab1", 0x1000}, {&(0x7f0000000600)="1cd5d6a9efe854329e68d99bc2f7425194ba8548", 0x14}, {&(0x7f0000000900)="1f5f96f09572214c4ad38ffcd3bdac861a895fd4b76835c934d0630995ddb1df3cc6e3ef11b01f81dee509a52b9408dd1cfa1eaf2b19311252dcba8d51a7af7a67602fa5580c9509218a0b0b08a84d0e31797a53ea1876cfdff10a9e54181c3d5bdc1b29b31a6b5f5563e1b56e0712501e1b87a3269b46510a36b286ce18ce5b064c11438902eedc3edadf4cc35e376d9a036b0fc694d36cf0b1698921305cc601e451f7a7a64040ceffbfb4b0b900c86a9a445e1c8edc6746c8962f2cd43b6d6c3297f9720583b3888e96873ed7ff389ad4c20e2bb286e1650ddc44d27757e0e66e05f6958e6f682d3678a1274cf1", 0xef}], 0x3, &(0x7f0000000a00)=[{0x80, 0x11f, 0x3, "5dcb754b96e36841f7c7bcd47e9011931e023b103a7cd0ea14cf63acc977640288a38750476bd05405c0fcb0ee7c3baf0629c30a972b1932dd72727f5c69262553d9f71b9dc14ab41f835cc105e28baef6056c8b0c1dd29379d5bc1265a6954d1f8435d0a58000e413b22b"}], 0x80, 0x40000}, 0x7}], 0x1, 0x0) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000000)={'filter\x00'}, &(0x7f0000000080)=0x78) vmsplice(r1, &(0x7f0000000700)=[{&(0x7f0000000240)="cf8e5d8cd14acbd3172c243ca568b20c9fa235c9a9e2b95ba4e15f82a1d5de123e26b89165ead528877702080a9ef109f0ae6a1b8b46a755f307307b7543c23029bd2b0cfa005df62c5419a0075cca2da50ab43fc3b51ac34723d4cbf5ef296df02a288e18ee819680c9d9c247eb2972288eace3d83b4dd44151b14d11e9852891014565f7ca795ab6b748aa319f82ad81289d121545fcc77c8440c86e4f19b2dc471e4e9001ca19878029e930a352cf8f8eb16837e488a6cb6f382ee2ace235e712bdaba145399c1c75aacd33c324cff109e1fbbb67fabd04989daed892432ad7e3c3c23d8a91c5d7837982f6dc36fdda540bb2", 0xf4}, {&(0x7f0000000400)="2908a12be336097aa8352b25919f9e0e124706b4b7e57955bd3df8e4fabe30af594ae9426faa20d046f434af84d697fd53e1dc28258f882db41e58feafdfb365fcc7123b2a4f62b22539342c914bc77c218ed8fa8384e34861a28665430d6f26bd177f0e54b973c992b76184351dbe48047343bbcade122ba8625da5266445f9c11943e7c114ebe630cf32d4621ce75b400a", 0x92}, {&(0x7f0000001040)="5e72f93cd3ba47dd36237869b0fe3a300fae599c6ed7bbca961ccad4cbc5f99d68d6b5f0d4bc124d932cf6f6dd13e526f785c3f904dd31c6194edad6b093bfd3c7168036388e3ac69782537591560bc4226929cbabee6b61e5f93cba2e4264c951900b113a35ab0c4198de727a43b410189abf4fea67cd80c99cd68e5e50c2a19e73b0e6d482efa722b4167aee82489ef2b3ef53bbadbb35f81f745d678935ed1b2cea4952d57b3b51d39f4d66211164150fcb547df9e0ebf20c284334c5abd9ce92a220623dc3131d8b04441aca85d62970c2940a58dc9fde3776085185674d70b750bbf5eb06fa067906fd77ceb4d83dd8af0067bf12067608fa323459be463805460cea4a5d9223f1482b5f445e94657413f0e3a0fe27d5874413018a8014aee8ea40cd116ac26ed31c8871f3e20834edc2475b38e96444d3de73a1e9ef503d3e4af48bc47171274b61446e2c474f12a745591f9223895fedf42bf83000cf4896508a846d7be83ab0d55248b01ff4d8ec71c1f30c539440084c342c944138751b724768107abf9172a75f9af254240710631c4bcf2482d12b56415d258cc34627df15e55b4bca48402528154d038aab5824ce4310052b959cbce2bc1141e1aa09437bd95390dd3ed3e85068c44ed98dedeaa1cf41f1290fe59e3f6e6a2c38fc63a4ee26561f58c06d10718cd668afae123eb6ff025a2db81ef8145130427e6bf4393435857e5a0aea4bb6fd126ce9ee9b63eb324e8f56533c342fec732f44c434a7e85300875967e0fe756f9cb8837ab59a82b23f568ba0053bcb66d63f1e39eb94cd8da9906c14ff07607daa829d051f58285342c0a9193b8914503b72a6c20be41914676f5aadd757a52a3261107ea233bf62403712040584a018424d87cb8edd467d0659e7c036ff294712ba38bd381477249ad7940d6b4858f25ac51c3a87479bab8695bb0524a0e79868eaae2c70f38a0450bc31c484fa546b7a16541bb7695e04ef1d47c3730f37257021597b6a592ee2a6d4597a146246a12b66ec4c3ed3be23bfe913de265f8dc2b7081febecb6609be18b187835cb77fac1c483db985b908c7b3eac01576b5f366295578d3648b62d16707066322d807ba8ec3a7b91bcc529f562ade258814efa724a59b586c9b1402f9f6691dee850fad7ea293bcb718f6db93a5c05a602b39a1aaf7cf6e9ebfc8c9fb007740e313bb93bf0baa24c2b4272b0d5e39a6266e858afcfd81bd6fbc7b9138e44e1f1eb592fab470ff868e201d1cd02a5e5218df693fa4a81758dd5397f676b9eba9faaa0133762f776082da03b950bffdf6eb0b6853aaad8c380e1662ece10f5a9f9509918983733457dfb78f87f39f7e299d743048a6eef418c785d6a58845d4f0fa73ccc66a89774eeb1c13e5c6565cb2273fd38f64f6dfdb05a1f8e4841bb3e3468bcb24f7a4f47cb019bbbe7acd4589e5de1c5fd4b70dc00679fa091a6d348be3a277077443f61d0b1220abef4ae444f839645ca827a2766338b071a1f71928097efb926aa47bc5975ef075f8860d3a14f74276386993b79827091c8e7f27bfebb54e3dc981b71301d21810bfabaf1c0c42e4e2625df5506375d910206281fcf91535c88f4940dc2be4fc7416cf624e0675bf6e82fc1c592ea95402758a3ab21edf4cdd319836d095b62e210d37f9dc1ff284a95d46817ce3180e3fb3f253a698300f2f7e06ce4a899f5cd9d29bdcd009e7bcb79a8b6d5793d5db82f913efd6639ef855212397d1fd3f663c43f45944e39ef4e879f66d08965d65b16f172d1147a6557fe128af5444b06a5230347e0df1b00259dfda7c03a5605ec7818705852f2c95bdc526627465f6c8fbed96a4658f65f9792d0c0aabafe94c8df186ec3a69624c1abb7ceb8fa25574bf02efd97f20e5aa6c146963473ba10d1937700959f194a36ebe76232970a0eeccf74e84ae65df1b779332651b9e64b37f27b61ed1f4040d73a60a17011cb6053f3afe981a01e8bc5a7e1a91bd674fe7e67a7fed40d306132e0126a8d3621584e7b845d4aaed4870f7d50106d5806e7029317478dcffdb9643b4f77b44211a331b8deda87a152dbb0c2cffb42df6f53085ce20aaeb959ce261388a11eb87a0e2abbd577608b5dcdead0d487c75258525dce63f9e43eef4c26b17e166ffd29a16c6615d0e182caffa001d6d60ad6ab7ad5b519ac40307833995dd04325bbb34e85256ffb092f95f754c9cb94f39fa3cac5131b297aee94c2c6402945ae5c7b3df12d45e39036a4ce1b1118b47e131ab39f8cab6d3100aec0a921118d61350f75f87d68d09ef380de48815bc3629a36aba092a3bda7840ece69fbb894f603dbf1092ca1bfb071b5850b59b58807a49dd27b7365426a1990d7b26fef9d0390c57c5e07c77b9f248257c5b97a4de40fa7b321366dff5b0502b863a898c1408a7988f2fc4e090752fe4cdf891aa57eeca0a2a538e1feaa18f4ae63a456ddbe002f3794755207eb16154fb756d54e33094dba36835e81994d7f2ba00354419122b53b62314e01bbe3663ae1fb1995e5a07e0d9dac8b4f3a6482bdf7806eba7ea4cc7817fe73e7addfac44ad4213a5bc62186c7e17646d62431f1a49670348b3c696078f0558af78b3dde24966a7f9ce1432d653e2a017f70b9cfbcd2d9c0ef8ca19bfd7a2d38b4d4d00d45da7c8d1c8b73bfbed11edc02291bcdbba9be88309c207c56979fde9169de4a6613abc634ef598a4d0229a646646967730c2286d832dfbe8c3aa70fd3478733699f8052311bda19610d6075c1ab86fb843ac1bade5ee1d9383961fb7e6b9f7b93197cee97a27d5b17a6e5d3c284892d687402a8bb6494df4965521629fc8a4ba56444d72b332feae9e3b7427151c774730c9c0628455619c36bae0a92f6ed58ea8f014c19a9809b7ce7a78dbd1b99cca753173cdd8f644afc57c8713f08c3f327fc77cb09aeef7d5d4fa0822a007aed35836e3325d36704327538ec4f8bf1009ea1eefca9b0c19f3d6f2ff3cee68000493c87c16f7f8b59f3d69b38299c20b3cfda403a7e4a344ee75f04f14bcc6819a312eeaed8c7b05c1215d0cf7f0b78810a5852fdc23ac8ccdd984a377d7aa60abe78a7f6abfca3289d116052b9b0a15b1894976a6819de09a756f17a2fde2381d57aa8667592032991378a6a64f9a97b73a9f6f7e481b99be262653c63cf48761b5ea2bc4ed5618dfdd1c2e0eaddece9d2f3cc8312f541cc867fb978b7b2f9f572945e2500378ae5db565b6134c97743d01ab17a5712c0982d2a3b93caf3226393640b2544b1320fcb41c84802ecf057c538fd6f1b97899e9e7a77b312be53aa3d7d6a43ab1ca258c4b2702f438b55765292d84173babf1a6c686d5281177ebb10d3f5f80ec50477c2524f4bb2054a2e1ffad5d61b67505524cc9b8ede61c7f02bd6c5f824bb11c5cece9d8fcf4690b2fdc44d3a750a5e883d885ca6e3a10d2d278a8cee3a3b9b41bd232341b2ab58da9118e844d7ef1a1866c722dfd373806e3df25586f719b5db83c49fb64effdb696c4207b4f1e941c1faa0139c8370c7552522322784050e1023723106963209be89b714d7ab985fbe901788094544355ff6057aa4b5f2a3ce072d7f8cb03ef6638502f68f30ea40fbe33bdc2d0ccbb4fb7e91c59fc938fbf8c18f15ba0f5a6ec58d0052a2d7b21c59b6b1258adc9c1a58dbc7e1a8d3b066d2f3f080a1af9d09f91e72448576cb078c4c7bf4f1710b0fd872fea8f096c9d472761a72f0496e70693a22100f918f60816f69d00c575bd1f1813737a3658fa25cbcfd4dca979264fffc9391cf9704386f157f50b7803a23c6365bf7631ddc0e80fd7674ac22e4a19bdf0677269efbcad8a0ed16f22832ab921718da47b453491deef1ff4c6c042750487e2cc3c13b589d3a98c5db82b7198e8c4af0e08cb24553e7db7f82a7fc01d1ad882ff4525cd1dbb87db9be814c3cb82731adc0c45ec0ecc0007a41c9f6af5de49d6fe2be93fc4b2508a7af5ae3c0cbee3d797c114403e2337d963126a64728a56599ba1172c4de6b36cb798957d07a143fcc917839401a2b79920068b975fd5c984b049e158cfd52bd694854a9928c9d6c9754bd01b0d2d297ed39bae84edfe33468f0135752019cb1be3de37bc203dd354764b0d39f3bc337b1e2e947a3973a7e96434aff1e40c724a05088fb4c926d56e74cec395cfd11959e9432e5a086590e9d6b2dccf67af96ad8f5c3919fc27fc50e75fba3738d2ae028d8f77260cb9cecfef5bf14a87dea8a80cdbe23f443370e66518ee2f1276bc8188522136a0742c98565eadb3a82ec44726333a519395c3a665a2ffd9e8efedbbf6c59da16ddc10f7675afee6727a3e2d05db55a64dd404a1456fc646f701fb4bef69f365d3d1df5e26b5563060e92570a19b1fe0b6c5ad79d1dbf1f92f850ac4d61bb83065a2139077839d7e7e031b382e754ae197bf2d73d00f741e3842ad23a29775b1d279f83fbd83f0e0da40ebec4ea056fe3bd71b8c422291f502390a27bbd9852315f142fe81f26dd2d45ece8b28e8ef3a08f5f1c2769f3b1c2123157c64ffd92e45b14a1ec5e17e3c5a97916870f9f32be2374f1ff3434f23f6c957c6b225433fac9e48fc4a0056c34d2f70aec7024c973e1f2c49054755161556b284518602313f0e6c8de0d55c7421696bc8fa8cf45d990534a3c9341f96c380950e09547d540e84fc3610555ead63f7c15cde7af057c3df6ab573ad8f90c5629a33f3c51dcaaad4b7d0de59255019a08d59031adb8c4d9880ed66f1daac6fdda01d9a215c3cfb8e48acbff7a80eb4b661a5acebdf84b3d9bdef9dbc6fac4b7e0bbf54cddf3fc0e0952c9fba4e39d188cc271950d38270b5509000d1c42e0311194fffb904c9889230b62e5a4fdfdbb6a6c2bf50568dc558ed0b1605876f758cf8ef92b4804e10d17aa10c58f70bf14cfaaa02af9901f71b7bc06a96fc8c69831564041f7ee12a167edf2128b9703cc2e43ba5e9e2637d80f3be485739497f80aa8fdc5c7d860ae509907eb5393a2388a0b88de03acc57147ce05ca46b2c463ac2550b28e7fcc329ef0b56a6038746592d256a436e7a7b0ad4e495cb8c977f12f94eeb56a1fc1091ae591065f8166e6d0aa60ed60562fd1bbb1ce9cc8938c7d62216ab25507b007a30d74b14a482da3325c650d472f0d2be34ad4fbed091fea271586a4a8d4d61c3d1254a9ca3e2278aac109aa9742d13c481db9c6600463accd3bb910db6a7534f137645570225182981bbea1e99ba8f360c019120547f65e57a7cde7781bc30d8e9658fb384057290c42664dc95170d3e454bb08077304d9e709d4177606b7bf05b38445a76d6cc547064055a1dbab845a2c002b21dbca947e99f142a0cf754bf7f74b0b52a0ea84e0cd277cc97857cfca88030b9d15a5e390405b8660f7f7da23342c2dae0c5c3d8a3334fff54ca341349e24ea5c9fa509d20df4aad831b18c4071fe4eb8ed9c6f0c1c15038eddf1c3cdbb4a1667c0e6c21f25c2c100844706aa89bf24541aaa1329e1ca39f82ea81351efa0b6baa680270422e1bce298174cef44502ae6b3488bffe50d25ba1502ccb7944d2da2c6845c1be9fd6b7741e02ca956035c1b71ae7c826d7d66c99043fd43d7a6820037103b9461cdc475b9449d7e2cbf93a2f0935c68b2768befc3495edc88721ff5fd0847d5019f4441b55f7a36ae505ffb948b81ac68aee15f9d120cb805b0909897ae8e6a3701d0924a64ce8fbd11b5292f9724f0aa8ef6bb8d15042cb957a37", 0x1000}, {&(0x7f00000005c0)="dfd1fc27e89a7e6fab88", 0xa}, {&(0x7f0000000640)="cacc2daba71ef671f50b5df866121323c5e1875b308eeac368712f1a797f064c0646f4158cd55798a4bc4d203442c6b20c2fa1a369a18e8eb7c4b3dc58ea8df170d1f7dfeccce8207027e9aa39a75a49fe3d97305ec6a27a1c0e28e69c424e345058126218f6257e15bce3f7f631a8f74f95339fba3c4202708799c48372f41d29c4bf4ea6d3edf0d424", 0x8a}], 0x5, 0xb) uname(&(0x7f00000000c0)) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x29, 0x41, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0x28) r4 = socket$netlink(0x10, 0x3, 0xc) writev(r4, &(0x7f0000fb5ff0)=[{&(0x7f0000000080)="1f00000002031900000007000000068100023b0509000100010100ff3ffe58", 0x1f}], 0x1) writev(r4, &(0x7f0000000000)=[{&(0x7f0000fb4000)="1f00000002031900000007000000068100023b050900030000000000000058", 0x1f}], 0x1) getsockopt$IP_VS_SO_GET_SERVICE(r4, 0x0, 0x483, &(0x7f00000007c0), &(0x7f0000000840)=0x68) syncfs(r4) [ 1021.660755] binder: 6168:6170 ioctl 40046207 0 returned -16 2018/04/13 16:41:24 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x700, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:24 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x4000000002, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e23}, 0x1c) listen(r2, 0x6a) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0], &(0x7f0000000180)=0x1) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f00000000c0)={0x0, 0x7, 0x1, 0x0, 0x0, 0x100000001}, 0x14) r3 = socket$inet_sctp(0x2, 0x5, 0x84) connect$inet(r3, &(0x7f0000000100)={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) mkdir(&(0x7f0000024ff6)='./control\x00', 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='cmdline\x00') mkdirat(r4, &(0x7f0000000200)='./control\x00', 0x20) r5 = open(&(0x7f0000267ff6)='./control\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x0) ioctl$LOOP_CHANGE_FD(r5, 0x40049409, 0xffffffffffffffff) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) 2018/04/13 16:41:24 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:24 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000001200000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1021.737187] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:24 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000060c0)={0x26, 'hash\x00', 0x0, 0x0, 'wp256-generic\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket(0x9, 0x6, 0x7ff) fcntl$getflags(r2, 0x1) sendto$llc(r2, &(0x7f0000000080)="e36a55328602adaeadbc0f420c143b5c3147c377a654dd5a21b4c758fc7c5a4392aa2e39c47da8d66a4f53fa68fc3ed2b8c9d8172e43f30ec6d7797aaa25d56695eb29b181ce7339c78f128da143008b4ed0ea062896bd22790402678b6913cb0e3885f6bb12d6383447058d9af6ba317f5d88dba0e83dd1d13fd3bb7dd232c5a93efdca0e761413e889a15c9fda1cca0e02788f8c21357727aa3f0854ca3041ce0b8e9f474694a6d82217f335d40e039c2413e4701049041f1629cf53a309c3e580654c3cf6eb710f4efbe867451bd05d4fe1de8b1ed847a4e4270e79c1c3ae67074b4ee8de32290e8dd99e8f19b2f7ea0a9b098687", 0xf6, 0x800, &(0x7f0000000000)={0x1a, 0x309, 0x101, 0x3, 0x8, 0x65, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x10) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x2bc, &(0x7f00004ecfa0)=[@op={0x18, 0x117, 0x3}], 0x18}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000280)={0x0, 0x9ce4, 0x30, 0x1}, &(0x7f00000002c0)=0x18) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000300)={0xa6, 0x20b, 0x80, 0x5, r3}, &(0x7f0000000340)=0x10) getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000180)={0x0, 0xffffffff}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000200)={r4, 0x2}, &(0x7f0000000240)=0x8) 2018/04/13 16:41:24 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1021.837597] binder: 6205:6209 got transaction with invalid offsets ptr [ 1021.872317] IPVS: ftp: loaded support on port[0] = 21 [ 1021.891401] binder: 6205:6209 transaction failed 29201/-14, size 40-8 line 2991 [ 1021.913255] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1021.942844] binder: BINDER_SET_CONTEXT_MGR already set [ 1021.963711] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1021.975814] binder: 6205:6209 ioctl 40046207 0 returned -16 [ 1022.062657] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 o\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:24 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x600, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:24 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:24 executing program 6: ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x1) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f0000001000)={{0x0, 0x0, 0x0, 0x0, "1fa81bdfc5693eaacc403eec0ebb14069da82c46b9813b79f8bb0000c122474e9e1e68d7ddad316b235a8651"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "e7ad6a30f1efb3a8f2f1256dcb0c09c578524021857b879d300ee8a096c658540ed7e3898814aeaed1611e720d68c8376f030d52f18f76e5366434fff0843c2d", &(0x7f0000000000)="706f7369785f61636c5f6163636573735d2e027573657224657468312d7d00e53a65edc21f0682f074538e84c52464b5036100e9913af8d27a6d0f2133d79d54e8e1a83ab5c1c847b910cf1937df89dab7fcef6e4da2adeb5fc3b5c10f58f5b4d0eb5ee4be09f000b4fbbddc37149486c28c19", 0x73, [], [0x400000004, 0x0, 0x7]}) r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x6200, 0x0) syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x1f, 0x48800) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x100, 0x2}, 0xc, 0x0, 0x2}, 0x0, 0x0, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc1105517, &(0x7f0000001000)=""/250) 2018/04/13 16:41:24 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000001ab7300", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:24 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0xffffffffffffffff) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000380)=[@text64={0x40, &(0x7f0000000100)="0f20c035040000000f22c0640fc7a8000000000f20e035010000000f22e0b9510b0000b80d000000ba000000000f30c46239f7b4a6008000000f01c866b8e5008ed00f07c46179d7e3410f2083", 0x4d}], 0x1, 0x0, &(0x7f00000003c0), 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000580)='/dev/sequencer\x00', 0x8000, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000001a00)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000005000)={{{@in, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@loopback}}, &(0x7f0000005100)=0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f0000005200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000005240)=0x14) accept$packet(r3, 0x0, &(0x7f0000000000)) accept$packet(0xffffffffffffffff, &(0x7f0000005340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000005380)=0x14) sendmsg$TEAM_CMD_NOOP(r3, &(0x7f0000005580)={&(0x7f00000019c0)={0x10, 0x0, 0x0, 0x80402102}, 0xc, &(0x7f0000005540)={&(0x7f00000053c0)={0x144, r4, 0x0, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8, 0x1, r5}, {0x128, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r7}}}]}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000005c0)={"3c76ec53299f8519973f9086bb292c9be39126025dca1eaf80247173e08854b7b83404fab20a3f49dc0348115c5f40dfdd6ac90bce31664a2fff0d9646170dedb16daa9d40f0646739072b022407000000000000ef3907060000000000000028db052584309d89c878a13615d2f8d26ec640bff1d3552c3da6d47b258e9c6efea0e44a9abf8b1df2df4a633ea7efb1167fea42a1a64b874c3f3b4d7008b7d1b429fc2b829b2955a041d790e89853809196a25005cdc6e8c2080090e71e2fee914bee0c4d3e6d16da68cb75e19727254d0c43bba4d0f27f649f852258b80c42095dda143db25a5e0ae1f83c3df37fd8482577869c26f5d12767569ba2fe1f79dc51f0436a00db4385a119e1542527e66419d6c28dc5e2417232b6c2b03c750c2cec9ff6864dd476a6e22f2bff71417f6a3e9028e2ae0778432e797a1464d70839ef2f4b334c11285c7a675e043fd39517198c767112896ea084a467a86af24e812cf10c191cedcb8d913c4689db720800000000000000477d5d9f8e58f9a015633c75c63ea5d6f8e3719781609bb0fe5b14bb7e4ccb83a60bbdb52c6c406fd2dbd08352ce510cacf886a6153026b8dba95d38fc4b6b3b4bcf1536a7dec889836b8ced33a8154c6e41bf0b528b95de216d3b8664e4bc44358fb20ba57aad1098fd73818ec9bb610c9b14fc2695e0fb00d28cc1612ab8982583dba6afe7c980d96b6faee937bb9b361ebc882d93f06e1adc6331f96023d53b8096ffe069b2fe93713b95b89fa622879e97e040d7696ebe24bd5f1742dc29bddf95c513f2881ac7e7a426175c71afea64ab78014e58ea9e2e34d0155ab8acc11e29a1da2a0d6e47d18e05df9f1097a205df152a22d2978d311253f46ae43a9c4cb203af26112f2a731e00800000f4ae2381a5b1eab83a7ff3cd328095700c2128e27e2ec878a99dafc9bf59be3c30ebdf13e8b708cae6b18f9745c842f45839bc7f27abb5b3cbe0b7af83bc2ce9f503c4714b4c79d79bf749ac4cde07fe428a14874c7722785632475186d763ff004239ab3622a76ab22617e7b622351442ad4cd6626c2e4db2af2acfb744fc530e38675b6b8f473a49126f0dc0b4b6fea45d25ab4d704bc3de0064ca707e37cd3aafa34b0be17890dfb4df2d4a50899125872624b939f9e3ac781cfed29cca9d3b349fd7d20307716163ed5f2bc33e5242d752bb471b006dd1c6f01e783a1636fb3162370bf60052f4d260a85093a582520ad5aca1c56797dec37ad109d9413f5be17e7bdd022112909a6804465ddf7a0a38dd9dfcb915c2c0746e22196ecda798689b8f40836e9b0dc0b63b3f306b48aad06f847a9122fa1867dd80a45fe42fd3e6cbe8c5b186286db557ed740a719130736164ffa3461aecfe60bf558a83ddf725fbac979bcc90265ff07dcfd3a3e7a50b00eed8a263163c3af7"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2018/04/13 16:41:24 executing program 4: r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f00000000c0)={{0x0, 0x1}, 0x10}, 0x2) 2018/04/13 16:41:24 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000004a40)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-camellia-aesni-avx2\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe000225070097c11ed4c2c4dc42ffa86eb9", 0x30) io_setup(0x1f, &(0x7f00000001c0)=0x0) io_getevents(r2, 0xb68b, 0x3, &(0x7f0000004ac0)=[{}, {}, {}], &(0x7f0000000200)) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f00000037c0)='/dev/cuse\x00', 0x2500, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000003840)={0x0, 0x7}, &(0x7f0000003880)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000004980)={r4, @in6={{0xa, 0x4e20, 0x7b, @mcast2={0xff, 0x2, [], 0x1}, 0x4}}, 0x1, 0x80, 0x3, 0xfff, 0x4}, 0x98) r5 = syz_open_dev$mouse(&(0x7f0000002500)='/dev/input/mouse#\x00', 0x401, 0x40400) chroot(&(0x7f0000003780)='./file0\x00') ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, &(0x7f0000003800)) sendmmsg$alg(r1, &(0x7f0000003940)=[{0x0, 0x0, &(0x7f0000002540)=[{&(0x7f0000002400)="a369e1ada2d2da9c899e8694e49fdff469686845029fbdc07a18ccceb7330d24", 0x20}], 0x1, &(0x7f0000000100)}], 0x1, 0x0) chroot(&(0x7f00000038c0)='./file0\x00') recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x80, &(0x7f0000b9c000)=[{&(0x7f0000000280)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x400000, 0x1) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000003580)=[{{&(0x7f0000000140)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @multicast2}}}, 0x80, &(0x7f0000001400)=[{&(0x7f0000001280)=""/65, 0x41}, {&(0x7f0000000240)=""/61, 0x3d}, {&(0x7f0000001300)=""/194, 0xc2}], 0x3, &(0x7f0000001440)=""/136, 0x88, 0x101}, 0x2}, {{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000002580)=""/4096, 0x1000}, {&(0x7f0000001500)=""/30, 0x1e}], 0x2, &(0x7f0000001580)=""/40, 0x28, 0x100000000}}, {{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000003980)=""/4096, 0x1000}, {&(0x7f00000015c0)=""/80, 0x50}, {&(0x7f0000001640)=""/235, 0xeb}], 0x3, &(0x7f0000001780)=""/88, 0x58, 0x3}, 0x3}, {{&(0x7f0000001800)=@ax25, 0x80, &(0x7f0000001a40)=[{&(0x7f0000001880)=""/169, 0xa9}, {&(0x7f0000001940)=""/61, 0x3d}, {&(0x7f0000001980)=""/104, 0x68}, {&(0x7f0000001a00)=""/16, 0x10}], 0x4, &(0x7f0000001a80)=""/127, 0x7f, 0x6}, 0x7fff}, {{&(0x7f0000001b00)=@pptp={0x0, 0x0, {0x0, @multicast2}}, 0x80, &(0x7f0000001c40)=[{&(0x7f0000001b80)=""/168, 0xa8}], 0x1, &(0x7f0000001c80)=""/40, 0x28}, 0x7ff}, {{&(0x7f0000001cc0)=@pppoe={0x0, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000001ec0)=[{&(0x7f0000001d40)=""/102, 0x66}, {&(0x7f0000001dc0)=""/203, 0xcb}], 0x2, &(0x7f0000001f00)=""/61, 0x3d, 0x6}, 0x5}, {{&(0x7f0000001f40)=@l2, 0x80, &(0x7f0000002040)=[{&(0x7f0000001fc0)=""/97, 0x61}], 0x1, &(0x7f0000002080)=""/199, 0xc7, 0x7}, 0x2}, {{&(0x7f0000002180)=@alg, 0x80, &(0x7f00000023c0)=[{&(0x7f0000002200)=""/73, 0x49}, {&(0x7f0000002280)=""/84, 0x54}, {&(0x7f0000002300)=""/159, 0x9f}], 0x3, &(0x7f0000002440)=""/86, 0x56, 0xc8}, 0x1}], 0x8, 0x40000020, &(0x7f00000024c0)={0x0, 0x989680}) futimesat(r6, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={{r7, r8/1000+10000}, {r9, r10/1000+10000}}) [ 1022.169264] binder: 6238:6243 got transaction with invalid offsets ptr [ 1022.187186] binder: 6238:6243 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:25 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:25 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x1100, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:25 executing program 4: r0 = syz_open_dev$mice(&(0x7f0000000380)='/dev/input/mice\x00', 0x0, 0x2000000002) socket$inet_icmp_raw(0x2, 0x3, 0x1) ppoll(&(0x7f0000000080)=[{r0}], 0x1, &(0x7f00000003c0)={0x77359400}, &(0x7f0000000400), 0x8) r1 = syz_open_dev$mice(&(0x7f0000015000)='/dev/input/mice\x00', 0x0, 0x82) readv(r1, &(0x7f00000000c0), 0x0) write(r1, &(0x7f0000417000), 0x0) fchmod(r1, 0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000140)={0x4, 0x202, 0xffffffffffffffff, 0x26a, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000001c0)={r2, 0x2, 0x40, 0x8001}, &(0x7f0000000200)=0x10) setsockopt$inet6_dccp_buf(r0, 0x21, 0xcf, &(0x7f0000000280)="db26fb3509a001e6954801b636e381593ed4f1c9d1bd4130c8d8b087bc21b502474a74faf06e013bb5298e22e8fc13c7c11c2c6a579b2d8a8338dde338ce3a97ef9940bcb88af2783f6c90b1ef2c6d164b8c2b83d69d3afd095d84a0faa7566ba381c80705b952ac02f139cc65e65d0644c019deba73a7fc463c7ea6d6a214711b63fb67a0f84d55b19ac5bdd5ee", 0x322) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000440)=[@in6={0xa, 0x4e23, 0x4, @mcast1={0xff, 0x1, [], 0x1}, 0x4}, @in={0x2, 0x4e24, @loopback=0x7f000001}, @in6={0xa, 0x4e20, 0x7ff, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0x800}, @in={0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}], 0x58) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f00000015c0)) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000001640)=@req={0x28, &(0x7f0000001680)={'vcan0\x00', @ifru_flags}}) r5 = gettid() fcntl$dupfd(r1, 0x406, r1) ptrace$setregs(0xffffffffffffffff, r5, 0x1, &(0x7f0000000580)="bbada901834b0f12f560f0a859a2f0ad8f6889dce26d89164f8885832e90d12806241e5c8011843970c0efd3eeb6d9c81152db42fd1b2712a973a3ecf76045de065327b8e8987392cd4b50fd8abb5fcd14f3f851ab1ff1990a9bf22be7e64701a48cd6bfd0c80715f79c5103b5afd08b9ffd92c9f9595ddd726b87c24d83b14abf74de38a3184de0e9") setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000004c0)={r3, @in={{0x2, 0x4e22, @multicast2=0xe0000002}}}, 0x84) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000240)=0x4, 0x4) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000100)={@mcast2={0xff, 0x2, [], 0x1}, r4}, 0x14) [ 1022.248337] binder: BINDER_SET_CONTEXT_MGR already set [ 1022.264317] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1022.283305] binder: 6238:6243 ioctl 40046207 0 returned -16 2018/04/13 16:41:25 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:25 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x101000, 0x0) r0 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x6, @loopback=0x7f000001, 0x0, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) 2018/04/13 16:41:25 executing program 6: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fe6000)={0x2, 0x4, 0x4, 0x1}, 0x2c) r1 = dup2(r0, r0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f0000000000)={0x0, 0x7}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000080)={r2, 0xfffffffffffffffe}, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000737000)={r0, &(0x7f0000161f7b), &(0x7f0000a94f37)}, 0x20) [ 1022.353833] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1022.429574] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:26 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xc0ffffff00000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:26 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000020c4900", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:26 executing program 0: r0 = perf_event_open(&(0x7f0000001f88)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000000efff)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f000000b000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl(r1, 0xc1004110, &(0x7f0000001f64)="967d34f201000005100000009c") setsockopt$inet_int(r1, 0x0, 0x14, &(0x7f00000002c0)=0x7, 0x4) ioctl$KVM_GET_REG_LIST(r1, 0xc008aeb0, &(0x7f0000000140)={0x1, [0x3]}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000040)={@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x3, 0x3, 0x2, 0x0, 0x800, 0x401, 0x7}, 0x20) setsockopt$inet_int(r1, 0x0, 0x14, &(0x7f0000000000)=0x20, 0x4) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x0, 0x4) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000180)={{0x3, 0x1, 0xa5, 0x2, 0x75}, 0x5, 0x2, 'id1\x00', 'timer0\x00', 0x0, 0xfffffffffffffc01, 0x2, 0xda, 0x9}) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000100)=0x101) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r1, &(0x7f0000000080)={0x1}) 2018/04/13 16:41:26 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:26 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000000b000)={&(0x7f000000f000)={0x10}, 0xc, &(0x7f0000beeff0)={&(0x7f000063de2c)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80}, @in=@rand_addr}, {@in6=@mcast2={0xff, 0x2, [], 0x1}, 0x0, 0x32}, @in6=@ipv4={[], [0xff, 0xff]}, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}, 0x1}, 0x0) r1 = semget$private(0x0, 0x1, 0x84) semctl$IPC_RMID(r1, 0x0, 0x0) 2018/04/13 16:41:26 executing program 4: r0 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) r1 = accept4$packet(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0x14, 0x800) r3 = socket$inet6(0xa, 0x3, 0x3a) getsockopt$IP6T_SO_GET_REVISION_TARGET(r3, 0x29, 0x45, &(0x7f00000005c0)={"95016c2f54494d4552000000000000001ed400"}, &(0x7f0000000600)=0x52b) r4 = socket$nl_crypto(0x10, 0x3, 0x15) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000040)=0x5, 0x4) socketpair(0x0, 0x7, 0x9e, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet6(0xa, 0x800, 0xa) setsockopt$bt_l2cap_L2CAP_OPTIONS(r6, 0x6, 0x1, &(0x7f0000000480)={0x1f, 0x4, 0x3, 0x6, 0x1f, 0x102000000000, 0x2}, 0xc) setsockopt$inet_dccp_int(r5, 0x21, 0x6, &(0x7f0000000540)=0x4, 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000a40)=ANY=[@ANYBLOB="7a7a8d7ef018aa0d64327a755cadcdbe23376f8d1f3730821bb01674a160ef4cbb31b89cabf5a7b72071230e34cea2d6b25ef2512d3b4d714de71f1361d47df802658d7af3f4f748d0dee4134ef87629d9a84ce6a76de073cf80f25a7ddb4ecd0b5d67906bfc05a6f9c34da171f51d1a6b5f34d7b1c36afe12ccb7081408f81e66f8bfc052936efc3a9ea78aba75b39b5f63bf3a92d2b2ad2067138f6cd2448191568dd868ee941665fcf8eb096cbf63980d1c05d6e944f85666afa9050762dfa40ace99cf5827464b47a4fb6244df10abd82ff82b2d85078836c1b7990cc20973e3204cfbd3e744238f551262520963d389d467", @ANYRES32=r4, @ANYPTR64=&(0x7f00000007c0)=ANY=[@ANYRES64, @ANYPTR64=&(0x7f0000000640)=ANY=[@ANYRES32, @ANYRES32=r0, @ANYPTR64, @ANYRES32=r7, @ANYRES64=r7, @ANYRES32=r3], @ANYRES32=r0, @ANYRES16=r4, @ANYRES32=r0, @ANYRES64=r2], @ANYRES16, @ANYRES32=r7, @ANYRES16=r0, @ANYPTR64=&(0x7f0000000800)=ANY=[@ANYPTR64, @ANYRES64=r2, @ANYPTR64=&(0x7f0000000940)=ANY=[@ANYBLOB="ebcffb57fb5e100e72f51bc76f1528621bf4a9ec", @ANYBLOB="b956fc7553b9ba3ffebaeffb0566ff519753b305c590af7f1559df8217b83c793ebf44c5107a503682df4cebfc6d3d0c78f8b4d0fe6c9c63bb1695361f3adfa0adbf1e4d4d7709a4010a80b60c70e788d69e533537dc15bd91f01d539386b67e80c29085c3f56481c8ebda4879e895a189047916215d8bcd068618e61814cabe6dbd0e000e5d997f3e5f600722544cd3e4238dcae68f8ae86f82a4369b412e7149868e471137824d630e71fafcde25c6929f34ecff1531f9a39b9af411291401481715911a4d", @ANYRES16=r5, @ANYRES32=r6, @ANYBLOB="bb837a7e6c5186b54c85df", @ANYRES64=r1, @ANYRES64], @ANYRES64=r4], @ANYRES32, @ANYRES16=r7, @ANYRES32=r2], &(0x7f0000000100)=0xa) getsockopt$bt_hci(r3, 0x0, 0x2, &(0x7f00000004c0)=""/116, &(0x7f0000000140)=0x74) sendmsg$can_raw(r6, &(0x7f0000000900)={&(0x7f0000000580)={0x1d, r2}, 0x10, &(0x7f00000008c0)={&(0x7f0000000840)=@can={{0x1, 0x2}, 0x1, 0x1, 0x0, 0x0, "9088ca7a5727629d"}, 0x60}, 0x1, 0x0, 0x0, 0x80}, 0x104) accept$inet6(r6, &(0x7f0000000680), &(0x7f00000006c0)=0x1c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000780)={'dummy0\x00', r2}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0xc) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000300)={{{@in6=@local={0xfe, 0x80, [], 0xaa}, @in=@dev={0xac, 0x14, 0x14, 0x14}, 0x4e23, 0x2, 0x4e23, 0x2, 0xa, 0x20, 0x20, 0xff, r8, r9}, {0x80000000, 0x2, 0x19, 0x3d4c, 0x100, 0x8, 0x6, 0x7}, {0x1f, 0x3f, 0x5, 0x1}, 0x200, 0x0, 0x1, 0xfffffffffffffffd, 0x2}, {{@in=@dev={0xac, 0x14, 0x14, 0xe}, 0x4d5, 0x33}, 0x2, @in6=@local={0xfe, 0x80, [], 0xaa}, 0x3505, 0x4, 0x1, 0x3ff, 0x507, 0xbd89, 0x9}}, 0xe8) setsockopt$inet6_int(r6, 0x29, 0xcb, &(0x7f0000000000)=0x1, 0x1) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000400)={0x5, 0x0, 0x0, 0xe}, 0x15f) setsockopt$inet6_MRT6_ADD_MFC(r3, 0x29, 0xc9, &(0x7f0000000180)={{0xa, 0x4e20, 0x0, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}}, {0xa, 0x4e20, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, 0x5c) 2018/04/13 16:41:26 executing program 6: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x40000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000080)={{0x9e82}}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(0xffffffffffffffff, 0xc0bc5351, &(0x7f0000000100)={0x0, 0x2, 'client1\x00', 0x0, "73260a0518cd910c", "92f0c601f3cb89d92a5697740b45415a6652a89bdbf1fbb62cf880d52dae49e1"}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000002c0)=0x0) getresuid(&(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)=0x0) lstat(&(0x7f00000003c0)='./file1\x00', &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getpid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000480)={{{@in=@multicast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@dev}}, &(0x7f0000000580)=0xe8) fstat(r1, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000640)=0x0) stat(&(0x7f0000000680)='./file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x7, &(0x7f0000000740)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff]) r11 = getpid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000780)={{{@in6=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}}}, &(0x7f0000000880)=0xe8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000dc0)=ANY=[@ANYRES32=0x0, @ANYBLOB="780000000f14d836133deb56b7fdcea1abf669693891c0f4983a3fdf2074a93848a4b10ea1b680f3ef8cc626b2d2ad9d59423cf492a18e5db612213e0b8cb5ff36adc92eae6bce4c986c52e62e4c2cfd3d0840a21f5755db92231f7dab36effea04650a59be03b898abeff34f593c1609d2134c1e145c3bd00000000"], &(0x7f0000000900)=0x80) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000e40)={r13}, &(0x7f0000000e80)=0x8) r14 = getgid() ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000008c0)=0x0) stat(&(0x7f0000000d00)='./file1\x00', &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000009c0)='./file0\x00', &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000a80)={0x0, 0x0}) getresuid(&(0x7f0000000ac0)=0x0, &(0x7f0000000b00), &(0x7f0000000b40)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000b80)={0x0, 0x0, 0x0}, &(0x7f0000000bc0)=0xc) lremovexattr(&(0x7f0000000400)='./file1\x00', &(0x7f0000000440)=@random={'osx.', '/dev/snd/seq\x00'}) sendmsg$unix(r0, &(0x7f0000000cc0)={&(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000280)=[{&(0x7f0000000240)='X', 0x1}], 0x1, &(0x7f0000000c00)=[@cred={0x20, 0x1, 0x2, r2, r3, r4}, @cred={0x20, 0x1, 0x2, r5, r6, r7}, @cred={0x20, 0x1, 0x2, r8, r9, r10}, @cred={0x20, 0x1, 0x2, r11, r12, r14}, @cred={0x20, 0x1, 0x2, r15, r16, r17}, @cred={0x20, 0x1, 0x2, r18, r19, r20}], 0xc0, 0x4}, 0x80) [ 1023.595720] binder: 6295:6304 got transaction with invalid offsets ptr [ 1023.625638] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1023.635736] binder: 6295:6304 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:26 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:26 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r1, 0x0, 0x27, &(0x7f0000000000)="182ac20fa7e95ad7d0f11bb38c37a8b1a7150ad7e868039f32ec847c59886252bf1c62bae18ab59a785e5b4b8ee2dd75b0c7649a", 0x34) close(r0) socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000024000)=[{&(0x7f0000020f88)="24000000100007031dfffd946fa2830020200a0009000300001d85687f0000000400ff7e28000000100043ba16a0aa1ca10bb356da5d8060000000060000000029ec2400020cd37ed01cc073", 0x4c}], 0x1}, 0x0) 2018/04/13 16:41:26 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x6, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:26 executing program 0: mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x1f183484f86513fe, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x3ff, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000040)={0x3}) fcntl$addseals(r0, 0x409, 0x8) [ 1023.665716] binder: BINDER_SET_CONTEXT_MGR already set [ 1023.674582] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1023.703879] binder: 6295:6304 ioctl 40046207 0 returned -16 2018/04/13 16:41:26 executing program 6: r0 = socket$key(0xf, 0x3, 0x2) r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0xfffffffffffffffd, 0x40000) ioctl$EVIOCGSND(r2, 0x8040451a, &(0x7f00000000c0)=""/223) io_setup(0x2, &(0x7f0000000080)=0x0) dup3(r0, r1, 0x0) io_submit(r3, 0x1, &(0x7f0000000500)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="02000000a00a000000215d2924af7b7f", 0x10}]) 2018/04/13 16:41:26 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1023.850979] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:26 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:26 executing program 4: msgget(0x0, 0x40) r0 = getpgrp(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, r0, 0x2, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000000)) 2018/04/13 16:41:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000000000000167c000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:26 executing program 2: perf_event_open(&(0x7f0000220000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$rds(0x15, 0x5, 0x0) mmap(&(0x7f0000340000/0xc00000)=nil, 0xc00000, 0x1000009, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f000030fff3)='big_key\x00', &(0x7f00004cb000)={0x73, 0x79, 0x7a}, &(0x7f0000000040)="b8", 0x1, r0) r1 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0xfffffffffffffffc, 0x4000) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000180)=&(0x7f0000000140)) 2018/04/13 16:41:26 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x10000, 0x0) connect$l2tp(r1, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @rand_addr=0x401}, 0x4, 0x0, 0x0, 0x2}}, 0x2e) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000223fd4)=[@in6={0xa, 0x4e23}], 0x1c) r2 = fcntl$dupfd(r0, 0x406, r0) getsockopt$ipx_IPX_TYPE(r2, 0x100, 0x1, &(0x7f0000000040), &(0x7f0000000080)=0x4) sendto$inet(r0, &(0x7f0000ac0fbb)="c4", 0x1, 0x0, &(0x7f00006e2000)={0x2, 0x4e23, @loopback=0x7f000001}, 0x10) 2018/04/13 16:41:26 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x4000000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:26 executing program 6: sync() r0 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f00000000c0)={0x7}, 0x4) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) connect$inet6(r0, &(0x7f0000012000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:26 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1023.976959] binder: 6351:6353 got transaction with invalid offsets ptr [ 1024.026644] binder: 6351:6353 transaction failed 29201/-14, size 40-8 line 2991 [ 1024.059333] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:26 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:26 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xc0ffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1024.081875] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1024.084773] binder: 6351:6353 ioctl 40046207 0 returned -16 2018/04/13 16:41:26 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000013ff4)=@assoc_value, &(0x7f0000002000)=0x8) socket$can_raw(0x1d, 0x3, 0x1) close(0xffffffffffffffff) 2018/04/13 16:41:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00O0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1024.158246] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1024.173878] binder: undelivered TRANSACTION_ERROR: 29201 [ 1024.175878] sctp: [Deprecated]: syz-executor2 (pid 6379) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1024.175878] Use struct sctp_sack_info instead 2018/04/13 16:41:26 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000dfdff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = epoll_create(0x10007) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000f9dff4)) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r2 = socket$inet(0x2, 0x80003, 0x7) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x4, 0x0) ioctl$FIONREAD(r3, 0x541b, &(0x7f0000000580)) setsockopt$inet6_dccp_int(r3, 0x21, 0x13, &(0x7f0000000380)=0x5, 0x4) ioctl$TIOCGSID(r3, 0x5429, &(0x7f00000002c0)) socketpair(0x5, 0x3, 0x8001, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f00000001c0), &(0x7f0000000200)=0x4) syz_open_dev$tun(&(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x20000) getsockopt$inet_opts(r2, 0x0, 0xd, &(0x7f0000000040)=""/203, &(0x7f0000000140)=0xcb) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r4, 0x800448d3, &(0x7f00000004c0)={{0x5, 0x200, 0xa8a2, 0x6, 0xc9, 0x1de}, 0x10000, 0x1, 0xff, 0x9, 0xfffffffffffffff7, "65cf6a015428be44eab30cc9f0c2931dd9a9adb2975be4444d53c067b91fb56148f3577856f9fb9004460ba45e867e5bb8326b9c67605fd4d4fb9e32692b5a52aad9b6a3c3649be4e02790a0c380a01d2331e4a296dae0bf81f683642b14c57bab9864bd080d0ca138a1d7496c394219f7beebf55ad5e7f58e1384a7e73d86ad"}) renameat(0xffffffffffffffff, &(0x7f00000003c0)='./file0\x00', r3, &(0x7f0000000440)='./file0\x00') r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) bind$nfc_llcp(r6, &(0x7f00000005c0)={0x27, 0x1, 0x1, 0x4, 0xbcd7, 0x8, "328b579d78335a5f58568ef5b71222b629369399dfbd29b1fa16217a86688a491196d677e60545a8aec04764f3038ce2d9659fd6ffa47edfd7d51c51dcb948", 0xf}, 0x60) write$eventfd(r6, &(0x7f000025bff8)=0x20000000000, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x8}, &(0x7f0000000340)=0x8) ioctl$KDSETLED(r6, 0x4b32, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000000)={0x84, @dev={0xac, 0x14, 0x14}, 0x0, 0x0, 'wrr\x00'}, 0x2c) r7 = shmget$private(0x0, 0x3000, 0x1000, &(0x7f0000ffd000/0x3000)=nil) write$eventfd(r6, &(0x7f0000000480)=0x600000, 0x8) shmctl$IPC_STAT(r7, 0x2, &(0x7f0000000240)=""/29) [ 1024.218972] binder: 6382:6383 got transaction with invalid offsets ptr 2018/04/13 16:41:27 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000000039800", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:27 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xf5ffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1024.260191] binder: 6382:6383 transaction failed 29201/-14, size 40-8 line 2991 [ 1024.276198] sctp: [Deprecated]: syz-executor2 (pid 6384) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1024.276198] Use struct sctp_sack_info instead [ 1024.294861] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:27 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:27 executing program 2: r0 = socket$inet6(0xa, 0x80002, 0x88) recvfrom$inet6(r0, &(0x7f0000e65000)=""/185, 0xb9, 0x0, 0x0, 0x90) bind$inet6(r0, &(0x7f00008a8000)={0xa, 0x4e23}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000000)=0x7, 0x4) r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f0000520000)=@in6={0xa, 0x4e23, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x100000000, 0x1, 0x5, 0x3e2c3e9e, 0x40}, 0x14) [ 1024.337432] binder: 6382:6383 ioctl 40046207 0 returned -16 [ 1024.375906] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000169e00000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:27 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1024.420317] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1024.423148] binder: undelivered TRANSACTION_ERROR: 29201 [ 1024.493333] binder: 6410:6416 got transaction with invalid offsets ptr [ 1024.524252] binder: 6410:6416 transaction failed 29201/-14, size 40-8 line 2991 [ 1024.541764] binder: BINDER_SET_CONTEXT_MGR already set [ 1024.558611] binder: 6410:6416 ioctl 40046207 0 returned -16 [ 1024.587438] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000001040)={{0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, {0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, 0x5c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000f80)={0x18, 0x0, &(0x7f0000000d40)=[@free_buffer={0x40086303, r1}, @free_buffer={0x40086303, r1}], 0x0, 0x0, &(0x7f0000000e80)}) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='statm\x00') ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, &(0x7f00000000c0)) 2018/04/13 16:41:28 executing program 2: socket$inet6(0xa, 0x80003, 0xff) 2018/04/13 16:41:28 executing program 6: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r0, 0x40206417, &(0x7f0000000180)={0x100000000, 0x0, 0xa6, 0x3, 0x1d, 0x1f}) mkdir(&(0x7f000091a000)='./file0\x00', 0x0) mkdir(&(0x7f00000001c0)='./file1\x00', 0x100) mount(&(0x7f00007a3ff8)='./file0\x00', &(0x7f00004f5ff8)='./file0\x00', &(0x7f00000e1000)='ramfs\x00', 0x0, &(0x7f0000c81ffe)) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='overlay\x00', 0x100000, &(0x7f00000000c0)) unshare(0x200) r1 = syz_open_procfs(0x0, &(0x7f0000c02fca)="6e732f6d6e7400c552c5ba9e2c33e308163dd83bbbef1a23efb866ab2c1b66c09db90000000000000006f4d0e9ae0e19c79a35b158ae") setns(r1, 0x0) symlink(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') clone(0x3002016f, &(0x7f0000000200)="a36eb1edc8716316c41c5e2f0913fb1a570a0c506662588da11aee8300", &(0x7f0000695000), &(0x7f0000000540), &(0x7f0000000380)="2dcf391e13c945811f3556a646206683fd74052655ba610b0316c915162f2d150c9e88b31ade15ee5037fb724d90e32063201d72f07fb2745691699e94a36e2746a4a8069e8a2319d886e618bb03f074960b487bdf81757ba35e2a7c7c631b0b7122a321684a145c7e1b0c558e59ad12dc3655defe06796cda614086e8027d647bfc64e1de57129417a7e5241ce557e84c5c2bc0ddba84a61188b861cd0407310c445fb599bf75fd996047000fec8803f1eb1a9638b779cdc08c61407a716156a325cfa66fa4a51bc4f505caa8625c8a5f46ae5b0c263a0ff34a2327d7d4f3145b8f3cc784d4813f5d38a8fde9ed0f36fcdc812f2ecb2c4489ecfebb2b1115e18eecf95eba07248a550bc2000000549ad459eaa1a3506ea83c7b3e4eefafb889c4d6adffa054ce72de36c2c57d2236cb261c365a08d6272d696194d0b02095067a1377083c04fc4bb13d4460cf2e6826ec1801f7601b2f38a3eed04251bbeacf97b1245a696bc2a525844609da4a250e9023961a5dce0915eaf1c4988a95968ea2574b8078516d7eda0077e8983832eb59cd88") 2018/04/13 16:41:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xc0fe, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:28 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:28 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:28 executing program 4: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}], 0x1c) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x38) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000080)=0x3, 0x4) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000107ff8)={0x0, 0x10040000}, 0x8) connect$inet6(r0, &(0x7f00008c0000)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="01000200000032faffff"], 0xc) 2018/04/13 16:41:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:28 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1025.410340] binder: 6434:6436 got transaction with invalid offsets ptr [ 1025.427078] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1025.448226] binder: 6434:6436 transaction failed 29201/-14, size 40-8 line 2991 [ 1025.491969] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:28 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) r0 = open$dir(&(0x7f000001bff4)='./file0\x00', 0x0, 0x20) getdents64(r0, &(0x7f0000000200)=""/250, 0xfa) 2018/04/13 16:41:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x1000000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1025.514996] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1025.530434] binder: BINDER_SET_CONTEXT_MGR already set [ 1025.551677] binder: 6434:6436 ioctl 40046207 0 returned -16 2018/04/13 16:41:28 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1025.569280] binder: 6428:6444 ioctl 40046207 0 returned -16 [ 1025.601232] binder_alloc: 6434: binder_alloc_buf, no vma [ 1025.607098] binder: 6428:6444 transaction failed 29189/-3, size 0-0 line 2963 2018/04/13 16:41:28 executing program 4: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0xa3d, 0x40000) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000080)=""/22) r1 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) ioctl(r1, 0x401000000000127a, &(0x7f0000000380)) 2018/04/13 16:41:28 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500039800", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:28 executing program 6: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1423}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = epoll_create1(0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) r3 = gettid() r4 = getpid() epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000240)) sched_getscheduler(r3) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r0, &(0x7f0000000040)={r1}) 2018/04/13 16:41:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1025.669763] binder: undelivered TRANSACTION_ERROR: 29201 [ 1025.696226] binder: 6428:6444 BC_FREE_BUFFER u000000002000c000 matched unreturned buffer [ 1025.737823] binder: BINDER_SET_CONTEXT_MGR already set [ 1025.754016] binder: 6471:6472 ioctl 40046207 0 returned -16 [ 1025.761776] binder: 6471:6472 got transaction with invalid offsets ptr [ 1025.778485] binder_alloc: 6428:6444 FREE_BUFFER u000000002000c000 user freed buffer twice [ 1025.786955] binder: 6428:6444 BC_FREE_BUFFER u000000002000c000 no match [ 1025.796224] binder: 6471:6472 transaction failed 29201/-14, size 40-8 line 2991 [ 1025.834177] binder: BINDER_SET_CONTEXT_MGR already set [ 1025.847918] binder: 6471:6472 ioctl 40046207 0 returned -16 [ 1025.877774] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1025.889072] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1025.910243] binder: release 6428:6444 transaction 2850 out, still active [ 1025.917235] binder: undelivered TRANSACTION_COMPLETE 2018/04/13 16:41:28 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x426442) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='dctcp-reno\x00', 0xb) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r0, 0x0, 0x0) recvmsg(r2, &(0x7f0000000180)={&(0x7f0000bb5ff0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000000)=[{&(0x7f0000fb0ff4)=""/12, 0xc}], 0x1, &(0x7f0000139000)=""/70, 0x46}, 0x0) 2018/04/13 16:41:28 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:28 executing program 2: r0 = creat(&(0x7f00003f1ff8)='./file0\x00', 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000100)={0x1, 0x1f}, 0x8) r1 = perf_event_open(&(0x7f0000fdef88)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = gettid() timer_create(0x2, &(0x7f0000000140)={0x0, 0x31, 0x1, @tid=r2}, &(0x7f0000000180)) recvfrom$inet6(r0, &(0x7f00000015c0)=""/223, 0xdf, 0x40010000, &(0x7f00000016c0)={0xa, 0x4e20, 0x8, @ipv4={[], [0xff, 0xff]}, 0x7}, 0x1c) readlinkat(r0, &(0x7f0000001540)='./file0\x00', &(0x7f0000001740)=""/16, 0x28b) lseek(r0, 0x3c, 0x1) getuid() ioctl$sock_ipx_SIOCIPXCFGDATA(r0, 0x89e2, &(0x7f00000001c0)) r3 = getpgrp(0xffffffffffffffff) accept4$vsock_stream(r0, &(0x7f00000012c0)={0x28, 0x0, 0x2710, @reserved=0x1}, 0x10, 0x80000) timer_create(0x0, &(0x7f0000000080)={0x0, 0x1d, 0x5, @tid=r3}, &(0x7f00000000c0)) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10) bind$pptp(r0, &(0x7f0000001500)={0x18, 0x2, {0x1, @loopback=0x7f000001}}, 0x1e) mmap(&(0x7f0000730000/0x4000)=nil, 0x4000, 0x8000004, 0x810, r4, 0x0) ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$VHOST_GET_VRING_BASE(r4, 0xc008af12, &(0x7f0000001780)) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000001300)={0x0, @in6={{0xa, 0x4e22, 0x100000001, @remote={0xfe, 0x80, [], 0xbb}, 0x3f}}, 0x9, 0x8, 0x40, 0x8fa, 0x81}, &(0x7f00000013c0)=0x98) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000001400)={r5, @in6={{0xa, 0x4e23, 0x7, @local={0xfe, 0x80, [], 0xaa}, 0x9}}, 0x0, 0xc0a}, &(0x7f00000014c0)=0x88) perf_event_open(&(0x7f0000001240)={0x2, 0x70, 0x7, 0x81, 0x5318, 0xc3, 0x0, 0x0, 0x800, 0xb, 0x9, 0x101, 0x606, 0x9, 0x400, 0x5, 0x0, 0x5, 0xfffffffffffffffa, 0xb1, 0x6, 0x3, 0x6, 0x1, 0x3, 0x6409, 0x7, 0xc1e6, 0x6, 0xffffffff, 0x1, 0x3, 0x62, 0x1, 0x5a467187, 0x6, 0x20, 0xffff, 0x0, 0x3ff, 0x3, @perf_bp={&(0x7f0000001200), 0x4}, 0x20, 0x200, 0x80, 0x6, 0xffffffffffffffff, 0x9, 0x9}, r3, 0x6, r1, 0xa) mmap(&(0x7f0000000000/0xe73000)=nil, 0xe73000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) r7 = socket$inet6_udp(0xa, 0x2, 0x0) getpeername$inet(r6, &(0x7f0000001580)={0x0, 0x0, @dev}, &(0x7f0000001700)=0x10) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x4e21, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x4, 0x0, 0x2}}, 0x2e) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x4e21, 0xb2, @remote={0xfe, 0x80, [], 0xbb}, 0x3}, 0x1c) sendmsg$inet_sctp(r8, &(0x7f0000002540)={&(0x7f00000001c0)=@in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x2}, 0x1c, &(0x7f0000002480)=[{&(0x7f0000000200)="30031f74a7390d9264a64d69e587f7624fe40724e6d44760aa673a82888719c07f97050729f67a8e85c58afe922b25b52ef250f948abb77c8219e5b0ec66951e88a8dbe8d675fcab2a80857b79828e20cd814c5a0c1b51e68b8be39b854dcd2ea93fe2109078f7a29d4d490b2a15eebc40298370edcfa21cb4523b070a68f73c611f6ccf56230a6234b22bc43f97b0d2521a41b90ab2dc4996151d522049442f3c15f9ef420a9a04ed2156ee3b2cfdcaf7cd8f2c6661030711068c318169b6e577d6b22791bc3180b87f10fada56591fa6d88f71d53add919872318e8edc5ca019eebeb3d64935f7411638a70028d455a34f292695f1a3566fd6cd9ef0120d4d24e8923079115006e31f36855b93644d57537c85a8da8df8e46b349dfbd790e2521d1d6375af2efbc684054bacd2791a0031095cbc6a62cb7f9e924854ddb0626ac03eb9889c4dcbb7bf550ad53b541263535fbe5c03c6b59c719528d9bb6402168f31a4fa265ae2127e6fd84d86c3dd9ce2082b9a4e17a8794d7cbcd11e89453d8bc00c721a155e903fa26fd042d804c0c60bdc3b76dfbebf62676934a761050186f4c7fd98f3407e6f63637877b0fd15ef4542330aee1205509e751688d2d818913458ac395e26cb1f67d741c9992717982b60a81b8d2fee60b502aa7e8489766293f659893c593f9918c6bb0465ffce89ce296d38dfa70e8d9627b49464c3f746be11a06ae9cdde3173e38b19a4d3bd4f6c23cdd1c0c0ed08af7a5ca7302bc0ed8927cb8d7308629469181863a813479ca0abf15d487ce90441f428bec2e83c908ccfd419537d57886eb33a6d7806f44e146e40284a3ab095e0a462b8c1841583c806f76a962b5be9db7aafd01db3e71eb417784187044a4c01f86066464375a1ea322114dd9d6d044c0ee8f7d3b7388d8508b82997987775ef8fd5656161ac9baee1523822093e45dde0ebc3c72f864ee100e34e7e7ecb620ae8b046a55a3cf700d6ba2bac8c604e5cc98b054512019c0121284e5613780627723f3905fa4783688184b27dc1e11925f49a5a50d6a3b81c9da936d3d26f5deb390f0033a114c8791034073dccc8657bd154b15e5b9187722473a471fbd36b62f44c41fe1ba96f76fee0ff52783ffe038ad0b5c7d6034f5e5f61a91e0b7a9422f8f57404c202064f77f52755899222ac411cfc13663765b722c07770c35325275ec647ba9cef867e8d7f912f2e59e71a3b37c60518d8920870e085627b969087d65240b36fd1048229c6a73d4d885098adcad98147747ffda69c83e05c3b004ca1ec985a3e7876460da505f54e57cc80c4ca2978c4b50c5a0be518edbe7bd46db79b50c6debfb7f2db273d3190fd3b3a586e7424413d45239a25d2d326dadd0b2de7144a829ec1a8743b3eace6521b75f7b4173dc5c1525fa3f863713c2448825a9cfb5f525d977f19359c765242d2c164b0c0fd48915a0bad1a221a421d67da925a268977edc5e01f5ed2ca3d1a3b42a4bee66916b3d4d01e196e2e40d9f500ad08543e3d399745b8e89e035ea5935adefc5a74d34bd030bcb0d4ce6416284960d681c00bacf677588da9444ff4c708b2786a1a78eb5caa4c5f40511c36086177e368f2c50661b9d3fd538ec50f00a99f3afa54fb0c72b074860f232652ca44c06b8dc1bdd8014ed1c0f00038e4a9b3860e649e4e8c8ce48736f040a6e33870e27d8cae8e477d1252757b4449a8574f1d87b904adfd73cf6b1dae427bdcfe339abeb5b799e3287844af026f412b26ebf324bbcb820f23ca619ed2d6235c42aa4b5d1679ea616f34b1db1a6caf8102296e1d642be6a03e986368b41b42b44dbb72aa551b3a409130c6d8c7ae7b917a3065979f398a14efe7086db5e5424441ad81ddc3e1b0991b5654d19730105affea9a08592be1f65535efefbc7072bb90cc6ade30fc889cc5e064c4eda196c991fa9d1135dd52921f1aeafcfea517ba57bc54f47686c3e8625b8a4bb1b8911a3993312caa3ef51465c01b7d1b5f095932f89e143fbc56025be9a59bdc98b648fe0c61bd7ff3f9238f230e4931b3545d0b087acec9018ed50b1a6418651e9a8dfe73a8a982a4862050edf2d7d7f6dbd92f2ea15e3b29d5b2809c96125afccbcb75acfe7440fd2c18e1ce14c8905eaa4178c8d88c7ff943f95630706793202df0dc067575d5da2ef6bb7b19cac8d8e883efb9c5bee443eb9e9319bfa09944197defa52ae6cf97587f632c5599acee89589da71779e221d74cbd6322461a9b375dba3962991b89a203f9be4eb743d35459dd5a869667ac8879766f6b8c650eb3447df47c2adb798de3a872fb87de30befda32454c49badca17723e79bcc63cbf52fdfc7a3a5d8d3998b88175f87af292871ae69b866ae8778d5a1da9b9807a049cb310f5f8881208273217997a6940afdf925fe2e27e8aa0ef9ae7b0b88d80a81b66be80e5e842edea7f577aa46a8155a3ee7557119c47aae8da23ea46669d06db83cf689cb237354763f423a536814e951035188b36fed52d67b28f05c8c84354f5ffd63c2bcd86d0dedd6760a739046661bf8401236322ab090df0950e12813fd20d417fc291405e6dfe376ee3152118b08a64df9e697a80f7a8dc5808ed19af4490ccd2456531fa161e02f51c3ef879080596781206eb1238ab9a6824f25557834b78eac24e4cc612d9d71fa8a7c30100ef9fd24615b91e136e4bc33559c2382e09bbf3fe26c1b9fe7aac2ea1098001007fda3d1c0e2654ee0c530c288b4c9271b5eef5b24cdecdc2490c652af33695691eef25f511aece0897dc871b000a41d9307018bfd01cbf0a85e4af5da53affd7bab3f76bab2a4f450aa32b5dfb9c8f3620a1024f925c0fa8f6a006a66ff638d421e4a75909399031098f003eecca4da171f2977f3021645175fbc0b81d264e5d6fcda03eb9a291eb43f6cc7f41c702d9096906a6aa847299fce5c88ce9ecb16d746b7ca89844c0fb0411926aafe096c4aeffa5ddcb825b4f0c706cb6b32f91781c1c4bcc895e872b868596164a2ed5807e7a6b5341fda68d517562410c764511490a5c2dadecdfe0d27a7164c125b3a72ad56f699e951d4a6907f7b1beb15fe046829d15d5727e1d21c0c6cad9673a3a6318f5c7be121f133cc396e07de529ecf84b56a13bc6543c2ed67274dd37b38ae549cb9e82f45740031ebab8dafeae652df40cc589e78efd8341abeb1cf838fb52f51084a443e3d1bb021d1ef083b776d2a70ceac71fb62d52af2180aa0caa49c91a6cba62306ba8ca83f940edcb5cac845370211f20bc4c022d894060398c0dde55b5e22ba422e865e8604ed5e5b577311a064e51925f9684424b6592c56f81d6111eb3dde0a8b51eaa4713b945f0ccdc3a35a3b2f8e90ede113934f90824904e584819525a3d6592e72cd01ab08f9404809ecf76ed06b47ee78475c24c495353c8cdee6e0b5ade18405d8686dad53e0b0974d8e41f8dc526c110e4cb6ef6f0ad18c70346d0899c1f17dd04c2537040d0dc2bfcb2d14acaada5e78936d5687564e30ea4ee02d82d134d7e1a37df37a229b78fe158a108c58bc754147a132cb72021f2328742e509a9b2e3b46c1ef8b7d58f121fabf931ef24c72ba96b82f46c64c75959c994e2003ab7d914b63f75c838ef0f7e6930390284529ffa4b2ea58c1d9d12403edf2a4130b18a2e7b601147c0d6c0600d7bea2d8b91465ceb641bd619336a98aa603b55378ae8bb5cca9990657e6a28ed6d11b1441fe834dd07e661bf74ba66c4174a5e0a9ec9565b4866945def9701bce345815b5f676e971d8a99fe0b274953e986029a47736d6174babebfd07065322f065eefaaab0d671d9f843db1e73f5b406e99369378c3135de6120df9e55161cdfb0f21b52d273397d3efbb3c306dfa595f9c4010e7f4ff7ce7b280c011bb91cde3aaa885b13f3feb86617899212d7676ec72cd837913c6daf47239be36c8a5055f07ca6f7cbd1ca7585cd0cb56d031cb0d6eb3baa7a98e956eecb8bb6995201ed010d6ac2bb74c6ac95b11048e9272c0713d213f0a79f8f993d28029629c28ccdcae83db9da726b35c633dd15b65a4f04ca52fa9af36dfa2daed7d261e32b8618e8e04580b93c7061463abd239cc595916dc353e5fd5003ab36bb52f95da8680644c8c94df2a90e75544e913d2c2a5dfccaa69bbad3c534c94bcb4045978dbb27f0a45e6ac0533d0f590cfdd844e46dbe4250837be655257e97cbf73549938444e4dab6fc771cc38ee356b551337ab9f328ef74e8548d8c22bd86f590ba65a010ddd83c485aa4149cf3a7b4dae7fc7ebacfbeb050b381a1529926bec71054d033b1233de674482bccaa18b01c17c982ea27f1ea7743e108de82938fcc809a27c96ba139a43de7ef70ad3cfc6605898f94be45e54c66396840cf313a0e5e6337b86fd047554848c24b0b4f4735ceadf0ed5866067900ac51f6b32f34ff1065ed6e0706c5b521bb8d30e3fb5d780e7c79a61c945de6dc2d33dce4d53ba50a2fd925b9a2fd438ab04a5c6d008c870d3b9b0c294fd16c25b8aa12f161ba974e03d900c583caf1798a16f23aeef1f9d03d91708b6952ea109d0cc615a0f390671bb588c2945f16b9c6c39b9a8f07ad919b182a359eb75c523b932cc4c250257cf1bf0208eed5ebd1c65625c2ae396a35f90e004a724f632e61efb078e0aecb2e1aece499ba697127255b9996643522bcc46bb9d71a6aba17ba269cfd89b7052234a943ec4354bcfa7d5e47ca3666969c2620118d6cbfb8f435a65a98a94e081f1257ba4f3691094064e1de6848c34ce5b5c1fed54807d881a5f8096ea722a3b02ef3f159ff6dc24adb11e7b3bfe4a2023d16c44932b1405e0b027c0c7fb1f6ca00597ab37767195b92c9d98e051e14cc3636ecf7dda394e30a4987847fa6b6498a0965f45709bbde80ee7046de7760f18d089353c01ece5f73b7c5da0d50e51556567a50d0fa0c2690fe4300c2d480660cad234c167a4c76bd61fa46fd88654609a15ce2fedcba0560b0f77b65ff7c4fcaee79b8a499b9b1169fa1e112f3d0f7f120fea498ed1fc65b7138cd66c8e3af9bd93f452d264fc64ca3e3559da98ec6311950849e16d1d6eb4909e3a2daea8fec37c223613ba94a76a01bdecfd7110c3c46fde9b9a51a5d08c29a024d7436048ddd1778ff97548ae1b77b05270fe3a1b5f98322132e8c20ad7292222ec34a7d43092be33476a1a343a9947b437c653c29f6726582e6ef384d7bafa908d5c770499517c098c3cd42c3e3891ac8136c8803ee96bd4f22ebeda55554c6cba575543a7761cbfac01a583087a19f8bcd97d6eefb0faa29754079eca49bb127755f518f0c630ebeb7d6395a7de3283c67dea04f2266d6396a050cb109cf0ad37485a0e105caacc45b0262af73a269260d3d7028dbb3fd73a61343d808da90e30cd41e8961ac680782fdacc32186e9b1072fff55149bc39443e00689e83e725d3b3b19ee5b4eef4bea791d7a081dcc43c847ec3eee40b1095d0d7fa0ac62ca183a0d1a0a4c8170392cd37c3cc93b8aa108a240f17276d1d260ce79d68b4def4a59bcb80d7fd0ad8ccd4636473a602be923f58f1686f56f37f1612f019b63dae1da089b5c3b73ef253bdb24dea81458e700f4d9d803e45e6192043234a24bd1ee04f92259f2c3eeb527a491d5bec3fbf97f6594583bc16129cd1ae57a183b51742ddfc4eda344325b79d34b7c58b11b732e4f5fbb09bfea65d80368f333fbe836513414d72c2a3479de4d1f46388e4eb199ce1faa470", 0x1000}], 0x1, &(0x7f0000002500), 0x0, 0x14}, 0xc045) 2018/04/13 16:41:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x9004000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:28 executing program 4: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'team_slave_0\x00', &(0x7f0000000000)=@ethtool_cmd={0x19}}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bcsf0\x00', &(0x7f0000000100)=@ethtool_eeprom={0xc, 0x164, 0x7ff, 0x1000, "e765a13f60bc6ec21b48a898103d504bd7837f97a74f32ceed44872304688856f5a6ba22f25f5b7f2863fd659aff3ef39d71d4200cfaa8ffcddd3ce13071cd46e2192ce1fcc5f4726e28911b5ba8e5718a128c7439c05eaaeee2a8bcd8b265a84cec7861d4e1ed7455e1bf4b7904994719b5c4d202b2e5ba393f18c301f97f3c21b66b35c4b9be7783dc702907c0a85be95f75a807305269657ef8cc088b48b7b0e6d80797bc43a79a59ef6360e9a88cec77946cebf29eb96c0029eeb9e7de7dc4bc19ec9354c99d31a268706cbe723e87c276b4719cd4c59f088d5baa9c3b28936d37aff13bf13dac20d906d894a9d59345ca7da6d3e8924e53d7d30bc80a8b106a7108857e83f163771f82ae63d179ee25015000237540cdd7cc23177d8fd60124095e42beeeaaa66f7d1e55213d8fd03cc8f41b475bb0c236a532d52403431b1593cb5fe1f74c2fd24409484d13f0973d2a9b0475723d52d38bf3c329d7fc5e568b9fa7adb47d33b7b87772b4b6b68851921316a535d5e33b582581ad8c1f4c3e6ac21cf1714f01ffa91a7b20797d745ac603d2706e900c28e46055394c00f86192cf075f87e15f1d901b8232c1db5090a301b991d3652220c279ac71807e03d27dda149ab3e51e6004b6d0934d7e53c36198cb6a29e5ef0d5cb11023a6c73379be361e532ab46a36d93c8ea4bb32e347706d3c1954899c8abccd49e3b83590b6b8d485bfb6e44226ec6226bb86418c16e4b1076441684bd3d5815a6dac348f9c7449d8f2dd59405e9bd8d457a17a687a7a03210e2288f46536da45de5174e852e6bdb7e7030f53a943590b6791d21a2f89e73a4efc565620675ad9ee6efa56397c8a5773378d85fa6b9c301375af80ddee32efda7ca1c1bbdabce0fb0bac5d4374857371245d38e1a0f325c0a02990215e77bdc4f03e2d3ee0da8b48665b97a13cc2c8c6e3ddb99e443f083baad61285d5cb90660975c308da69cde8da0dc8c9f278e2a7062947e16b3c7e46b99a33c7a47f8df954ec25372306af50cf6f35bff926528ae2acc160376372b87e8f26a921c56770bd90326303e2c7d65c6c18bb4f072a80c0eee38cee1db7f16fa4ac2423a4c7237923e56c14a54a05384bfea5037805d002730ab344413fcdac33f70650e5e5adb77d62ceb94574108035e7a0296b3e134bcfa9cd6b0f6feeb3e4bab2d08d909f7a52622b7d4f2116f3a23c8c380e65bd405fcd76a215bdaa675d2058897dadccb30564521d8219c0e976d4893c30f1dd8422113fd930de1d8adbe826378fccce21e694de1375172803bb3e23ecbe58b4102011724728279f39fd99c13c41373b0336b045910769e037092d9d257d7944e43d2d7c7f4c1d849f635f5add081d187cea64a007ede90a6605d89e8ac070fe4955ebcf519e2628cd44c9fbc3cb96c11aefd5a6c08d9cbeb977f1b9782924ee511cadc27e861489b2adfcbcbc0899fee6e30ea6059b8e3870737729ff373e7a099883e922e53997838b0e603dcee22fb6f28066655465e694dfacb53d6e39106122b33b0b47ea3042637d580d6685939de75a669bb4f32723439b7287554d4784bd784e8da30aa8587fb9213d4073a7258b32a2f7fd8369def7f994a162708b26f463ff2af2d9bb3a52f04f8d5d3f1466798848191e0e2f92722ecee3ee77d0dd7590d7371edda9fb1debc80b260c550b674178cc2017969a8f37154b94b46fc889301ce1c21bde90b7e71bd01458f5e6a5f807385f472930fda6d4df51794275b5cb04932cad8934f72637154885613d7693cba9dde78d8364e505bd8c927a9ed48e19e6c9c84794cbfcc785088f2e641524882c4b6eef977a77ee349faf9f272dc57ae284e247d2a43b1ca98c3192662fcfa7f0d1350807b94b08869059c5dc7853b8c9d70de375bb88ce7aa4dff6a09385b71dd31d479c5b1fcc5f38e646818174488353a662ccd068be174f79c66b69298cf4d7a942f35624bc994310751a303f76e436cb309dd6fe497a860f280888c31c459f035af122f31abacb718be31046f357880dc2144c25fe5b738ef22340a00d265935d04b38aa24d671e44cb5d8dde48e8acb7ff3bae7c093f96168742ddb4e9efb8205546441234cc2f1dc17f7e4d138177cd2051823de64ac1f9b290a94de7aaa54b145731b13f56efc96824fe9dbf4d17d208b1c252147f5c795b04f191f214faa0050c2692144fe4d736b9191a3d449cf0e53f6d454f652b72c8a8bcecc67cc8e494dab42c5dc198b7be852ff214516f9024cd0b40ed31d5173b5b11e13456695c65a677401f79f9331124e56033d325cd0f49917dcd5f936cd2990277ae4128c16d643fa68f655c9835eee534b722d6f2dce02b7628b7c72c6689b96a4cb491d600f498b3bb8b397704abcc4ce6430cf46bd6e7a0181405f0e733d76e2a84aaf3106afbfac54a8bb12b09c8f2eb130018d4f055ae76449190ad8e77bd4e212f4aa76ec4f89230385885dd72d064078b6bd5845b3cf818bd658569f3ffdf046470e4433e706cddc7dfd10b9e2ccfd585350cf313b263a01c307fdc3c8b6fc0c6717b0c23271b6fb658f1fe16bfae23c2d3ab738dd39359cf333196499ca031c73000bf9cbb4a570942de2559061f81456c24073e2580e627bc8f27c1ea8ff2ca37c6631d6729a6597f04843cb04dc0ead2a91572ef90a87cef74637d6824fac22f34a6c874c7b85985efbee0b0afec7595eba115fa3f428e730b32e96431ca73676e6190a3df3e4424f3ebb54607cd82d931b981806e098a93804d073e2a182776ba1dd3bd9396786e190e786f9364ead7b016f6dd7fbcd6f267cd92984065a73f5e474c2f32a74bf333a175e600bad4291807436c910322b8e1020f473a544d2a7df4b606e9af316b9689d939786fd085b5b6931437a5bcea03db1c7092532289f88795512981e4e78e0daa75640c78b5ad19883c56b1764dabdfa2f0af56542829ff95c2afb27790b2afe36d1e17fee78192ed82f60c50bbd3776330b0c4dc59b355b87d7c60af8fd18db5712797c4d2f998c531d6861fb483f6163ec53860efeecfa7872f857fa3a89d7daabcc1fba75ea1ec17e9f32b122e9c9ba72d68c10a60afdd73cbd80a3d082b250db5a15a983479b28de5b4458f7005ccf99c6119f87fa8f9a0fa573c9bc865ad3b115fe526c05b8b910d27035b071b7616a0cc26584bffcd7642cc551ce15d0259bb2768741f79bd74d709d3b28cfd1bc2aaa280d52db0cb0ef7ca7a3764ad5ee58a3748a9016594ce1aefa0289f6df7f3be2362e0f0a1b1686ec356e7f3dcde0793a27bf78a5e260ba5bb12827605cae8969347201472021a6c8f09fc1b2eb017082ac229ac753c8ddb5d280cfab6afc2618288e33ac0134a50bddc31b771a4230635f9d94cd7182c1d98a12f6c0e091531ee093fdf1ccfe0919cef11a29ab5c452881c1c636ca34ae0fec8a149e23a2ddc73f1fc56fb6d367ee33609378792bb2872c4f511aec55e59e3849954ca05a4f08fe9210b51e0ec343f334a03acb61aca8743c31de2889a496746b0ff35ddd235d37f19cd88c0534956bce309e7dc25f32652120951e9fcc8c14f604fdab134142e8ed6e5b02d9ca32b3ec79e323313803d7bb29eaf312918726dfa746beb78fda1ae02b6d5133864935db92717dd9b58a90b2307e78f212535c5bea586651e6d4ad1da3ec67d68b2f1be5633fbfbcba37abc6f2767dea31d9f47fb0e1a65ea6b4555401e527c163d1cc8be96c3f0182242183ea9dde44ae00da7e01cd3f2368628cff260e22831bdf2803f2d16736d11ba93b6595749169217da8af1559b652aa6b0360c092f430d688f7b512d4f4835db5b839f447e5332cf9f1980aab8537ff4dc885ada1c41cf097356170a3b3d4cb562d2c9d093c76243f3b74029db7b433b672282c579b81fb91aef4e7ce09a94218acdcbb990ba467478eb8fa59ef98ec430c2b1d6c5a5c4c2fe479b64d876e57ec6c350983e0340e8aaaedd6b2bdf84aa25eb5b98503b80450e266021a6fcc8d2c86e5e4266106f67ee54d4ad2e7e577f014712c55dc1ed8a42a70ba7d01035d5bef153ec4b447296a43b535fbea66e244fea1fe276c67d97c6aca86cfff011b3ee56a5b3208705dd35682c9ec7ae3b853308e05b36431e36e59bbceadb85d902204a4096edddfcc084f634e7ff1a0068dab8286b61b5a5ac03f5a9a16ca39fecd05cbb38870a9025758a31f0efb0dacece9653a28edf111f01569b24cdce8979de295f62f639ea6028ef54102f7d2b55f531ff89b135644165a65205fe3e036f47da9f26005aa6d86a54c178aacd1e962de1b928e00fad8c7db0631250b77c53b9427177352f99495c5301a119c906ceafc225317462427432be5b9375e656c87d43cde4229992c7060d5c4df3dcd047fc95f72e95bf771c4af84ca0c321a4b9910a98fcc216933cea8281ccebf44ec4aca4a17188ee7fa16e427d96734ed3d9e6ee99511b8f48db924b1883d5fda1bfb6a52bb8eb852a63965c7ffa2a105736a84ae06f8c6b78d3f59b2221f948c0badc5f10be0fa0cfab26c8e230b3a284ccd80220070e8f44eda712001f8bd7e8e53ceebf375ec41768e40c5e221901f2e30d686437ed7eecc8ff1e3a8d5b53f7497c3f0b8794b43c6a9f55f5d78d4137bf1c4e8938a0534d4edc56fbfd6b18d4c39543d3be691dc33653bb8210c0d0986a29bd26378c22df4ca5fe5b2b75d0bc48dc141c9dc8f4290caf636d4cde668e69a179a2b908e6b6363b72e8271ec911cdfaf009479c4242ada6548a4ce8980e5b05c84f87e8ec23e007ca9ddbaa51e5d57c42e16e9296e9917485f75a33c1730587fd3cef74c9d72a503bbd9965f7f909c53276e98c9bd45701f27cbf80aed07a2e14e791d94afd08c86af9ae78819f587dbb004e3169e5cb8b013302423f1e8fac204b5c02723773e67a18a0d711c6d4a6f7e496dd7c271b9a4f7f001f9d8bd73bd2a1efce64a14cd110ab15d0449725fbedc39a7afbb5d264bbf9060334562793bcd5f9558174b160d44df4e18dba027734a9fafe560f513476086890fb05b510508c5ac9093338b095bc61c1abaf66f07d5fb506ad31d093311328f9ff4a8a723b7712c7a35451ebf3838cc9f9bc739b910353ee6d382bdc8d88d665223869988a2619a2432abd0277dd2509f73e2c4ccef12f97867891a07aecfe9316a5af27fdca168e2be045e4862701233a9012d7bd3eb151b73e09d8abcf338fccc0664d9326a9732f52da546e40609c60f6dd0015438d41406747f1050bccc02d3b206316a7d264c4a6d05e0cce2f068103cb245da1c43a722395b654008bffaafbadb3304900161647b956a2c354fdb15d428c679b8d64e8d837a9511ac536278b4f70dc5d4ff5f3dfab6d96ddf25ed3ff3286a47ad59a153cab8a5304f197664a8204974ba88a3343a6633495843089d03293df87eb2ed07227451eb7c573b48ebccf64a54d23e36630eeddbe7e7cf148c6c98db31bc6f41df3a7e1cb00cdf1b8c8b224d9a3b73bac0482d87ae3ef49e5cdad7c489f2765798e7884889e05a26167e962f67d4276c31e9ffba662cf4f6f81b3448b830ab7388fb951c2f577a194319c7a6637a817fd698cc0d2ee0ca19abb6646dab2ebc5dd092eeeab29089acbfc954fad2c7965306f129ee0a61ea5f2b77344754a694e561b564556f1e079969bc8613d169e119c73d163fd7683f8b4b0e02a19c59bea6d59bbd3625403de2b8b5763f964d861e19092a2ff9346d58008fa812a8eb"}}) 2018/04/13 16:41:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000ffefffffff7f0000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:28 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:28 executing program 6: clock_gettime(0x5, &(0x7f00000000c0)) r0 = socket(0x10, 0x80002, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002080)='net/rpc\x00') ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000002380)=ANY=[@ANYBLOB="070000000000000002000100000000002700000000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x004,\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="00000000000000000200000000000000a900000000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00;\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="000000000000000000100000000000000100000000000000", @ANYBLOB="000000000000000002000000000000000100000000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00k\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) write(r0, &(0x7f0000df8fd9)="2600000022004701050007008980e8ff06006d20002b1f00c0e9ff094a51f10101c7033500b0", 0x26) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000000)=0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) kcmp$KCMP_EPOLL_TFD(r2, r3, 0x7, r0, &(0x7f0000000080)={0xffffffffffffffff, r0, 0xf471}) connect$netlink(r0, &(0x7f0000000100)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000b4bffc), 0x4) sendto(r0, &(0x7f0000cfefee), 0x209, 0x0, 0x0, 0x0) ioctl$sock_netrom_SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000002040)) sched_rr_get_interval(r3, &(0x7f0000000200)) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000025c0)={&(0x7f0000002100)='./file0\x00', r1}, 0xffffff90) nanosleep(&(0x7f0000000280)={0x0, 0x1c9c380}, &(0x7f0000000380)) connect$pppoe(r0, &(0x7f0000002000)={0x18, 0x0, {0x1, @random="fbed0d81127c", 'vcan0\x00'}}, 0x1e) recvmmsg(0xffffffffffffffff, &(0x7f0000001f00)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000002c0)=""/161, 0xa1}, {&(0x7f0000000240)=""/64, 0x40}, {&(0x7f00000003c0)=""/186, 0xba}, {&(0x7f0000000480)=""/4096, 0x1000}, {&(0x7f0000001480)=""/71, 0x47}, {&(0x7f0000001500)=""/152, 0x98}], 0x6, 0x0, 0x0, 0xfff}, 0x8}, {{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000001640)=""/213, 0xd5}], 0x1, &(0x7f0000001780)=""/133, 0x85, 0x7}, 0x4}, {{&(0x7f0000001840)=@alg, 0x80, &(0x7f0000001e40)=[{&(0x7f00000018c0)=""/178, 0xb2}, {&(0x7f0000001980)=""/43, 0x2b}, {&(0x7f00000019c0)=""/176, 0xb0}, {&(0x7f0000001a80)=""/251, 0xfb}, {&(0x7f0000001b80)=""/145, 0x91}, {&(0x7f0000001c40)=""/58, 0x3a}, {&(0x7f0000001c80)=""/159, 0x9f}, {&(0x7f0000001d40)=""/214, 0xd6}], 0x8, &(0x7f0000001ec0)=""/12, 0xc, 0x1}, 0x7fffffff}], 0x3, 0x40002000, &(0x7f0000001fc0)) ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000002140)=0x5) ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x4, 0x101, 0x4a324670, 0x20, 0x3}, &(0x7f00000020c0)=0x98) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000002500)={r4, 0x5}, &(0x7f0000002540)=0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) prctl$intptr(0x29, 0x0) [ 1025.922429] binder: send failed reply for transaction 2850, target dead [ 1025.933315] binder: undelivered TRANSACTION_ERROR: 29189 [ 1025.970488] binder: 6488:6489 got transaction with invalid offsets ptr [ 1025.993211] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:28 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1026.019255] binder: 6488:6489 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x78000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1026.066469] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1026.067421] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:28 executing program 4: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x4, &(0x7f00000007c0)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) sched_getaffinity(r0, 0x8, &(0x7f0000000140)) unshare(0x20000) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000000c0)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000180)="006b43000000000000f8ffffff000000000000") setns(r2, 0x0) clone(0x30020100, &(0x7f00002c9000), &(0x7f0000d70ffc), &(0x7f00001cc000), &(0x7f0000000080)) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0x7, &(0x7f0000000000)={0x101, 0x4, 0x4, 0x20}, 0x10) 2018/04/13 16:41:28 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1026.140798] binder: 6488:6489 ioctl 40046207 0 returned -16 [ 1026.155635] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1026.232925] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@remote={0xfe, 0x80, [], 0xbb}, 0x0, 0x0, 0x3, 0x1}, 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x0, 0x200) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000000c0)={0x0, 0x0, 0x3, 0xefdb, 0x10001, 0x3, 0x7, 0x20, {0x0, @in6={{0xa, 0x4e22, 0x8aab, @dev={0xfe, 0x80, [], 0x1f}, 0xfb}}, 0x7, 0x6, 0x5, 0x6, 0xffffffffffffffe0}}, &(0x7f0000000180)=0xb0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f00000001c0)={r3, 0x7}, &(0x7f0000000200)=0x8) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) connect$inet6(r0, &(0x7f00001cd000)={0xa, 0x4e22, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000080)=0x2, 0x4) 2018/04/13 16:41:29 executing program 2: capset(&(0x7f0000581ff8)={0x19980330}, &(0x7f00005ccfe8)) r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) move_pages(r1, 0x0, &(0x7f0000000080), 0x0, &(0x7f00000000c0), 0x2) 2018/04/13 16:41:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:29 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xfc000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:29 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:29 executing program 6: setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x10) r0 = socket(0x11, 0x4000000000080003, 0x0) setsockopt$RDS_GET_MR(r0, 0x114, 0x2, &(0x7f00000000c0)={{&(0x7f0000000000)=""/109, 0x6d}, &(0x7f0000000080), 0x28}, 0x20) setsockopt(r0, 0x107, 0xd, &(0x7f0000001000), 0x47e) mmap(&(0x7f0000399000/0x1000)=nil, 0x40000, 0x0, 0x12, r0, 0x0) mremap(&(0x7f0000399000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000398000/0x1000)=nil) 2018/04/13 16:41:29 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000000ffffffff00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:29 executing program 4: r0 = socket(0x1000000010, 0x4000000000802, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000140)={0x2, 0x1, 0x3, 0x7fff, 0x5, 0x400}) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2800003f001e000305000000000000000007000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008000a0003000000"], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000180)=0xfffffffffffffc73) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000340)={{{@in6=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@multicast2}}, &(0x7f00000001c0)=0xe8) sendmsg$nl_xfrm(r1, &(0x7f00000009c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000980)={&(0x7f0000000440)=@updsa={0x508, 0x1a, 0x200, 0x70bd29, 0x25dfdbfc, {{@in=@local={0xac, 0x14, 0x14, 0xaa}, @in=@loopback=0x7f000001, 0x4e23, 0x1, 0x4e22, 0x0, 0xa, 0xa0, 0x20, 0x5e, r3, r4}, {@in, 0x4d5, 0x2b}, @in=@multicast2=0xe0000002, {0x928, 0x1, 0x9de, 0xce20, 0x7, 0x7a1, 0x38000000000000, 0x5}, {0xf30b, 0xd0, 0x4, 0x6}, {0x1, 0x13, 0x5729}, 0x70bd25, 0x0, 0xa, 0x4, 0x0, 0x68}, [@migrate={0x88, 0x11, [{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in=@loopback=0x7f000001, 0x3f, 0x7, 0x0, 0x3504, 0x2, 0xa}, {@in6=@mcast1={0xff, 0x1, [], 0x1}, @in, 0x3b, 0x4, 0x0, 0x0, 0x2, 0x2}, {@in6=@dev={0xfe, 0x80, [], 0xc}, @in6=@mcast2={0xff, 0x2, [], 0x1}, 0x7f, 0x3, 0x0, 0x3506, 0x0, 0x2}]}, @algo_crypt={0x118, 0x2, {{'ctr(camellia)\x00'}, 0x680, "59b8610b88a7993e60c304f9e54ec71768cd0e37331c40aeb1bbff95d7861717bbce2b70d0ce2e5b91acc6dda7401f562296b6a1b42d259d5314e06eb3cd884ec74b61f6dc9e37d53f484f9430c6bb5badf25b66ba22e17dff4749a875432d688e37a0cd31aa6dd0adc2472e80a2374744d5c0d116f41d38de87b60dc10f2769fc3d290b9a9105a53d3ce50d383d983cf2e5612dc4059f110c476ad1e0322c673f6d4c3d35c7a7af1720230f084c8c6f3c3aada952ccddd2a8ed92a115551a99bdfc5d59178ffc40855934089b2c6fa9"}}, @replay_thresh={0x8, 0xb, 0xfffffffffffff000}, @algo_comp={0xf8, 0x3, {{'lzs\x00'}, 0x568, "deea6a298630651f41d8fc9389920b5a60a080ba508f068111ef95b01e0075b3e1402dbe87d93f36e7e32cce1c235bbbdaaf142b7badb2ff35e28e943a69e3632bdf73000c9dd9d00caac83aa8c40f871468cf7ac7b3869f6942311e94029c85c0c370b399185d61fac0c199c3bc04ce46ecd9ba90b9cade6022ca8d81399df5499f42ebadee7bad9dd7d085a75a69a3a0852a7e7a6cd514cb4e7ae4b2db52e8bbf53283e7f8ab8fd269f61552"}}, @tmpl={0x4, 0x5}, @sec_ctx={0x54, 0x8, {0x4e, 0x8, 0x1, 0x7fffffff, 0x46, "29c30299a1e6fdfcfbf0b59105e8b92a26f57407d8378e4cb4b3774e9aab8177029ff0845210c6c73f48f91379ec763ac64dbe2b0e37d218e5f5ac1058289ed5fc731e0f574c"}}, @algo_aead={0x120, 0x12, {{'gcm(aes)\x00'}, 0x6a0, 0x1e0, "da8b33d0f67285311ef9f8081f2975459e2ee9eb926d64bd42610570187ff30be27107732dc9b3b3f9be71ec168197b432cfc38f8b8bd679079dc84d47d67b959c7af8a52e3fcde7349af63890933c3c402096a6ca82be91727b2ba18cfd4d58bf9c46457bfa0684e4c1c989f0954accdcaa335ebd3372f1c55385f9602b508633824411b7aab9bb26aec9dd858240a6ef4129b79de64da5dda6e2faa90b9078b9f929da4b55199d9a60bdf7064a2a32a92cfcc26a39c22915c3e777fd8ff596bef3c855fc93ef5761abd77382e70174cf6ab734"}}]}, 0x508}, 0x1, 0x0, 0x0, 0x800}, 0xbcf84322a8d050a2) [ 1027.210201] binder: 6534:6536 got transaction with invalid offsets ptr [ 1027.258164] binder: 6534:6536 transaction failed 29201/-14, size 40-8 line 2991 [ 1027.290099] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1027.292335] binder: BINDER_SET_CONTEXT_MGR already set [ 1027.322384] binder: 6534:6536 ioctl 40046207 0 returned -16 2018/04/13 16:41:30 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:30 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:30 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xfec00000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:30 executing program 2: vmsplice(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000a62000)='=', 0x1}], 0x1, 0x0) mremap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x2000, 0x0, &(0x7f0000b45000/0x2000)=nil) openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x4, 0x20000) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000040)={'icmp\x00'}, &(0x7f0000000080)=0x1e) madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) 2018/04/13 16:41:30 executing program 4: r0 = socket$inet(0x15, 0x5, 0x0) munlockall() bind$inet(r0, &(0x7f000001bff0)={0x2, 0x0, @loopback=0x7f000001}, 0x10) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00000006c0)={&(0x7f00000000c0)=@sco={0x1f, {0x1ff, 0xaa6d, 0x1, 0x1, 0xfffffffffffffffa, 0x100}}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000140)="65ba0f965f9c16bf9545602da28259a0265fa1b25950c6556292bb5c8922d47f4aebcb9a26c6e94ca40129e0705fdac2257f6f5253cd142f6ed73dfb657f631faa59a66142355c60b248f0ba14a2b5e32e35a7380be74ac55cc37a467b3b0dfd04c36a922ff8766680e7880d076bd89cb1c034cfa3a1e89b4000b67c6ac7b93e432fd06e4d8f003584cc0ab2b8d333a670ee736b4cb782d684234ff0bfade4ed766838a97881497f883c878153ed0f3c8566841b541ddbe35c0e7f8f939b85ea95cb5849e6a5d4ed0d33ab94fabe3e4bd79883ccbf98", 0xd6}, {&(0x7f0000000340)="a8396e3d6385aa16a7acb89b9d39a709de9ccecfa7ab692a6da404012f5bac022be83d66421a1daefbb750ac8d08b35087bba08f7d9e060d954a4ee65b62851a58af13bcf6b9c9ce03f864f0ec2edd618dae99da956e7730d7f30d839787b23368064c73f23356d57bf115958a8e67c5dd44219925da9b41ac7078c631809e3e7223d0d6840ea298fad60ca9adfd7f235e52a6a631bb27180fef355b4d70cb3e7f2c37ed2b261df13beb840aa129bf7c7deeab2b230e244aae9a99de397a20f1b245c4ce48921d07838bce336dae15", 0xcf}], 0x2, &(0x7f0000000480)=[{0x20, 0x1, 0x3, "81ddca68dad29d25dc8287"}, {0x100, 0x1ff, 0x6976, "ecc46a76215f159a528d545a12c9d169e50260fbfd421852978f7aac57cc7bbd5541ab3fbde3405b8c695c7946e35ab350662220fe5be65cfff7ed78a61c1b63498322941cdf3aafe0aee0a257ca870e5ab3f881252fba7fb64485e028a4e3c8c66bd44f561b21394745f01a2eed85e944d2951e2531327bf60ffbb59f2ce993c9296983b662edd9ff73095215262837142e512c62b6cdb833d129d1b656e540f043d1d6bb9defa344a3751675d010fd4de13aeeeaa9f1e7e90dc168cffa786ba849116e00b7d0f626ee8e99f04096d467d1871825d5fa0b6799917ee7b1364d9b7e9f8c6e1c350c00f60ac906"}], 0x120, 0x4040080}, 0x4000080) connect$inet(r0, &(0x7f0000000240)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xa}}, 0xfffffffffffffe54) sendmsg(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000180)}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x1ff) 2018/04/13 16:41:30 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x2, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000280)='./file0\x00', 0x0) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "498780551862f246c6488d9bc330fffec3eff2b8af6dfaa6cb5b648afd74172a462b5f075eab2833983cba1bba8c40717dd902f766f7c7672f7cd883c9f07cc47120826aabb10cb51ea3730e8203b0670254358a9c09ac86"}, 0x5c) ioctl$int_out(r0, 0x5460, &(0x7f00000001c0)) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0xd0, @mcast1={0xff, 0x1, [], 0x1}, 0x2}, 0x1c) 2018/04/13 16:41:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:30 executing program 6: perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000348f88)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x1, 0x400) r1 = getpgid(0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000002c0)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000340)=@sack_info={r2, 0x2, 0x1f}, &(0x7f0000000380)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000080)={{{@in=@multicast2, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000180)=0xe8) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={r1, r3, r4}, 0xc) [ 1027.363746] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1027.394980] binder: undelivered TRANSACTION_ERROR: 29201 [ 1027.455440] binder: 6565:6568 got transaction with invalid offsets ptr 2018/04/13 16:41:30 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:30 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00009a9000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f00000002c0)=0x0) sched_setparam(r4, &(0x7f0000000340)=0x1000) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_GET_ONE_REG(0xffffffffffffffff, 0x4010aeab, &(0x7f0000000000)={0x38, 0x6}) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f00000003c0)={0x5, &(0x7f0000000380)=[0x7e, 0x1, 0x1, 0x3, 0x8]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000001000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, &(0x7f0000000080)="440f20c03504000000440f22c0c40131d86c1dceb9d5080000b888ca867fba841b9a000f3066baf80cb87cdf858cef66bafc0ced460f213f66440f76da0f009e000000004f0f01caf3f0834de99ec4e28dbf1ce1", 0x54}], 0x1, 0x0, &(0x7f00000001c0), 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000100)={0x0, 0xbf, "e1a600fd0bf3b95295e6fd41d514fe0b67ee0f5c057e33d0c5146b770225d2955efc26f21880a562461968cebafc98aeeeab149892ebc5fb4833afc11c9e49f3ef3fc644e580cc1a202426c9e982bcb371c4b455f33f3de8dc9f12b5ad9d7a963c7382d6a7a5cfef47de34c359e7a7dbfb175887382243c17beb73194823b7326e1575b23aa244b4ec853e85d407b0feeb29956265da4cc44be4058c2e76ddeffb9323aba68626605a87b9be2cb7aba2b03933d418b7cbc4785878d2817329"}, &(0x7f0000000240)=0xc7) r6 = syz_open_dev$sg(&(0x7f0000000400)='/dev/sg#\x00', 0xfff, 0x4800) faccessat(r6, &(0x7f0000000440)='./file0\x00', 0x2a, 0x1300) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000280)={r5, 0x2, 0x0, 0x516, 0x400}, 0x14) ioctl$KIOCSOUND(r6, 0x4b2f, 0x0) socket$kcm(0x29, 0x7, 0x0) [ 1027.500175] binder: 6565:6568 transaction failed 29201/-14, size 40-8 line 2991 [ 1027.536831] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:30 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x80000, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt(r2, 0x65, 0x1, &(0x7f0000000000)="5b4cd9494e24241dce54b2670000000062e50fa42f3f6947", 0x18) close(r2) r3 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0xff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r3) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000100)={r1, r3}) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x89) dup2(r1, r3) [ 1027.573668] binder: 6565:6568 ioctl 40046207 0 returned -16 [ 1027.609717] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:30 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:30 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x40000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000600000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1027.690395] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1027.702326] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:30 executing program 0: r0 = socket(0x5, 0x80b, 0x8) fcntl$addseals(r0, 0x409, 0xb) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_GET_VRING_BASE(r1, 0xc008af12, &(0x7f0000000100)) pselect6(0x40, &(0x7f0000b9e000), &(0x7f0000f58000), &(0x7f00000ddfc0)={0xffffffffffffffe2}, &(0x7f00008e5ff0)={0x0, 0x1c9c380}, &(0x7f0000dd6ff0)={&(0x7f0000cc8ff8), 0x8}) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0xf51, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) 2018/04/13 16:41:30 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:30 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000007fffffe00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:30 executing program 2: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0xffff, 0x101000) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f0000000040)={0x104004, 0x6002, 0x868f, 0x6, 0xa3}) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x7fffffff}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000100)={r1, 0x27}, 0x8) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000140)=[0x0, 0x5]) setsockopt$sock_int(r0, 0x1, 0x3f, &(0x7f0000000180), 0x4) setsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000001c0)={r1, 0x7}, 0x8) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000200)=""/4096) io_setup(0x9, &(0x7f0000001200)=0x0) io_destroy(r2) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0xffffffffffffff00) ioctl$VHOST_SET_VRING_ENDIAN(r0, 0x4008af13, &(0x7f0000001240)={0x3, 0x1f}) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000001280)={0x80000000, 0x0, 0x9, 0x7fff, 0x0, 0x20, 0x3a6d, 0x7, 0x7, 0x10001, 0x1f}, 0xb) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000012c0)={r1, 0x84aa, 0x30}, 0xc) r3 = openat(r0, &(0x7f0000001300)='.\x00', 0x143840, 0x1) setsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000001340)=0x27, 0x4) bpf$OBJ_GET_PROG(0x7, &(0x7f00000013c0)={&(0x7f0000001380)='./file0\x00', 0x0, 0x8}, 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001400)='/dev/sequencer2\x00', 0x100, 0x0) r4 = shmget(0x2, 0x2000, 0x80, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_STAT(r4, 0xd, &(0x7f0000001440)=""/231) connect$vsock_dgram(r0, &(0x7f0000001540)={0x28, 0x0, 0x2711, @reserved=0x1}, 0x10) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000001580), &(0x7f00000015c0)=0x30) ioctl$fiemap(r3, 0xc020660b, &(0x7f0000001600)={0x7ff, 0x6, 0x2, 0x7, 0x3, [{0x6, 0x27214b21, 0x7ff, 0x0, 0x0, 0x1}, {0x9, 0xffffffffffffd801, 0x7ff, 0x0, 0x0, 0x8}, {0x8, 0x6, 0x1, 0x0, 0x0, 0xc84}]}) ioctl$DRM_IOCTL_AGP_INFO(r0, 0x80386433, &(0x7f0000001700)=""/127) recvmsg$kcm(r3, &(0x7f0000003840)={&(0x7f0000001780)=@pppol2tp={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000002800)=[{&(0x7f0000001800)=""/4096, 0x1000}], 0x1, &(0x7f0000002840)=""/4096, 0x1000, 0x9e8}, 0x40000000) mknodat(r0, &(0x7f0000003880)='./file0/file0\x00', 0x1000, 0x6c4) utimensat(r3, &(0x7f00000038c0)='./file0/file0\x00', &(0x7f0000003900)={{}, {0x77359400}}, 0x100) bind$alg(r5, &(0x7f0000003940)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes128\x00'}, 0x58) r6 = getpgid(0xffffffffffffffff) ioprio_set$pid(0x3, r6, 0x7fff) [ 1027.771377] binder: 6603:6604 got transaction with invalid offsets ptr [ 1027.806202] binder: 6603:6604 transaction failed 29201/-14, size 40-8 line 2991 [ 1027.873117] binder: BINDER_SET_CONTEXT_MGR already set [ 1027.916623] binder: 6603:6604 ioctl 40046207 0 returned -16 [ 1027.944989] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:30 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x7800, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:30 executing program 6: memfd_create(&(0x7f0000000000)='dev ', 0x1) r0 = memfd_create(&(0x7f0000002901)='dev ', 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) perf_event_open(&(0x7f0000000fc5)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 2018/04/13 16:41:30 executing program 4: getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000180), &(0x7f00000001c0)=0x4) mmap(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x7fffffff, 0x2000000208972, 0xffffffffffffffff, 0x0) madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0xb) clone(0x0, &(0x7f0000000000), &(0x7f0000000ffc), &(0x7f0000000ffc), &(0x7f0000000000)) mlock(&(0x7f0000a67000/0x2000)=nil, 0x2000) r0 = syz_open_procfs(0x0, &(0x7f0000531000)='numa_maps\x00') sendfile(r0, r0, &(0x7f00009c7000)=0x40000000, 0x400000ff) r1 = gettid() r2 = fcntl$getown(r0, 0x9) r3 = geteuid() stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = fcntl$getown(r0, 0x9) r6 = geteuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000540)={0x0, 0x0, 0x0}, &(0x7f0000000580)=0xc) execve(&(0x7f0000000880)='./file0\x00', &(0x7f0000000940)=[&(0x7f00000008c0)='cpuset\x00', &(0x7f0000000900)='\x00'], &(0x7f0000000a00)=[&(0x7f0000000980)="40ca6c6f00", &(0x7f00000009c0)='&em1*keyringppp0+vboxnet0vmnet0@.:[]wlan0\x00']) r8 = getpgid(0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0}, &(0x7f0000000600)=0xc) fstat(r0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000006c0)={0x0}, &(0x7f0000000700)=0xc) r12 = getuid() r13 = getegid() sendmsg$netlink(r0, &(0x7f0000000840)={&(0x7f0000000000)=@proc={0x10, 0x0, 0x25dfdbff, 0x20032000}, 0xc, &(0x7f0000000140)=[{&(0x7f0000000040)={0x28, 0x1c, 0x100, 0x70bd2b, 0x25dfdbff, "", [@typed={0x10, 0x79, @str='numa_maps\x00'}, @typed={0x8, 0x6c, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}]}, 0x28}, {&(0x7f0000000080)={0xa4, 0x26, 0x2, 0x70bd28, 0x25dfdbfd, "", [@generic="0b41aa826a04fe82a8f829426a176ff0e1b3ba329c004e339ca01d3496a7ed15c63f814d4718e3c8e447040677200f2b3eca4152f68a31b88dc3438f9ebda44d43a5903982db9ccec3316bc42399ad93f5ee84eb9349bded6c212f39e98adaf98b3d220eef0a7a0e1a587d88b944d806fef426cfbbbd1e69760c02994debcb2547e0fe8f3576be9eb970f8bdc631764b5cd554"]}, 0xa4}, {&(0x7f0000001000)={0x22f0, 0x2d, 0x702, 0x70bd27, 0x25dfdbfe, "", [@generic="b7cc042cb8bb77efc1eb744c47e5d460b1e7c2ba487dea093031afe20490f7dfab7c2c826be925536b8770c4a9747bf1f50c4f70e774116595ccc944be389394695238c91e1114da96e3d9344ed60af0ecb8e08d6f46dc5605fc15d0194ab6fa66a819cedc082a39d031ab40278dc801601042e348dda83196ed8fd1c8611b591fe7a8d5dbce2e7137b0a41dd295778c6b67b971a9b61cb8da4d9286fa4ad795e89a2eb30f51ab32e0938d51e2d3bab4716d796c7958", @nested={0x1100, 0x8b, [@typed={0x4, 0x4b}, @typed={0x8, 0x58, @fd=r0}, @typed={0xc, 0x1d, @u64=0xffffffff}, @generic="9e1e6381efd68492b52655e2ed9f35c867dab46aeff8e7212bd63ee955fa3845accc63d7fa3522f402c8c5dd529be55751bc7db96f80809704029756eb438566d6af73ac1444d2466712b2f29f7636024c9b022830db", @generic="b60891bb31391f0f28a16da6b8c13c67da241eddbf761fcd801e9a347dd90fea15deb316a1fee1718aef5b77872b0eff8df2db7161f3377189ff3455395af161d5a6562bf7601bb65e93674c6a564689d11e7cc9546c9835a038a0bdf34f906a1972dd9f22ae35e54b665525923bf45a00ed99b15c087bed9df7037d33968eed5172bbac091a75f9fb96581ee3d6", @generic="c30316ddf3c5eccd8e6cf450f6c084faf2f10488f8aa6c867b48478b194bbef40037cd15674b1ac1b81015e4c5097d497013d059c1650250648e637a350a301ae0b9f87052b5cd66113bdef82a48c3be85e446c8a7e8f09fa749dfb6607e263a7855f5a5b47d249de0eaf7701a272cf63fb17031937762101083b58260cf67e3dd20863f717fd5ef5cb582b0f678f433df51d7993666e0b9f56ae219513ac0d2d798fc948c0812a239d15f087e0bba7bba75465b8647a2f8f9c3dec9b54be76e25173ea008c6b18328d82585feebb0dc0ae79adb69472e187a6def94fd407d23f9004ce5ff043be260366f7049365b0219bb75ba87414b1e49382b0afb97effd9355048ab24b0be78b672080ff303314c899dee50b65fc9c71ac3f89c8822bebb4639abaa5b084ba1802439263af335923b4461ec09a2cae4f09f3e89f7a7aebc2dd8c281e26546d5a8225f65a0eb54f69d965b956a9242a3023675d2a2eb083098118ada58fa69499efbe9a3cd2a3c038ca8bd5fc529b871ed0c17c03d04e82d82d51a6f9fa52177a007b9ca48ba5a5cc331abe841e4b38c757eba4a4f940b91032ecbdf188225e7364eb62b1563c5729c3dc81fa63b7864e4e16324ee61d6c6e59eb7d5dd3e3a421299fe8584301f0ffe04878bf18ef52f0cf91e7c165c6d5fbe7a710fa37c74cb3aeeac9a4e8555bd710a14ac6708f2a3dd7be9b7f48c34dde8b1c69f1f8ca4b539e7185fc5c6d9554be4d65a568a99f4ed7d277c78801529192ed4a7d4005343d2f9f8f19339b9ec8538649ef8bfceb103e957e87bdaf20f3d4104f99ae3723b1cd3c89778ccbeda76fe7a69e1822eac67966fc0a882e795380b6587e4276b39724745d1daf29a2740d091158111522dde17bd8e6fbc7a4f805dff3211714539833b487858119bf95a887120bfc4bb7a5de7bb1a6d4a6865fc5a36d7452855d74a55015ed68b7c69d57fb94a6e227c9a8531b4be1d791b5ad1e6890fe1e00987046bf305a7bdd5d1dde8a7ff5c0e3f328d6acffb7bf26df10851fbaf794074c08727f8760b599a627d281de77daf0bcb795c83c0365bb2df4d3a42d52d912c8fc9de03da639c37dc225e6a3b193f1c40e316727d0e4cb92ac925e562b57ebd277745cd06277650b392b6d5791ab597fa12dc49dcf9657959e1539864e2a6d5c217faedeb4e2bfc9dc698e9790e5cd805cddd83720668a5f43abfa99f2aaffad52e7f9652c3e9cf7123165c2bd7bdfe85fd6ad3ce0499ade060fc7afc2dccc2d242073de871955eb583e249f8d4dc5645d8b1c5302006cdc9c22d1a5395f69a53acbd4d6bf5b24105fc47ef916987db580dc027b449eebc148b604a0234c76c0b966ee581e8598c97f38f364e39aa61f6932c2c201a8fdb68a6e84847948d75ef4a472518b5d65f3122a44a4d943cccea3f3172481a16fa9d8148f726699386421a2f879933fbde5f0d1549e910a5f611612cf2e24c3a532d7aea34476943812eeae1ac06ad2d4cb73f50a1d6e1baadba1095c1e36294d60f2e13c678e59f70c2e8cf6688624f22ea54060fff6dd55ab34e01a2e2677309e55f9d280905b30201ece62d5948efcde1d9010a0019b494d85245ec0ee2d902d89007ce203c3af1d18ff66c7707ce763318c58b73abec8dc6bba9ffa9b373a48bf698ebd4ec47177329a1594e0cded144c83c96fbe5b4a301ea0c7df5eeed57790161cfc3b8d4c15daf439202a6d4160cf51c75cb2386f54a1353ed453e52990cf5f2b157bf8ee3f531db947441a68935f11809080c4ff7d3c6f55192531e3c4b8b597b8f75fa04174f408058c38680d01d3a835548e63e1b83deed95024f56a04586153bd91a3cfa7d5432aa90121c310612d98055a8860e99badd18091b1e45093b002b27567b24e2191bcd4cfcf743273bfb3417f15afa1f6c8f9cd4251e7014a6eb3d809a65148141dc067eaf5f3c43c9c841381203f5286f532b96021a8717ce63cf7ec6dc1c1e2f5c1385338ca59f6570e8d5c43514adc9d355ec71186796a12a7e1a71bea5c1a9853dd5b0117b14e011ea31b45cd540ad136fa6b2c30bf461dbb19bd099c171706f31efae5e7a9f5d8da771b75abec87301a6ac54b477096008a397f6694741514c6eda8d182cff3ffb862405d4ccb7071bb48b0f705b530b7baefea6a3948114515754a41428936aeae517415211d776f4ca378fab0c40674cc82cb4e1d47a6950c5fe9ed75a2f8bc45ed64b00c02699844d2a7b7ac3295e6a6e0dcb87c045bec392ee684c40e95388a467f440ba66645125d4479a788c2e6264d7ae4375299705b398a2841b856e9ffbe386abd64184242840d1ccca1678013184b940eed6c4760048e2b949e7b9a5458a1c80fca1d012cea85b32bac965de667856871de4045245951f5b7c7d96a098436534fca7748becb0dfa561084ce917ad33c649bb7e066c4f64a4ac1d0e61e56630b8ec175d8f420ae286fe725d8db9d27388daa524fa09652287dd4c94e3a48025bd24e1310b0fd28f191ec5db14d7dd3b88fe6e004528935c443897ea07615391a88da10f0a3034ac1d258a533ea3b9d8aef15579899bae4d9c9028c622705f11ff052867ae9f28879bdd4ce0d383edca4042abcb1dc5f3a3a17bdb325676be05af4eb5a75126a11aa3d79a64d2feae6c0b8ffae6cd24bc6527a7b31f83ab4b05b9c744073c07f2ef42c9a1aa9a69062081292a742ec43a6d02d2eceff856da0ab7da99b3ec7f1b6727c274f7d4ccabf5417305bdad5fbb9fae69f6b499f657d350a68a6391266ab38f701358d43132a889b64e837b0a9c101be92ad08e2139a138eeb91ea9ac6e59fbbc6a80ddd0ac425cd71b7361048597982663f336637e079826a4887ad68a7d8a2e8e67030e263ecb7ede667ee0bfe3fa3dfed7c5468c3a10c9ab716ffbeb6668489a63ab9331ed631a0e0030f9ee9316bc83180ab06b04976774671025e062c496002169ca66b859406674c6892c30b49b0d4876f789b286f749b77f98d5740f047756d1451d51aa205316fea5cac54347428549ea4ff07dd306efb0f4b45761680effd7a0603cda3420a4cd2aa6da497245760970b416e0a7b2bec1593fb5202c21575e062251cb0d996d46cad767a81115fd9c3cb0ecafa7d766e3819746182a88592961949b487a3d802739d8eecf14dea354b7b7ee7ecb4a72abcbdc68ea22513c0212da7a801fb32f1ef28f2793e3660fd657fd3d4efeb72e32095fb842518c3259beba05257c2af6ce1fe5d5f9f7b53f0f46635b3b72e36a533fc06555028ae7ff628a4283cc47a1edaf60801285570c4911d3ead97a778d524bec7581990a00d1dd33e3ef3c8c6e7075487840013ae3d5f9e013ed3a816174a908454f7a661210443312a0e4f78ee012f529ac96fe7eb824e6c5ef4b2f6d572341e7eadd9a713903c2eef1d34c807b6f4240f78a3e316026c25f42029bdf33f5b242a7865318f9e74af4599c62d074c50ce1210b6e77ce1c0bc1a080a4ea83f7e58b3f4285e8fc4aa8bc7c9a9e948b9fe6cefdcb3a0c0464774e629c7179981a292ba870bf791c6ad84907a93f6936e628ef3bc7025992ec1d924529d39f9e2a59a6ea18db4adc725d3ea044bc547deda8fe2249162628b1821aabafefcc2d38c375460d50997041feed1179f66e64ff4fdc4e8fd309092903b3313cdae14e5c095c3c8d0624ecf56420b1e4fdd891d7d374abe58c40644fe4cc1a83c50734faf2d296ce783de20c28bb92bba10052349d02734e522b68ac8e43dc5c66677acb795d6246fa9a11fa1259effd5b605735b668946de5a53194085a46663a5ca66bc216e6f7bb980bd6ef1bafb8876258602676ddb4ceca1083a9c1eb9353e2695a390be5a8623fcceb6da5f1f397a3805ebd38c271c7dfd33c3b268f738a5f993ff758270ccb11bc64a1518293314ea43ef4629dfde6b8f9c071c8e0ca6800c2769b591b5d2e605fc54de8afee871a6a6591f1c7f01677878d6efce687ab9fe61533c128aaa23f97cd5cda84e93006f5f627928a24b0a54138207db85beca23a315829fe9fbbe52be3a383d2e45bf9d3dd73ad4fa29cec8cda22a32f79032fe1e19025d62827e5ff2e450a48457a83172ac0ecda5c0d87845567542e8615f4301299e204fe26519de2ff0210240e4416db4b9be2c94333abf5e4ebd4678aadac43bb4801ae7eb7726587f796d2c4aad1eee4021821db9181fbeadc563129fc1b60a565f143c6ef1e43965ab6e32233f55e73e592d4271a54b3b15cf12160fec6d236a8166cf300d3961b3cf9cbf405beeb80eee2554e3b387ec3f3642e62753456719bf8f106d0a034c4db55539aecd5cf57cc5479d4ec7c5b86ee7944c91b125ff0c1444de902b23039db97752c373fccd4319c62b6a6a40f0bbf670652d8211f21d00339adcd0029713826f7c52388632083f100e94ec13985f8bda673fa242d745dc62aed695eda18d2f7dbcd811d9aefb27eec5e50a78148e0ba280197bbea9016fa2af57dc9734278ce24f48af38feed861e8073f8a91a6203efb054ca010378818f8fe20390016a6c0c2401c858fb8573d9deee3076731a27b5bea0995c4c17ad0805fcdadbaa78d9807317c20b87328b4436f2f8bac8772a71d5a9d0f7ebbe62c9d6e3914670da15a5c91c8248d4adb160c0234a4ebf061933428aa61710277d69dfd4a02279a73abeb80cae56acd5f40c7cb175449f6b07ea935f4370ecb4d64b6a9a1d7ea0188e210f85969df88b3431c1dcc4efd56c95f21c4c57727250b3e5774631b55509e52a854f7071581cfcde9f2979d81e251f28ef8879a23bc3be11f6149141f2225d744c0de6fb62f4c5ddca274e6cdd70f5a937ba396415c086d112be61df45bcdc9ea3f079de37d1a4baad036a5e9f0fad4bac72ecc4bb9dd782dcd23232e2579049ae4d92a13bd872aa5d58b0a6ba3361fc3e2220e25b58e8f5573ee115c6179e7f5ef012466b19bd6ee17d413051ed613ae0b618eca9a8826eaa4fd127aaea796a56161784b0a9eaf7fd10a2ef952e208d4fa4e0befc54c7984c3849a3cd3874467defa8945831a99b23f8f45fcf3f0a4c5d7ac2b8ad0ce9317a6e95aea94ada390dd3b52aae46e118bd10e65894702ba430fbf3ba0879f20361ce1625a3a5095432783b0f80607607c92bcd1ef48c4bcb52d895d88b17ab0c4ca92cc526d47a58d6bce46f1f000a5c60bdda4aafd9b7a905fd32e5077638a46ef54a520997e7486dabb707a72e86b13c7cff529b3c2d42cb25026bfb38043e977e060271217e299de5f91ecdfaade617c9e6ca916d31f888519069e7173a2180f2455233e9b11ed44ffccedd8247adda61b7f5a4d1b91e99d9aebc48dabc6cc5bd157658decfb0838fee16d930c603e2a2f9eb89aed929bf20171bfd31387ada00a1a459013a448f18fcdc44702da6867caebcbdf5ed32e6174cf4ac063aaf97fdd49fd8a8bf7d6320854aeb3850202473285e25d4bcafe3decaa0e8110fb8fc4e575632a915f4c1b344c768b9d9b327ac1dd52cbcd94bded8904b37feca56dc6a4d46c62e4a03d8002f42ad802328bec1eecc302dbe0eb81a2dd123f64b75f77d3b7b623dfbc62f9c9b2b713ca8fa8032e520bf9f890494c41d2a585b14fdf76d31555b8066b2923c975a87f717a46810572428914a6eb2178834e18b0ca3faa80ad9eceee17d066e4cf35eadf50449cf5f23c22993e9d90eb4118e6453596c3c41fcb181705c0f13b8e68dec956970301bb58505297b236f53a9b4b0b3a3"]}, @nested={0x109c, 0x13, [@typed={0x14, 0x22, @ipv6=@dev={0xfe, 0x80, [], 0x1f}}, @generic="6585e5689275d35b754c22f95db70e6a741b2dd92d258c39e39f347b0c2ff26da6fb6ff69ad2499e3e12c5fb", @generic="d3080cc99f3eec8552376598a171411b305225eb704fea0ea003563b876de87de099ed4fd1ca1d86d07aa77e9ab9dc4e97b29e96547098170a67cce16d44db17050e0985ddd5cfeb8d", @generic="2257a3a5634009c9975888c6c8f4bc7cd0d39e8ace62dd29c58c26e1a64cb98b271522713304634e95d67df8a3ea212b9786a735ece86c61d4f2bab3a398e67a3954546a975164fa932268bbaa71009490165c3f15158fd66b8edc38dfc33c82117fb31f922b2ce776328dd7042fc7611c8d20a46196ca6cbcde6748741280d907bba96b2e915c8818ddda4589d9d3c9637ed8da7cda40e69c5d36478d7a0e26d1b5a692cad73ad9425085035bea662f2392e65fb970889d69e1248123c8fe33dd1760ad824de20c6a4397edbf97c67e957eb5b149d7d9a29a2d0ce0fcd2ea6e877c19efb89031eb2370a2c5454eddc803e5a5149fb7d611beb3966cd4ba4aaaac0e2dec26bd0b57dc3408790182a4df06eabf5c7f1667b6e66c84459f13d2940c1b0b9d54253f48760c53542baa24b9ba6ac3a3955cc2253c6106aab7b1a23b5868aa9d8161dfea9c4f55f8ae69c7831664c5901291d297e0b4e10845af06c5b2ba6fb754130dfd08c1e95d9f915578196b06aa3636933d3f9b5a1e2173e2dee9516facb10590727795cb552af119ef26fb19566133da2be73ba003d972b2e17e740d3c2dd6467c28990eb8b8ea8921deb743922833476af4f8d68b2dd70dd682cd4697125c469d7344243f79ab3f50f5310ad089171f6db3c51b52eb39fe7678edb3e216cebc41340f01685548f5e3cc3f8a8363d4bd0b1949fcdba9e58259d532d712bb9a27ccac91fc35abe77f460d275701f53387ab95c9b95ab0671a46504705efafa402d705d17b2548f64f5a01f599ec3742741012939223cfd328bf7396b95a5533f21696d47911128392107f3480b0ac8ae7bcbf6c3ae3dada2beadab90a28d01c5b69ef687aa9fc012cd69950453e1a323cd28a2ea290a9581c7d8e3cdd3aae9a852813bc93fd08439e796591865b951e67656531486fee116c52437a65b0a8c52d6e4d50f74b75d90643f8dab42251bdadb20a04d1ed7bf46c9ba191d6d5bd551bbe9d82cfdabaf4392a63a371a72eddc8037cda8d9852fa85470b9e9c3962e5a0374b8d0ba42bbe0261f450c72fbc57b4599e6b578ee2636ec69972d2545a9eadff5c9e4c58c61014a5ebbb929083443890aed1131ffda91a5d5d6dd5d94ed73ff1ee2db679f177e5b0c406f84ec688479c0512b177f73264d7d71be5517c682e9881b459d872ac9c2ca418ab58112b45b1c92c414dcb5d2e3f1ead21a76eb8e1c3f1c8e53c657fb931d49916893f38d242d674ae19bdce9639f2a4ed9a63597ab3dfdd83ce3acd12d7e851df729671bfc18a1a674aafab7ef7e2102f07bd750804b4ba29f7d8b69482b7080b78427a5c0d222e583cfa7b9eb8fe679108365ebbb673f462717fd16d8507a83c0d0c50925a59f8a0f14d9cd3237bd25023adbf5040994730b78a6beaab4225f4fd6c3c118773eb91e417dea080d6018cf50603d3ddf2ad230f786c854c7edc05fb88a208a1f8322a7a30d3e697723152a5eccae1abd4d3118dcb3dfa0f8e683d5ef16e45f3b70a80a2b2f0ee5d9d77e90f1c83c97cac067a06bfec163116619e4825397447e17d9002bdf406715f7b2b66f338f8f142c561ec344ba33b6776ae16daf563778caa2296a380c50a79da89c52e4110d713519af7100c29972e8b9024ddd76a8d47710152a1638d856da1ab34a689875696032b79ce42bcfe2b62c1db91a432c870ef9d04d104a06e3cc131dc949ee44c769dd8543e2652380943a6ab3b723145e416840bc99b4ffbc2e5e2eba79178a517edf6a934ec1639b4022ee6411424b571e2b61ec8f7bd2d26a8d69cc299ab5ed86b3707be1d21995a8a24deb3b3b6dee1c49b9f03e40826dd55b2c250a460a624c70ce56f69fe493be4d98083b5ce5d85616b6387508405ae2aa19f4391a69181c2afac61b451e2ae65a7a666d1dd67e804945d6a2db3b0a3e9b6f9e6d239d0e62ed65713d29af12cf20cafab2bc8a7c356e55f964fa800a93c50fdee1ae652a54323140d883089107228504d75de15eac5c8912974e400b313dc0c8d0b70eb42a04973ff3d8f319e19fabd60eb3a5182d851f7d6fc81dbab4d092f9373682390562b03838a367408524a711466e0bbc125b79623d45f44dcf7dd0904b526102368e4bfd9db72384ca158795c675302bf7e38a555b3e3f849e309eb5b4a18d8709bd98fd45d797436312018171fa7ce8d30a831835dd61f01ec935a3d6e6929d344361a71716a10ce1962be13e3ffba9ec5b95a82428c7a1c8b08863fd3f667a5b619f6cf71fcc72aa3280edc55191a7c12a6c68a013527e43b5bada93aaed0140b130dcaf079318da8e43f9cef74310210a8062bf9690d227f97f97a8cd79d7ad4e3b09c905e3669e69a416b340d9d5c25e5d504fbe6ce01fa8145d416f28b1b64cb887e40a6fa62525c024502525169d3a3076805aeeeadca80edf559dc7c17e4c585427938e8525a63e424f6ebf5cdb3ecce834894b04e921778b3243ef40c5b1cc7a34d6c8ecf6c1cbae16f426d8224ba86226661e0d9f8d6fe02e4bde906ebf707e712b10f5a0abf9b908d1289c70d9faa9475ccb635680db4b6fb6b1e6c6685e658d595df62a797cecd6fb44e40584fffb6c06c2cf5b1040a4f8c8916a7946fee47987b417c4b71499b6389674a5cd4e2ed8c9f22700140eba888b4f185b41a65e3ab9b90b208190e6160199095afab17f2d21757863f6b35e3fc9698f90ff617702942a4f2fcff1baf48e95dffe6376a0120960d610b86ded312c58f600bd1478a56de9533a8a0e817b17eda8fb0c136b532f14ae4194b43d47ed3397f3f2ab6d903f6dbe0b97a2b19be00a0d2fc435bd5eb7ae124a25752fe0b499038f1c8fa57b4d2a52277e265ed923928b9d5ec453c874d1fa2ac79aac6515a840ecc98bac4b19700f9d3b536e93c3540c257e2ce0368ee5d5c643a530ef8b0a3dff2112235cbe9d50880da221b97b62c4323fca8bbb81a71d740b19c84f37fd7b7251729db29f8b9ce4d2b6172a28f4994e03ac5a12a91c5248536cc93b33cf90223eca93f6701d6549019570a4f5741222de59dc2baca9c7c4663577dca89ecd4cbca1c885de2e571e9fe7e18e3b7345db26a785afda35f30fa823feea5b08e1318dc06dcfde8c1b089196333ec2c42a207d15b49c07ec3d08e564a23c68292e6a3bd8c262f637ef2c959e73349b0d649274655af4210195a78b3f5b7f05b7a74b6addfec3421e4c8bfe4c3870ca9a5b51ec7cdf63e82d39fa4bdb77ce01d558c855e6b86e281b071ffaebeac19a2c457b2d300bf73a045cb7ac0ab90c6b94d2587dd25483b5140b8c0495e4af9ed7e56ccc1946bc97b386720f88d46598cc3875feb9ff62747eadef3fb920bc66102fc71ab3a8f3d0ad2b1a44b2e45308c95348ce721d75339ebd0e320c75aa63c0307a2ce801e0b1e373e6245d053766ec3a8a7143e7357992d44131531c63119ca4424ca80ddf58ad79776f44d0aa1f95fc9cca0b110d63e1faaa1431da3770dfaebe8fbca937c1f58c2f075c1ece7deb2f6bc6cb507e45030cbea9db7aa3c57174291bab05e3d87eabd5efe3de4c9e2a9e63f3fb77ef2e703155a93623da14e5b60ac21ae00834183ef4f9db8d54c9b09b087655223d4d3b67c408cd569fabaac054ebc139e772c66cabd42833d805221048168ad04b64e80fe45a5d96a90668c4968e2b210c31c76e30f13476a938a26701ec619493e6e9db04a86e61f8081469974a527264447e996579dc1e3664b6fce942b6feb273d03a567db356a7b704eed175beb8ac6b196500a362fbf0a491cf618c4034c08e126b7188461680aa2b1e6a450cff78dc9716df5b099254608d0ef5c4da6a9d6ae5825c3d766f09aea8e3f049142dca19b62a5e16ed7d1df700f1ed7913a32955274e9dc488011432900e0dc592e6fd181cc772f421a8234282ce30cae430d4023f8d4bcdd16209cfd405b50b899b4225117fd98998208ee3062743db2fdabe844f10d08b2d1a4028f3d1082e3ae12a197a445d28aaf9ceb8da050c3dae24301f61f2f23a575cced569b494ad718ef15d0a9f9b23a5ccac60bda43f648cfe632a7e435c8d39a541338404537ecbd58cb110e426e0102c63dd50ecbf7e02b0aa8f4b9e8451549da862aa321a195ebe28c6c097d66136bfc24c896d6ca3da326dc07695699698029ad899fe8b8ac30cdc7414847b0a6cabaf4ce2a10d14446f73e77a7646987bb60864805429b96dde3b3a860fd70f11d967d2f1f1b27266995168d6c46c5a8c97d0de277b2ed57af4650cd90d62eac9bf68006d1a7f41bcc8609ffc6e08c60084c9cfe6d51ad8d8c389718bb6ec809e8b81afbc70dfc02c86ff242fbb941b63cf915e91b4a6f074679cb4007e282ca9fb983b485fa7c38ea9362d2638fe28934ecf403d0320a733920caecb37e2d608a3eaf973cdb8802560bd718e6038c1578fe19216b8664a5485228b59633d380a8e6f01ce9c7ab890f922c818d4ece446afc80eada5d870b7ea3370fbf772bc853ca2ca82e258a4e99a1310c6b4f23407dfc62b112ffb97d4d674352ea7969e1d413b3d4f9beafd2f56e3c65f193cd96c64a3c3a679eb6f96b8a3f280efe012b6b22acf516996e0a820521b74ec7d9a65b9807cc1c367712b12f46acde777df567d4c72ad99077f1a3b7277785a95a8f15a69931ed76f8c412594f7a6dbb9026854e546ceeca9e543662e7f03d7e462efa82a3a83bcb9f3edf6a0b55e7dc2819871b6a2508f2dbaa3adccc3f29e32a02dce3e383946253aba8bc152f4a93d1fd0b691420e6dce04e807a43c3c06f5b4481263ceff28d9321b6785dee167e9d0e1d672e7b95a9396150319719c29fe6a525ab752d2d6baa5a9cb129d0c660d87ee0568a213a9d386a4f8099563ee21ca0954120c8f179fca33eaf71da051e8a7f0b43073df4094788647f0e2888b34c0435e74cf31a31aa6c2ac1804aa76095cf5c031f4a065f7fe203147ff81153144b06f24c4f17b82e59ed0e722a35b5da45a280609da2e7731a398d37b00378e1fe1e155d6712913ca7be6bf870be354f254a0974c342bfbb3ebc51d1f7dfd6434c870c965aaf89607c37ea0b47edae6f63c478b1c2c462f208d4f5f8779bad85f19695fee2d7f54a8bf08aa95c165890c6f85ce9b52b897d2031b1bbdb10d6f4da49a767827294696c861792fe32897943fd9b2204fcef905c90a8ba58a75735d908325149c605b080db1c729efc4569865ea85ffb27aaa494edfe848d60a9e90d6ad5595a534511718a1a6c4dd46c43a7df44d85da47a7b52ae15c757de9233027e246473c458ae90db8c35a45c5c33f5ea250435bac5babafe56430e9976a4ffccddedfaa88e6bfd853a233e703c1b6815339a7a74a207c8fb1e1bdd7958f557410532739c5b65c1827de022296d59b512d1ea5726c2633216fbd0ea038ccb16708644db62f8b827c9fb79dff5e001af6e3302adf31d93e38159a15a0fc654cbfbcb45cef83b75a3381ba2d7ef19a2ecc55ebfd7724ee7ee4318012f0670e8a56c918dd72b234e907a812c2896a1fd79289e14554c11e8a0cf6d07d07c78b774c5a0445dd09b2e6fc79cfda235cf70bcf57258593ca1afea5da75c9c8126474569412bf45d7b554c50022ece2131a6f5767ff63f37349391ebcddd2dbd30b1c4cd1c33cbeb389c31ca0b04ddd67ba1506aaca0fa1cfebaffc172a6f844430159a0605332a1651f566b28270a6e71f5855656ff2898e0f8ba7d1f9161208dddb1a936fb8cf4704546776cf921fc", @typed={0x8, 0x6a, @pid=r1}, @typed={0x4, 0x24}]}, @generic="f49745784b985b281990d14a3be1dabc3b48f48a320a2b07a1bb821966227781f1f383d70fe90bf74c5c68e7b66c56af3070cba64fd017c00222c5d269aff6a5593c88c064569632afe055d096e7610ae14b780bfedaed8485bff8c4dfad8d208adbb5f57eecdc7ced776208c0c2a40265c013994fbac10751f455304f872c9f75070472f412ed40a253f6577edb"]}, 0x22f0}, {&(0x7f0000000200)={0x26c, 0x30, 0x300, 0x70bd25, 0x25dfdbfe, "", [@generic="8564ac350b55a983bbf666ffcd7f961b3411a23dadc96002005c7bdc45f90d55f0b687b3587f605aafb0536da95282d4ea6c66ce6434bdf58194a0066fc3f35c3fc4d7b32f065626ffbc07802a74bf57763502c4096c5cb5a2947fc9438b2de437a6deeff0982806078a79d8a6df60f65e8665c74e72413a3c36f7bb6deb72a00cd1fd2f05414dfc7ed005431c2ed82c1092f513a9862992ec7aeb94cde20da02a268c4c306c06b9f3bcb7c94f0e2b065a2b6eec00895cb8876debe173900f792c35c4bbd3b7d74732455b443565dc1e079703b2f2a7866511", @typed={0xc, 0x93, @u64}, @generic="302a227acd6b16082a3474dfa28e348db2344e79bb417187b14e49886eac384ea44df1cae9eb5bc9d7279a7ca5c84a1cdc153308aeb8dc3d77d093c985f332a22df5baf731914a1084bed7b9594df5df51eee887003b3e50b21829967f2801d9294c80d8a2a08eff601c9b5254807103c6f9d8063a293532fe6f7945c6620dbd09d436e5e99af7560c421550e475ee7e052f235ad1605d7f88c0a7f2a5ff1b7836c82a6801b462df9a2dcd010807dd963fa54ce827e66f68d279676c8538248857f102bcc35bd6a4e6a37225a85885968a3e", @generic="0b4973fbe55d7818072b183ba1d30d59f48203fd0345aec7ca0334b019fcc89ae4954ce9ade6d3c9b3aaa92be3357775dccfac40379a607910673a2800c10adcd84c618036324ecd2714f4857613fc06dbcc4c3ca6cc3564ea99afb1ad0db36feb511cdc7077553dad1a3f710c64ba354e2de442e9c4a5b6c696859885749592b89056eec263ecc549ebd4e1b9c289291ae4bc1cc2cf600a2d89f1fa5807fc6dcf7a1364"]}, 0x26c}], 0x4, &(0x7f0000000740)=[@cred={0x20, 0x1, 0x2, r2, r3, r4}, @rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r5, r6, r7}, @cred={0x20, 0x1, 0x2, r8, r9, r10}, @cred={0x20, 0x1, 0x2, r11, r12, r13}], 0xd8}, 0x8000) 2018/04/13 16:41:30 executing program 2: mincore(&(0x7f0000ffb000/0x4000)=nil, 0x4000, &(0x7f00000000c0)=""/56) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000240)="56b2602dff01470000005e0a85b47bd50000000000000000000000000000", 0xfffffffffffffe74) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='io\x00') getsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000040), &(0x7f0000000180)=0x4) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000140)={&(0x7f0000000000)='./file0\x00', r1}, 0x10) 2018/04/13 16:41:30 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000500000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:30 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000000020c4900", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:30 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r0 = getpgrp(0xffffffffffffffff) capget(&(0x7f0000000040)={0x19980330, r0}, &(0x7f0000000080)={0x7f, 0x401, 0x3, 0x7ff, 0x9, 0x8001}) [ 1027.975661] binder: undelivered TRANSACTION_ERROR: 29201 [ 1027.984818] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1028.038273] binder: 6627:6630 got transaction with invalid offsets ptr [ 1028.082228] binder: 6627:6630 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:30 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00006ee000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000080)={0x81, 0x0, [0x2]}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x6, 0x4001) sendmsg$netrom(r2, &(0x7f0000000400)={&(0x7f0000000100)=@full={{0x3, {"b6e464868f448b"}, 0xc2}, [{"0c6820afde2d7e"}, {"548f82d9affab7"}, {"8eeaee4289dc22"}, {"5f81147119124a"}, {"a0f3fa1956e334"}, {"7586ed3656a816"}, {"6219bf468a6354"}, {"5b5d50aee34668"}]}, 0x48, &(0x7f0000000040)=[{&(0x7f0000000180)="9d5aa2202e2c9128d9cb84f7700cc972f96fb97c6efd63a8008dfb890725b883b3ad3c32fb0c240f4ebf38d05a4a63ec754a267aa050f3d5e71a0ed4a28f133efa1dcda36439e3f705a95d1f259472f3409beab4d2823d8e2698f2dd25db6f403effdb1739078c5c112446a1389a3d8e34a27e488a1e46ee9367f207e68cc77b209ba8cc107f23c0e21f3158536d0bbe0cc1e0bad028eaeaa0ae04bf482d2b", 0x9f}, {&(0x7f0000000240)="c84949758d4d8d5b96c02e0bd535e5d5f2ae3cf8383ed726cf0ad01f33f5b6b48e764c5b012aa8e1b0b40ac89f37c4ff92a9c717d79b6d48857eacd2a9b454a6c800bcb2309f56f947bc57814e14d728dee906ac9bfa94d9e5ad2e5e061c72b25fa0f7c106572f5ab2fd529026df9bb8630c640b1012a97e4a56cc10e2480cfe54adc253cb71ce5f9d00c787bd1eb5ac745ad15efbf3731dca8ff16aec65c08f11c5ecb44db726cdc7dfca7f9d3a66a7125d1d229e38", 0xb6}, {&(0x7f0000000300)="e8466c864a029314464208dd24ada13877e19d740eeac4dd8de9b5d8700942260a8c544f99a01daa10baeb5bb906fbea9258a8b0a63b52736657fc8351b707020bb3", 0x42}, {&(0x7f0000000380)="d9228794bc99005518269ba78a50a46b7694dcf84acf04cc7a5609ea845362b06e657a1eef5c3646508ecd5c05ae355844bbbad156cb9a62b6eb01cb1720de99a2d950fc40a54875b6cdd51ae07533996c3cf381da1677795a591cc4bc4bb85d9304", 0x62}], 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="10100000000000008401000009000000b89acf28dad20e7e25405ec8c2ae417f2c3f20975907789b4ff9529c85a05fca8070645c7d1766f701f84a11c159b657aabc5b172121fa4708b4a30a33759bf10b2a32ef24e354636f0fab07d5b00e4786713dd8c04a338c4ab3c711bac6dfb6794fbcfc03cdc3b00540ccae2f3401e8c22c919e721abfe4c2fc7f57025fdae79eb2851567d08a5a3c4f8fee15f966fa38c3e53570410abc366749bdb1602ad924d5cc62227e706b8292a64c349a687580dab6d3dbd462080c59d7682e30268cfcedfc991c9c38e7558d3f21344e0d94c120c0db567922db1a8577cd20fd6f744ba560e611ddfb757160a06d831fa0be61c431f3bbcb248c05c6e7b5b385ea568e9379daebeaeb6766d02ddb3ca7111166ad5083b7511f6a8050e83f7976b8091e63031f2902ce8f73ea679b21044d317435c40a257ed41828a04e44597db137a5bf9383f60a28a7e303497cefe0a3f9f7279ce44fc5db166ac73f05bad2029e6d650cf63bcdae3f9d5d5c455b1193f099c25cba51b090167b770f2c4b30fb88a6e1e23d12ccec1edfb5709d22915045d3047314272dbd3ea8f3765cb6f5c3e69772298d48ce5f2d5b6e568ba5f7ccb1232769e1a965874e8f3034dfc41537dd846b9f9460c4893a79159cfd72bb8575269c0ba7a9d78894a15c882ab48cf6bd3bfd723442ad76a62dd18d79d8d48dd24d6e2cf4a3abdd508e98fb48f8d4c40b34f6a12a3d8acff0075cd0d23907e79bc4f30d97c9482132b8f59e89e0ebdd6956216822da83ec81206b51b4579a5552abf8b40060cf4b444540bf827c9737e69eb02845e43bf54d7381bd1300a4350fcba9b8d0336438bafe9770e5bce2135c93c75077b75d440156c89001b3fb512edd8dfc66fdb368fe39f0fae2e5badb1360fd1fdad2b8a8910fc688d0860287a64401f9035f0d14f4d383bfa312bd835c6f06f398f87c902c4e53fb4b0dc43c4957d54aead77c5aaae0227f105285ae4501e0246cae6c168d8e5cde6413c5fefa09150911ae20a94c37f96d9e5d4ca32328acb273773431c4e3304b9e231b872e812033e3754c6aad0d768f3eda03adb2a81ad14f73131760e334e530e3604a44e6ebc97cfea093db49dec4ff035f94e388c18c2934022f77c0f716d2d8ee7f9f8916fcbe9cfc5e0607983972b1c70ea1f70cdec6dd5b45bda4e6ae43a21d5699abcfa3e41008c8fa145b377099ebfac3a24583a3bb1fcb9f8b2b73ad8ccdf4790ae44b08c9d6c7c4513f0809786b057092e0ad2669cb43dbe8a08b1be633eb504824084458a7d1d0325e0ae14e373a2c66d885ef0e87b5f7f81c00af83b5b67a830cea425dd492faf48d58b51d0f62aaaf63cb86b786bbf8073d67db22e57548085d9a761d3e8392049d8829940f4da5dbec521bdd9a3f8901a7969030ae9177279bc1daa03472d9b8598c0193e7011ea1abad7bb1d47ac51b63023436a7b4d1da11fc7ab4fa61a6911713a9461a3dceaf857f2a4187da0cf1e5dc36ba88d5ba8094683600bc96d1d34821cb5fceacba9cfc4a3f6c13a28cd7941212473e995c0f23018171bbacd355a02fa61866298a8f4cf9e16fe0f9d057e42d71778086bfb7afdc4debdc51839429b5539869374a9a7206258bb558e830a3f35fa3cdbdb06947e10ef6b410891ca72308b31e198a00716aed804ef44452ef720b86834706d51ea8b8544742b38f6802bd9196114a41d483a2a0a1d5e8c3858f0bb06f3e3f38accac83a2084f4e8011f4d95fef8d64527386d2ec6d092588c6e0e2c1cb692a6d5efb129f28f120cc14aa84db30a017d1b33ba563161c02db4a599c5cf3058f4ec9585f80c7e5ae89b7454bae5edb5b1ff7eabe6ca87f0036f7c276f451447e4b8972e4bebd411055f843a835eacfd673207e06a32817a011fe645e6e6fd2ddbcfdfbf8cd6c0af0267d3ec16f5f14177e0737495881c8f083ad1120762aa0f7558c9f88102bc43ae1be330d10b640f8044d910501b53117babfc8e421708c1609731a322eabb5f806a15a526b26eb5bd470dbe693c71b56fcaebc52509b7c45aa4557bf64849089f89600bf68047ea4b59c163d71fe6cedf02168f8b86101b2e8ddc4d7867652627cc8e0777b5e0d020e5d333947efc6c95741d0580814e41fa4e6b9115ff9602f1636ebc4666481c6a2cc4fe39dee9872f0d70ce5e042e8e0d675e908ee82c564e8569c2a9287ae0bcbf734d0bb30486984f779639302df5134c759cea695c8b8e8b991136bdeaf03437d475c98a74d5b89befb4e814d5d399280ca814dd0c3ad48e207a2ce7059fd8894b9194069cdc13049b0993cac6cb53735a286ff72fada71ce4172d45315a95f5830a805b0eae298b519eb8a6c6e4a3e97adacde7ec275a9d765b5deed2a5beaad69eb7c47693f3927c5de3c00f7ed9bec97f7a160fc7569f70032b4e9446115385c45cef18a0edccfad78b7d3ffe9a27a7ad4029a37af89556aef9c2d0aa8e35b26802d15096c91b2b32d53566491702f3c9e8a5071814b87cd123990c4eb2653bebdf0943e9f2636ef4408d6d1e3a12e519457c9179f032ca0265704e7062900aff3263d1efdbdd911a32e767b28c8688ae6d8fa7ed88b79c0c943206731c4cb9a462bafcb518fd99c52ded4f90c524e9fe67589d819603443c68f31652efcde263d9769e39ee7928e64a5d40f98b6e0e439d13608478875856ef808077cbd11e41f2f6e8321c2443535c428d16122c24cef6546d140dadc5d4fc64a42d17abc9e50d4f61ed4641e25c425a1bad759d6a6275777479fac77f9252d502865e4c325f0796a6180227b27766d65e0a9fda4c06c71932c7bbd1fccbe3f08dc0427338f7c9933b1e25f42398c602843142c0d8d453be30d100dfc052e444ea239125c15d055a5a77e2007da2dadb5e66f207e131342912e272526f65758778b878fc76bc382b4b717b06c15688758c7cfd3fdd8366978af9bc69e509d012b888985fba1c2c69fc3d61a5bd1d8ee27400c187ddcea3f9bdee1887b9df2c7609babc8a2222dc50e0cd8e07d1a240968123ba4e5e714c05ccecbe573cd10ec43dfcb9febb19f7a199f9d4ef1d92861c7694c4406d08ab4f8276beb6357a104632c14de7a1ed586a2926affc62aee9d2383e562453dec21989367c66bb0e4347f9f436c12fff691154877d96d1135d19a155fab874a15637444d34e63fdfbd9830f30023e5cc62d6c75c530d70b572a9d531a9bd4e06deb5bb95bc9b50808698a742db195e8f99c95224637d3ca413f3c2c4e25aa43b741521b1165303a9f16f2170ba78cc3d204cc900af6d2afbe2b48612e01fa9b6e6dca64306d1b4bb1859201bb1afa8e054b72e5314e89cbb3e375bd08a8b29a2c1338211f5de76e1b79a312666fc73bdd8e7e2af52867bf96d999443cda2a3689f6ec9d0ff580936138f06e3b4c44d90d41df5a7ca50726eb97676c98341ad28a99f8f22b071fcb2c58c9092e17de4d0c3a7049b73587b626760d7f8e536e50845f6ebc029f439caa1ff24270b38872c55605277b0a44d056c834185624504cc12ca96cc0fd6ecc094de916c2719f967983f6a617178399c214aae432024f1db20d0ead50918e16d1917d7ecdc73a25b5540a301d69ef892dba2461ce0467cd3070d424cebe3108f79167a211015baacd21a2d23d9c8cb697f4f7ac14a067e9356531484d1ab390deb6f75c9861816724a21fbcc382a6a7bbd9d8a62db8a84fb9f84882f33d53b8100295becf54be92efc1caa6511738151bc1601242e472ea7e6ebca5502c1ebf181e5510d3f435fdc93eadf45d6c1ae92ac9f0b04239247b4285f16b211b059428172fe0e293e5dd992a5dcf0c76e8e8b94398d511abf4c88c980961d222d38a8d9711a94830759c25925c379c7fb967a612222de766aa9d332224d11cfed755bc9a980fa841d5efc6eacc36abb2d6872dd0a7355ad9522a4b71bb62817a7f34ae2540bfb2bc1114a454af699d26cc6cb3f52552d102f526475de771f6892ad3cdad5967dde0f45e5e55b95c0e3bcf66da81b6b75d985b711e31668610a18a78801b0427ae430d2e1691eaf67914260abb7c0a11f86d41ff52805b7b76888aaf01464df667b391a1dc5f1a8ecac70794e75c3ed3d4799875e441ecdc1b8141c72c1dd86bb9cfb854ef4b0eb79c22cbdcea608f7322ce9fa45b93a2de6178a7cc7ebccbabdb3cb729b6b57b22b9aad6b9879dc42899a52e01f0c14b6d1cf3e4f4526c55ff34e8e7c256fab30e8a39e27a5416eb5e736276ff83123f5c2d2d131aa096806d6a3c3fb7ef128c91761415c2fd14073043b3146079bfdce74dcb7df2dff6d9d54d39165e54cbcb72a81930a5baaba4cf03211ca5740310b1f8d0b3668ca637a6165985ca8c5c75527c4b59719bf1b5bf8c2e3db57af7b28a496cf7d8a4c3a87938ed3ec4f504e78dada44b4c9d2b0f3639fd60cf3b153f3b98073af7ac38ead7d9329307435cb078e55601b86935b81bfacf70d212a083e94cfbdfff364efe4fe52014659787142a78a847e9cc13b9fd1c11a8fdca20834bd25fc39a83e1bd17e4b435b4467b406661081063964752f964738c61120f486e600d52f6cc1d4c938d48481dd3bb779c84451900b5c27ea8e3b7c3563113a0132aa8f90a98b937bf52b950403e31169cc848164de49156c2a68ea7723dd07dadbc7bb84dda1d04e9d42990ad8ad77ee96e26a4373668cbfb813201a2e66e3d9da57b93be3ccc54fd0f88bd3247d03aad31a2486978aed42f0cb0f6c8eca12d92415391161c34016df1621df490472e6e3d1fe425a95bf8f3428b178a36b06778f81cd8e971ddeac1f24b120523da7edc525473eeecc18bbbeace58da552aceb6f20039cf55c29d85fcff1ddf27dc0c82151c62ba80ed064bd8309122970e0d34cc0320c804c04b6840193fcf8fa5270c6ff86a8f169df3a58526a3884491e6c6eeebb721a9e44dbabd061558c03c9e033567923a42faf1210d25be2c6fb097832dd61c352e9e2e28689c0cb2a13fcb3c35f675d36b183c5a8de25dbbd3d11f78057004850ab04d220f5db86e37a903374893353febae359e8ef23b817ed6449bed532b06939c6800e4690458ada97cb7d797e5f7d5181ad85f86784054773c67da44cce8fff91c4e5b3c78e5db7932a3b667168e2a1364452115c297a47d3e7c29bb02c41c8321462c68d96c55f2330f8228b2839526acede30ef08618348c77bd15caf0952477a2156088e526da8d4af25b81c5c11b7229b42ab498c6ea5655ef1ce5177e29563f39170596378e8baad9074fbdf304067555a0e87ad4cee0bf03aaf006b7f175ccd8183de6d5050adc2ce0a410675200488a3dd838094415db0f0566d889313ae641118b55a373db003b65bfd858e88b3a3a1189d6e3248bad8c099109c51830110eb3a694272437707025d3aadc5da9a1a58bceda7d70177334ab8a015d3831c2d6d7100f4cf672c8e0f663d0c902354bc8b7bf456c4dbca760c0927ea10cc76d81bfc6b6816b03f4bfe092b18a56cbb2dd02aea6c65926ff2f6ea4f0ab2f0d387eb1c35d6f23569c92dde2492ce88ea2882e0bcfda839fd88b15e6ef4fea13ac66a041386652e1be2a057f33af795374531c397586546cde9e9361adf9c289738bd22f44eff5489365d3428e63771ca8ba40914c569ef783b7a1e0c18bedc5f8c077a60c4553ab43138799dcd833bd509b30f28311a3bc0cdc56a009e2f4e80d37980d000405d62ae771bff7b58f8d1316e2442263b0b897035c3dc498a450cb5900000000000000029000000ffff00008bdc547a24beb361deb166c27578d9f2a1866b7cad48f070b735cdad6d5ccfc4e593ee894f37fcfd479909efd2b826ee72aade7c56a50753779f29dd6a3fd96ed67455fef6b9a8790d31964b4759d61d788cb009570d65fc9807f8264ae809ed0cd9c3aaa433223b3cf33ffbdd485e594f9630b8c86a979573b676000000000020000000000000009f010000090000005af92cabc02e6fe7f300000000000000101000000000000017010000ffffffff5219bc16e17aa994e69c3c21e61725e78976f1194bd490193bcf74e89ae79bc7a3585e828cbb8f7c0fdce30d1cb6858de782f014fd5c2c12416295daeeebe686e2c7115651eac27ec30d3ea6a5bc547cc893e111bcec63a2c788ba0ff5b91ae530a30c89f29b66c4be4a5e86cb9449695fd30991d8595dd759920e040ea07f70047beef9f62a2948002edd32ce6825241af6f0e3724aa5063fa96f39ae4a5065ed5847afa2154bf71ac4d8500e505fc2ee07905c6fe6608f67392becf11533f486f51fb1b892e56df6ffe56774cc51b1c65fbb8c09394635aa98028a67ca02a539ead882ad0b21acad1f2f735feac37f2efbec8cec84422e99571f0b3977aac95a888c6086e94c15f72c85e25b81791eaa5cccace96965c5cabd8f718ab044040c1c447903735670d53977ade52299f935975700bd5325938f96411129fe57dc81217a854c438defaa9ac7dca7d8d41ca1c16439ee89a7e573110c932fdc1988a5aeca53db47916db68df1aa87313439f24861e9e97fa2e124839f993afdccc2072c574566e10c6d008bac4ac4dc66ea70a3aa3c79caa4aa18016e3a957ddf4123954fe9b4a4b8ca4965e47ac31f7f134137e28cbb584de809b2857c5fc9aec84c68821c38c361844e1b9a0a9d57d7a96c5fe7c137230f92b6e76f9c9c4179bf0d9523a11ff8c3956ca6954a2371bad55e60d94a2c8c887852b573a61388c72dbf0869c200418239e842d12d3cd0c3f12330a504ec37f3a3235d291ee954a7c306b34ad886ad1309f9ecf8cb65caac214c6b75930f342c1fdb6cceeb635c29aad5f50d0327ef82149cea8f6dbdea2dc6c375ec360036504d0ff986575fdb3327365dd845b4971e8e81af32f3aa55c4a3fe97c716276b60cc3c2a758c9222f8d79151cbeea578fbb2be0890bc50bf8ab345f74155a192f34ecf96659a35aa6248b182f9fc273c4967b757a714f6e9faa7d404a60bd5174680520374da33dd05b0b74ec1d527221c0b3367385110a9320d9b56fa5b75969bbb165c1fa8ab1dc8dc245a58deeb616b0fc194193d05c26693b5fe7896ebc4fe023fdce0449574d7a72ea50f7b607883a23d2b0581f7734ab6345065d9a960d1ea72142ec24270c449e642e15d97d1a5eaa208c49dea3b056e22c23f5412cce2bea2fc776096676fe60b24ee239e31e1da3e0be02dd526dc58a6c281fa88691e1c6cbcf5c9e567b4874f4fd573204c4c487995dbe2d9d8f9dd83020ac1af195de84c1121bda4ee59d1bf4310cb897edc3606b3d75bae2b1c2e6ee9518842cb0b8a48001ab9bba79c0bd5c07d8d992f819ee897720d720ac7030a15bbe886cf21bd79c4ead7f110719f569f5881526684fd0d43adfb0c6817f7f81838aa54c904418ed301734edd6b393af39b603c82049b46c2a7e3851108387fcf97d2a88f0b84112fceafbae403892904e72d3ba48f48672457a463158718de1032cbd4ae608d54c2a7644ba53b971fb76c9d9d0be51f050d1ecc1a191930a8ce031881a6645bd112a561df63fa130346635e4cd5614f6537469ad2503dcd46e46f1aaf26aa338fb2b1f3b69d549b601085823c0aa2075f3de93299a858d7b7f454c1aa13f06fa6a2b4c536819b0090cddb906fc22356d545dd8687510fa63c34d62000b69eb8a3d49e3bb7d7d6f2237cec7878c4dfa875d86ed7a3e86e6080c2f67ec4ea7d91976fefd2e8a531fd61e25b7080a55da36dabb8942cb5b370361eb580edb333c12882cf3f1e043fa849c406dd224f7bc3491f905133d891b1317c483df330d1d431ac5ddd8ee75ababa79cbbe0ef2f6c3dbb844c598b48cd88ecf10bc458224e14bdbfe8b8268c53e679fe659eef1b994f48d13b80d7db3d7ee1912e23438c6fb7c24b6cae9e2f63d8b01acee79edb625efeb50aa2345f7b0117cdd4f234bd7a12b467cdc0fa9f86b735560d09333c9e75e9434a966015389ebc5e92fe30ef5151b8d002ba25ef13f199952eb9350fe93786a409e003cefbec3cf21ed5c5181c5534ca673eef7371bcb2a587551e190ddc38302736193307db5a57774e297e14c646ba1533e5770bdb0553517ca1032f7267351c8aae283b5006ba40a89dd8eaab48e695c82868773b347ea3fffc9ea397400de7e6b3b33ae929b4c48a82edac4c363d94bf9cfe46671ae0ae26d74ceb96ca4b9d0e756eb64d07661528d2faf6f87c68f36d50a54e377e6516323ca7f3125f9d70af39960be57a04a3a23f3324868f600629579b7eeca8a794f6539d40dbe23083bdbf21a760d23d3557d8571c755be9b0b8f26ce20b5f8aa18f3b2933fc582eadff296c2d67ca521357ef4c01daa05f97f4ea19872405863863ac82efa223a591a45bb8f9a0e1db2d491f8abd0a61dcc1f02fb4ff305272e6ec3bea0e7fd9ae778c32bc57d003a45079cfb141f8f7576b810b62f918d3a28b37f849e40894e9d3bfb972f28b20417e02bbb80d99ada39874946e21383dcfc13cdad3464ef9114f0ad922cc4a78a67eaf69d828d0d133b9556422e572a7e13c40d88d74f9c313a7d33672f6528682ccfcceb0666295b76a17619544d472be6e1f7ebd31c1b3f5abcec897a8b022d663e16568ba8b4f539f60f3242aa825e7d6c899fb67b68f847333a262ae96b13c86c80360d06b91b01972336acd5efd9e2e14774484d809a8333c01cff5cf0c5b5f09b1894df1bc40d6d48b8d5297662ff0f263888b5aabebd07fc0278878b533b98bf01c4aa1fd80443fd3bf81a9bba0c2cc1481d9bbcf6c8ef64f9ab6070e27652b99b60cc2d7976f622bc9738d3600bd93b65e373b4c31eddb9643f1b5676690bc27599bace8a793f99ecd748c105efab30294ff944da7939c33904a5e3a5ca58644f7387b1960503e7e4adf8eeff00b9cb877a451110879d2986bfe3fda1f3f65befd53cba3d8479d5a425e0bb5d7ff7e0ffe22cda7a232184f9cf54b8eb3670bf859688aa859cdc4373fc2dd3ec6c6508018f00a89273a53242e0d445cfa7269b646379df414340031f8d9c9875f535e14ff079ab72ebe8ed0e9b7c4b512b7011f7e4d0130fd0593d15ff77424128d8ba1b4ab9d8f3ce0007a9772dc9c09d23025980f0abab205380b4f1421105a3a0d1930e82ce2813e03518b1053e6f1089b1330f735957025816321a61581afb6a044dda254f1859698de49213def49689cdfc838e78ad426d7e52d68074bafda4d4f070bcf427a5befa2887e56673d981a3dbf9f61710f97b34122c0acc11138d1705377121980ec92ead62ae3234079cb5e0a609ba88c8985359174c1e2555737bfa2f5f8a58797f1104ccd7e4d23eabb361d87d0713016d68660d5231b4ff041df3e9851abf76496f7037a4b83ad662038a8e9d13e328c9e7619a0b535994b4af72b4ffaa19be77a83384b504c445c120e7b619d422146202415ce2a83233235be513000f6eccbce2b7a101a4a9803f2f46c3ffae12e9de334954fa8b472d26c3b8d5e9e8f3de5b79ab9d5c55d97224d7de9ac79ecfbf3616e1eda1df205158fefa818f0ddd8ac274158f0a270d0a9682982cf5e95c86a221630e0976de03bdc255b12d4c36b43f6ff7d961d4af52bca6989a8f94f96ba2faf34322a0729f9bc9c177b6eddfff5e75e0729cec4363cd2877d264ea988f3185c6e5350f3e0d430298535bcdd96582fc92746ec3883017e814b4fde90397126ce94d8eddd37e6ed4035a1c57814dc5a76d0cf0f7fb0d6454917b9a1b1fc35d2e1c6826a3b8f3a2e97ed0a0ae9a815250a74497ad464ff0a485ae6e3d2e93931bcd133f1384bc25c003149194f843985bd19615cedfa2f2a8f26dbe85ab4a1030dee574ee110f8940be466b9221b71c21131e99c9326ec88b2731b42a2c34e17a064835d24b0f5373c857453a89b8ac45b25e39f20a90624fe3ca949fde37c8d8748cd24b4fe6c5b1cc5205e8b85d8d4c9890d7ca1302061643465dd96c8935f3603aeb6777502450b41b69b8a7daa1bbabf98192b1fc51ced934d10def3815908f41cbb7e7ad681a029d217d44011d1518dac42aa5c7db3f8527cc080f46e4d5d213e828c02c050859d1a9258fc2923bf3cfb302b754224acef9712c51fc82d8d377d9010b88256a8b029c332ae8f20a91cb9b5bab55a98390888b287632d4ab68f363bc02bacaead3e438c7b6aea597e8a5f712512f708698801ca49566abff6824c7c9cee4c0e69277877efbf5b98067829eafc5741314cf5c594fbaeb9f7dbb1e71f35de71e3b3f27dccee8a3dc14febc4cfa170c303b2ae22c674eecbbeda195066c262dec4863e4da026c9b197f7976317bcc8f150b74cb0017d29690d6a0921c1ff83ac5bfec2c2f51b7c703e191bd90c5d99c2702ea7cb93977def183a84dd8a1e309fa4b4f6942af97b2ac2b209968d8c17e300146f8867e04e72281232150a32e628a30f1b37302bd4fb5dcaf34e7987b7cd29ea2e865a39131bc867e166f25a1521ee3c184e7512baf72624b70631c65d8b19c3cf0ed34c35b6db8f0c7dad969ee5842d6ec55648ef92e6720d6b7ebed1aa3df9fd1cd3c5fc91a8ee47682ca90bf0373e0b4d89df25b0d180b581bc2d7323851612d93a7415923d6e88e2656a3685e91e46f0af4d10c3c46c253cbb7424e8ba3eaae640a627bbeaa273dcfd0b73ccc3350bb7625abe7478c83b663e50e18d6deb52169854d7ccbf865ed64428b56d0d451e05d21cfeeb7a4f43a5b4e8ec1c5ecf0a1565b8699420a29c78fdbd52d10f05a30b643f22323a3e1e23fe3324659de15e40920e65f8a21b8f2e5b8be872ffc534be13edb9133ba12fbec64a53479cd774e8cdf8cf34316169b9b5fe89fcd87b90ca10c7d32ec688000a82121f220f7189391d689414001a416274bcacdf2b3395d6e3135e1718592b5f17fa1442ddd69a3f465aa73ce017a09ff7717f322fcb049f75dfff2040e5d9878391fb20ad26d51e0299a7434e18fe55a274bfd9cc454fd61be8f3364b5a183e9d2ac4cebef196f988126a6b8a43a250fce720d385f8723751bb80713a74f1f5021ff27c265b46d600c8b56e7b0b14b8031c9cfff69563da0657b07fd337b039d2ab79e6a9f30ab30180d6e6c73c2662db935acfc0514cc6f3ffe62ae40c776c1a6e705693ad28797052fad11c438e84e65111e8ebcc2efe775bb00df0497e96db248d492a4c85363b4d56c68d44c2e1be49f6af465f9a6a044a790d4d4d3a76075fb10a2b803724618ea6eb595b559a28c2a1c3e6f605a422989356c609b0defe9c9facf39acc0db7219586295a7e3581fe12b751f91dca6b2b4604f7e3662a17bf4ea91c5e416ec888ebc798324cdbd1a8b3d95cb5754a20cd90cd67f51f301bffffc99d8b44132251afdec557c7b5d52c1048ec2db6ed3277b550dd87bf110fde915edd8305560d4e5d296f81dd1e9e0e1039ba2198c0a5268996ff209cc0e586402216097eae4e1bf9fdee5c1a25a4092152f4e0f3b9f012549b52ec68e1e7007c04fe7b379d7d2bbbd0dd67e964779e2b439b9f649ac42ed773a957a9cce5d7ee7fc44de2c7534f287f845f2fc2cf90818a8e484267532a28d105d0ea87ca9a56557e506500226dee99afe9b628236a20b00fde8bab5383c0e129778f53dd4d284fb5453697b28891457245381c6ae70f9f722848dffb7044d1275909448fd545af8ec6d1ebc32a5f7776619d2c1891bc1714ad286236aba7b24f984cdeedf0dab34ae5ee92b2b4d1a0e7b96783fcc8df2b0d335237368068b827e0a6dfbfe97efe2f765d0d37e9a4a5788e27b68080100000000000017010000ff0f000090960b0993ebd609f4fab6a5c69c7affd863f4595500c6755ef8a8731524548069aa74068c7e0449bea8bdc6a7deeeef53d65d907d4020d70a29958fd9ce645cf5ceb846a0a519ed2656553899d428ebe0fbce972c7d5153817e91f03cefba74498f27e39772b7d990b53f82a10f01d3c33b62b256a26a6bb2768f00898d2a62745d096a3b0b46d38480c0e5e54dd24b7fc65b4ef26040bd443adf37286918ef0ec0330e82029ec076e841d4236c215fa3ac78e76848bff2930e6364c37acb4a0d7a47bd9abd7a75bd189e0dd97011da53265919fc4b1b9508a012b461b97baa88866109c65c2b5d9411968cc069202a62638d000000000010100000000000000b01000001f8ffff8deb83f75d1281d1f6b40db0411b406e05c14eb0974629b72d5e97068fb29d1ccbf3d923f356eed97bb6911ec3700179d0fcc6fd350b1b40dfb792cf381cb5b669e163d346a56b19502d6afe7a626fc7822edfaf994a3c48337931a8bdd109c731b8ef53329a4edee83d655f51901bd57b16a3cfb9f9c7c1c71430b664cc563dc762e1ab6973a6891de589484abe9663a9f8bbd6ec1f75c53c1c31c3ae5c1fe34de74d24d935efa41ee9b96fd1be21ae0aeb3aba3b262ae723e6eb1ae46234ca300820551e4cc02dc6429534414d5d7967ad90b0eac99abb62307350da1ceb0789cf90fb2c9ef79f6ffe84c99cc8b9ddce2b4e34d102be7eb0eb93c89ad9d3deb1beaa60e23722f87c91903e287f5651e260ac0d121f84cca47cd7786bbd403af2d3b02ebe437bd7151689c353aac118b24432a6b0e507c20f9f29f9244ff380843ef7c49425ed12a6af8b106982733e99e54a8cc352b6093a79dfc9c5654463571839e9428421453d2d2fd76f594b099f95ac49a83261c33de1e6d97575e49b3e268baa5b38fd107f6fd1f65e42ba46919ebf7129aa937d94477a19211822f35978b10277913862ec9371695d82840ac448b5e551578742269c7baaacc17895f899131e51aede0377d8266ebbf463088d6b6ad3abc1b62cdf3cd195bece78c0edc5b6fbecf50f6d3fe3f1583528ee3686502adeed8ddeb5e3aaddbbf105e1a8eb8f5e5cb7d4a17ef5982d68ec07fb32825d3791c92bf7158b8af5f501a24ba05f5ca76aa7d099fa89bc1ae551dccf1b8d192dca2b095e10e0b6293e250d256ba138a63c6c0d1164562035b5ba8e6f1ee2e7cbd3eea13360e7b13213ef544b01291cdca79e4524acbe482921e505d34925a6c9d1306b3b4ea3d433bf890d7517fc79b99f9f970bdd79ceffa94976efb4970524c1b57678ddc8123e0a1313f92428f571051794c3e4aafe45f47c91dfa42139274b4db4da6bdc1d3c2f3a6649b5c2b39be87f9f356f7f8bfccc3ac796f3ac9b68cd17196fa518a88f8a3b12312b6b6f17d446514bd41169841c54553221b9a99ca21a61ba4c8a70a69fb4540b3c1ed4750414dd32fd9f9d19af7912b4eb9426499a83e2bcc465e1b311ca20d12b3ba2b356dd8959bd5721bf36425f1bb24def0c9133428bfb2bfc0cf5013ce358eb1e14596823a9cd0f647fc507deebf496ef6d783f2a8bc14feae9cf8f8d6d21dc8c48ae0a119aaff278f05a9245a52d61d629eec62212c82995c095de263fc61dd5d48714ab4351652d9887694a25285c2f1f6985a6591b7ca3c824f83df674f28ecab9e6a2891f8d5322a88d8651920972813558cd9efe5d8ac80a59c0f537bd5b226acf6ef917980cf4ab888670e94b6efc431ae1627250666471421e62d41a3746c4051429ef14ea9fedcdf658c2c92ae1417edacfdf1b8b82a63476488c996aac133453c3a6dffcda0322385fcf84d4b9c65b9b20589a1a48c670f1a8ac85a7449b4861e5349c8b4f6e062e295f97a5765f1794b639fa29b77d05bb1f097804ebf98743b0cadf1c54421df0736aa916fc02e647d88d77ed1f71cbe886d784f44c254de0a9815a7c52d5d68ac0ef7f131d12d90226263ae76df1fddde6048a0840d1be5f1d9b84437b1171ad41cddf4aa0009172bc23088e6bbd948fb5c661026c8c76960bb03bb15982b3685bd95cbe62b85a190370d0bf6712fcd8877bafe51a1f7b7c7a5d4687abae0f2d0a1bdd862c52d60bbd9deccccb7eb8fe9e6d62040e9cdb26bedc41500faee831d3fada3ef9fb3b7df2f20153f4b201c71a80b83a30f8d642bf7ade6080ff38141b69c5c1b5fac80ebe9fc41b2b156a6cee218220bc3965910ba0e396e7828d06e55448ed745cb4b806fedc2b168b81375994ceaf79bcb16269c7a27e450bd338dcd8b314a7055a42903a3b85bc0997282c923e1e1a11df1944782b919c98847fd41afdcd8fcf0709a40f620d8e1df6a8b6fb923269fb9b32bf7e47f91eb050189034f4979a7413495b489891387c4e54062cebf3a308233b40cb878853729b7f844bb6cf7babb702585a9b2481e81020893865a56c6ccaf4c9f5e9c119f958a206e851d9d3e0428d44a3f3071c89d44ff327f1b20d40fe195d22ca845335c8de27fa9c826e934334413b80097508ebdfa6c688a4f7df9ec49c7f4624fb8238525a23f3397089c674401c04a66bd9bf2e4cd9c5e72b8569c12657acb9c7b39cda5539907f64d61ac8045c06480829a1f0dbff8c8eb27971dea81be87b19e481d9fa22bfaff0f8978142845225257a821bc476426028db581ee970361689de41f7f8b166f7e576adff71df9273570d8a2d2b59c14269d830ed3d409ab27c944b1f074da108928190516cb9a7fe77246b70220838df9022b8c3143a64edd4566dc2bfb042e7f58a50fcc8b8b9a7f91f5b2256084002f4c88b6083b2d6edf95873d10f084b83b7466ff01a03dd56b216d73ea690f191aa92405f29c8e76e198d37151cd27191b29fb3ba3c65b03642e8c57da588fd080ee52a4ee57dedd98c287047b80284ea5c51f9a1356d3ead37f85bc0ce09090d59eb0541d186a4af557b06c9492a5ff23a0191265f1223773780b23a47b83e9e1b3ffdd9a445ac16f6f05b75ebb53d858aedf763d0aa6edd2d1aab9b5ab25df0a8c63a56fb20e5d2255e8f9d858a37f85af0ea17bead8b612bf34b30187bd222314a07b8a055757af6e5146f817447359e1e9137eb196cb13dfdcca5b4d5fc1ac544e4f9190e38ed094a5c4848d51de0e5ea6448fd50c021f66b7f9954fdcf5cf9d5a39574f44956407e9e2f3c54d5d0d1fbd1306fe6bf650bf00029cca23bb57f52782e6e61fdfb06032f68739a278c06bddc9ca8c15a20eb68e23d4107c6159ad5daf386c4ee04a9dd6749c95b5778b4c5e782a980a26ec29c48fa7f1da7f1572646c2971e2e58a68f9a61a91fe2ddee9b7849e5c48ec03929caf9f13adc6d33381bee49299677acff5ed935e43aac315f743f14254f221ee2cf013b7459346528b193e217ce6a5f666d05bf4decce796f3b7b73ffc750ace48cdb764a72627dc4b2106e6a675315c7cea16aa8fa36f94b120b14a69d7ea398d6f06f0e02f9af0ffc3953d3948595bed7c6c77485ec135cc5267e6b345d688b6621be8b3645bb3d084db8336649003862774abbf5b4d2a6d515740668a163caabca89fe963fa802e80e700a983cf9560f07776daace370fa4e5e8165f742072735170ab7ab8aebe80f1d70daf2e76582aa1ee84efbba0ead1a3ac3f6be7230400be510a5e4b413f256b34806e9cc7356d5802cba15e37c71760c67475e16e7ece40f29ab18c6f2ffba212cc33a74e713ee7cc63cc8f0ce6f35754f960d85f727d046133ed48925cad5abd01fedc4a8e298804c05fb6865fcae70121c40562ba263b0fc85b45ba7eb00d0217af1dcbb3aed606d63dac640eea112292e19ed3c8014a856aeb9790bdd6b751c1bc946fff0ec1a5ac948ce6a672cde3c2b0c2a0415a317925642eb34eb3c047643e59bcf729ebacf5839135a655c7fb4495913d4b687bf21ddd26feda5e756aea805f87783a2d3ed034355d393ad328ddbbd539c5fbc4dd738870121b09bdf4200469bf7dbabc278d8c5fa212077e41982ea59af5f27f9fbde0e89144804597f595ab65c2343c1327da3046126f9551f4e5798cc75f3afa3e8121b1b0f586c2c3707ce49ee641db1a26b74a4ccba3636dec1e0f31af80ee92796665e6da791c42fe09b6c7bb475fb9aca10e7ade56db5f70c0799388a9a6abb2b7ddcc22610630796b95fc1ccf5af1a549e133c895d190d7e94696ada011e24370e57ffd333bb9098e9e32a137fa94557975ea3638dca1e3da763f014a35ffe1fab5983a55e4b22c10280d47197f65f4de9deec926c00fb4eb3e48d3a0361e580055e8b6c3316297aa590cecd324ed53d67211e5731b086824f85d68a93b41c9e34459728ea7bd635194108cc33863609cccd7428729287e6cf5259e78475ed3479dab60bfb2a8e22edefd6c3d3a9571b38f6659f44c0097f876118cbd3baa6682332f21e09fe930dfd09ccfd6a8a50db8305695dd9c223790ee58ef57ed56d2d476cb3da3b0139b63773ad29d04de4e1a51368986b8872a220eb7860d51be04ede134e513d649fb37f6e7ec8b74470aea7ef52de8d57b12e8e9633d0e6a0c7e1578dcd5da610537265a857d7903dd725056d8d7522d9b9269001c36036ae8dde7d52345f43adb7d2e69a0c7050b95b66859807f3b77a8b78ecb4f4956e2daaaae5d4dfbcb3d6f2c809eed1ed97673cbbc0f40f9d95613016b725b22467b6c04cacd96c93734d89cd824061f0e56d0ceaf89b7275650587f0392ef4205e99d9113ea80988aeb68823a631e104b6dcaef09eef2725b04473a1f7a47795f5a18bc708deedcc4dfcd5f1f71b03ecb8d6fdfc3bc6e0249be5bbf6aa4cc60ac4a31151fd33a1489fea18cf70da81417e579b575e77d497f3bdfb9365869b9725ae5c7df5ed27c217c4d3390e442f499342cee4bff51c93708bcc387fe5622e7caf568bb9a737bf0ab46f7f686d0a5192990c4c861448038484e23475709066c0b7d44d7373151f3952ca54930bc6396bc1689eb61b37a2053aa9bf7c2f2496db0bd4c94357be1856cf0144d8ae71ea34787238be125e3cd5b155973174c8d2fbcbae3b03b0d74349360a19f9d14921cdbd1e579b504cfa5d917b312172550550e37ca8348c30d0c087d68a710d909c16add7c2e01b3a65899a054c18337bf4669c6cb45f1a5b6a4be9bf2932b671a9e4dadee2e817361f8cc48f2577dd95a7a0c5752241d2ffcaa0621ac547b31909910abcde2f716c13eb27d0d811cac215b75b8c15320473dfb281d0e9734c5a6f408cc985646b8c7c9211446a9a171002f449baf217a20326921399b9424ce2dca8dd7ad991130511812e3d6e54f7627926ffb653a939fe8314ce3b19b812aa70b4a5a97960dc0b70a7bbf4eb300b7c9b554c1036b1f47c750694fe192deae7ebdb4baa7ca896263b7007ed9fdb0c8f689b0c59d9c68b60045d2933bb3f894c5910d2e0b3a89135fa2d026c9a2bbd418fd05b8b9ba9dfaf80a8057461cb2de2a5ceac4a02303c7ff84b5c00b33f6592feb9c158bd97cfd7fe4c8c621f2aea11036ba3482db85ea7e0cb7bf0765ee4eae960a5177bcc54bab95d06820165d9ce7b04ada07dcdc45854d0286243f43bd367937a1bfb76390a0ada634b7719f2df78f2665c1af4593a34143623d88dead25000cc43c2644227ca6968133b85ae03c8e9f235f6b8f7d6af0c4e1a34060847a78fca2f781d326b950b99edae48e638e0c0c25704db7dd1f2311051a0a043b9d01f01239f5688ae23458ae5033f6f451fde1420d03bce97fcf0c2dd7e0e8009548b31d76423e04520ffdf87560ce56e11f1a748efee1e9ef4893f6da93bdff01d10e5105426cda06f4ce756ffa5f1f6ad5148ea41b6e171a4cb41c4e080ffb4bda193758d59ee54d6c75c90d961b15fd7773c0a06cff60cadaf92239383f3cd1ccf09ee4bee8fa1f126d595fa479816b8968efcb2cc195f084ad837b373baef2f5e8145e4fa0ea528eca6b2d35194c7fa156b4d0c16b09e93a4dfbf63aa85f746155f2aab354fc3761dc36f669eff94c72aefbf3be9aa61a48ee89d8b091b45a49e5f1487d9a8c28711171351e71f11e8b23c985ee9895646bcdc61ff791afbf03c5ce789194f5d947411f9c4fcfaa30a5ce896880ad2f5304489f58f2a5f724959990101000000000000005010000f400000016cb221f60b78872901c65f2d4dec4d6f5e9501a7fae229dc91b3b2c45915cbd640a4b2ba5e8130324e581b41d2870b128d4bf9618fac4633567849c95af2cb68db90095c101e237029c4eea4fc7be5e119fae3d105c092200a59c6e35d632cd04cddffbfcd96ed1479cf03836fc1b78917f704221aa6827ba9f71dbf3a02d15660addba883862179f6e074ed69f248f49381bb7e28e4dbeeaedb2016eeea4dcb9952e95d7cd309dd308ee21e39be5b79d8f56c426b8b909453bebb10f9f364d7865a424ecce25c220d92bf736b179dca86a562ce281e87e38420ba08538bf24893ee669867dbe2437361daa7fa77bfcf4ab3d6a0ab0ada32ad5ea857c57b2d2e185c3b9f8fbf3068fdf1782abe82280288ec7c517e28aae2be0d604cdb96c286502f5758bcc66ffbded2c40474f95975a66fa5e659a509de5583d2f04501f650226b501a41bb6aee20474b17375982d4cd56c1e0b033fe68a119a465faf95143f30b922cb0f3ef21149399349c89432ced6db30003e4549d73c6a65a8315b3ae36793ffe73d187f4106538e29fbaf2961402414135dd647640be4d15c6cbb3a8dc0abdb574e8ead88c5e7d43aa72de0ae8586cd7a96b52abde67548808815672327f7468f53794ffacae86f2c46dbe53f6e4db9823c6e0f14aea497256ccac55b4ac10afda3edf26772900696c0e01e98ea93d81339d2ba5c991253a0e89775496759385ec94a53bd73c4745e2ce8672d2b6bb5017596802e00f189b8ca59139eb4b1914b057a201297ae9d24c44a1ce869c7c3ee1c615bd9042e4cdd961e40c8003484c6e5487ff1e9a1dd88f7f5168998bf45662c40a501830c1c736e23aef86ff5cdd59375cf03f0046f2424868bfd904b38d1eead070e4d767e24a586f93c1a0180181341692e59f0888e19e3830ea2fdacf9aba04de7c5a2e93d56b13ce262d6e516f595d9e4b3f633981acbccd93bfdbc3761718e5225331daa6d7431ad8d8082a6e867fdc7ad1eac449b01a7e6936919f0f77a33ee6ca5dc0f5a5c41f01d28d6f1e4530d7e1cfd7a3649fc13fe7601a3984a61d7df1973fff43b9d99b4c67f6ba644d7a6c34abaf6ee86a035059f2b7ff017d3908fa924d314947961ccd24f57832738b6595af7283a31a6017ef5e094123484b3621d3833d5e4e8d35acfd24e41ac419992f6aeaef4599313eb056a3f3474887355dc6f1d343acad79b4d51b8415a33cf851906b80596ef4c3cbf350caf6042a1b0daf4d228914deb8df306d70538ee6af43a8dbdcdb93de15f3778671b69b127c16c89f5d8ad7ee6aac3a4a2c7b05a83525c77165fd583fe124f80e1e955dc20eb7ff956e22e2f0bfd925ec9cb765483d88bb87ce63e9f420789be81c0eb313f393213c7dd9fd6e50e799250560877bb3942facfd7bf83be8214313c33c82cb81962ed59e6f1848ad3aa5159f226f8ea9dc7eeaea6211c4b1f3a93fa015b6e958c39933b7f04edc35dfce5bad26a66cd5a7818501aef7ab9d01a8bd194f2364d65fef11d9404f7014b3fffde380026ec26f324cff3b50281beeea7e68814669d32a4494f978bcedc7b443dc8097fc846e61a50cd4a1da2f7020602522ed7da62d076a2be825eaa8e00ee5081122a8054395e77189773ad355455b7f4f36794c76e23866b54ecfa05e194bb3f4d64e9a211634911eccec3087e6a090acf08565b075f79eb8482847c6e081c55755f25e010f0ee1e7a68b92d9b49cb30b7787d62d04f0adc226c37dc5d0909d7940255609829baa1e0c123e4870c258cfcf6565f81dc2c382589fc662059fa4831c9a2116b0f968573b1be5ec6d16689ba63b54b10d1e4981c1b53c9d9a0bc3ae269583543abe5d7d681abd357c616d6b24d9d5539ff5428ab77316ad7f9f07db6e800b469627828669117f5784ce398299ad806069af2180b904fb7473d5a4e2a5fbb29e8ed9b38d538c1d37ca6c42ee0dc0f58f00aee6462c37f6ec9525e8679668e34bcc79edcef29602883e18263b596dde37272924cfc7f47070427a3f9a0340026bd1dd27ac5e700e50a4bd4f0b4d6d73f7f80807e4cb6a65f56cf224b6402d8db740d177e8173cfc03ba314cbb6b700d6ba04c217afc8544720a220d168a6e3729d5e0dd8965f4d9713d5712541452916cc221f934f5fa7cea82caeed3c567aa9bbf9f28b0ea9870eb5a03be39e0ee98d90656679b4a2bcbbf0249b32ff0ee68ed6c84dcad7bc5e5a5398217d2514a892675673c377ad66b94dea176cde2a09d79834ce2be82e36b47e09352446e3a0191756bb5f19eb1beb9fc9a6d5be218475cef449993927dc6ef1db385ba999f548627b281b3cc2fc1ed06261979847aa69d0095b0954dc7d4f895524f378b0b3f432ade433e1e72aac6882bfbb63dc8203d697418502ff0105f6ac0d2b0e07d233cb066d690693c47b2a4714dd6f7c1cbd59d04eca9beeaea966592250233f64a85116cc9adc2b01d0af8c2427f6370c3a35311d598a5cfea99dd8961438fd6d519623c961c491642e2cce14be892ae83a7a16330c6213672538b2377df693b1810835e4770e9225f616d1f6b042c3eef97e7f83e1e26dcf5805bc5453ab7d70b6dde1a570370e98bb645c70b67f7a7441bc22f853849a92eec57376136335898ab4c56cf4b5e495560d795167ede8f40c29addc2f11d849e1bd06536038746d9546b28d65b48cf1b50ead151bc402ce38f44852ff9ce79653e5e63814e4359de469253106818647544879d3dadb78651c56abd54bc4f9dca3f94b1be9553ce3899dc9af4d1651b6494350fa378bc931ba21673e42a1c8674022ef76f5ba7ed50dc84735b08e1b5d78fbc5df9cb7b1732170f0f3bbc33d5485b132f0dabdd31a7facc77e1ad9d16402d040d1374839232a6f689e8e49c5776e7a00bec894606968bbfb947fc20873bdf45bfd9c80ce6e268e20b366ebde5261992b9dad68439aa8fe419633a936b5f0fa258dbdf98eef0e15eab93ccf84a6ab90d582b1fca9914163dbb548b22b693a1a7461b36addde4584a6517a9d3df24af7485cef75d67684718f2690d2ce943a055838536e1f02445e947d642213e7444e302b3b2f6d94368f670ccaac02a1e33dfd53173fed0d361837511a35b73ac65d7e9d19bd7b927c73120aef37dfe57c6c9f21da0adab1b17de663e974f2bfa8247baca4d08111933549827b059de738a384870e3c64e8a51624518a8d0c6ae6cd1fb8584c6aa5a5ce5523d5a3eee9bc0871ed54b640d6f116ee4d801adbd75aafdd6ce03f1a6def31dcd1a5220d41a2b68fde2e45b11ec33809c5306e71b1d91616ac20dbe576c03c5bba9091edae02eebd5293e4757dcfda1c9a2190a7df52c99139c6ba66e08631de4b7ecd33b3d27aa5940bdbe5e30c5797e7175b1a51a1ed51f257461c5ee77a681e5f0cc233091ceef99fb363cff403f57108fea22699f65aabe3d0dfd6df250304b473bbce4ca1bee6abb6a4ae505888bb90643ef16657b411b64dc978c1fb852c06feca0e483faee58a01b188bc2a50411bc780c0a282c0ff594e776ff8640a4c187665a8ce563a9670a79fb905dc88491f629cf0cc1fdb996b44d94851cb482bd210d561b360a1fa93d1b187fc50a4a1e7ce7f91e308235a429099c974bbc63b63d1d1241aabaa15f8a970d58e56701f726d8a4e64912c8498ad1abee70b6eba544bcce9ad9ff6b363d24e06e6b030167ecde6725f34de981066fef52997583674f2f4aaaf939bc982ffde904feed06d954345a22ed3396d286c454d9f07eb16aa1fced845fdebed7225b442ed072ece093d5f24cc35ba9b62e24d0cce3599291a3fb39321be8418a471c0edebcade40d43919675e222370e35448e5112c0ed06ebcce790bdbb8677b942b0efc674c00c943f11505919c9e5b607836fa4c51e114ea5cbbc6fabb136e7951bbcd8de16f6e2b5eaaf7fe8176c6dd3cd6496de852f62103802eca73f2d859511061891c6260894b9bbf32febab70f642efb0e5b93d8c7b3fcfe8229fd651c424a475a1eafaf5690794995574ee679bb040ad8d9eb251054c3f1e8183bc1fd95c0d40b5cf84861b6b3b7cd574fffce78f4d53cd405ba6cb7a37ad121334e503df00b17e4d8514fca4f5a8dff7b089d6ccdc22cc0758fa285e758bdb168b3da8b0886a9cd1c851bd1a8ef5ca90cc9589c757f48c2be60f7ec61128a874d7fd75f1de6ead0bab9c11f065cb3f84ad20a52461fca155c0e07ecece103b62f4cc838543ca813252c880d6f675dcd0fad97f213896586ac0d8c77fb32f38a3b51bf306c39f0bd5adfb610f5b221a59fe34e4f30e1d19296e329f9aa4bb5e52c2d6a8c8d2fd12879b734126ad7e2db2a3fa1d2120be6b522602b9794da6d1789bc699720584b50775b5988557fbe82834bdd8b3baf52a6362615ff5fcf832bc8f68633c0e09321f84dc10021e2cd8184809b45e68b1c362e091dc2691358c7eb20b155754579ddbcd339fe9bab9e2b64c4e81ab1abd25348a92274e4fb04a2f8247972fb24324c33e31af1e97885424a15cd987213f563216751057f47e50f0cde175e8326af5f408c476a4b96f12297b47ecc89b53f2045adae6cce99f77c7a4ab19ba135f037aaa053a91bbf1b71df9b9116d75b28bfbe45fb60536d524b403562dae01bb83490ea6cb04330ec8fec1e9ecbfea2d319d899934932b436394911a43c3bfbbf1166cffc9058cc6f26c880754f9eb93da2963685ae1e458f4956be6bb0cf7a57e67e6652419d25770c72ea349f926daa2c6461b7144f503ad2f1fd9d9959c990c1156184c0f65e50faf1a6325c7c2dc9e5171a51422feb55bf5addd2aba76fa77f97b854b8819b12137ffb85e05083a00db5838735fd1dd59b91800632620cc982039f3a9bbd7952538971e07d7dd3fe1d714338dde2d291c10347aa8e6d7d70edac831d04bc4c9e340fda570b34bffab519ad44eae51cb72471e8f26ed8a19917719577fec65c99728517b77e5dcef566c64d263a02d8718324b9279a9d80284445d916a350b0165e1498d2d75928dd779587d6cec2ceb7390ec47ebcb2e8728ed39ab899a6e5ac810c5463ea5c05111c206ebce9725c839e7291b9c98c47cd63ce1e44f5157c129ff6eeb17f39340104f30bdd4d7391b0b25d321aa0d9822a040c1b72adc670f6d9b53f4cce7a2a5b27a43f5a2e0cac437d275c32bf8c4e56429c4c2dbb1911c780fffbb0e5b68d25cae0c350e893efb39bcfe893a5399cd417690e0bddb4bba059e76e0c42e2b4b3ffa8189e996a40a51b490fa4a05e10f4f66b33445abfaf5415419e8d911a8ab49ef6c945871815138a55c130cc50ad9cb68953abdf9683481be85903a41aaaf4e2c194095cf9cbff9297fe8ab3a3901a284ae13e10b3871bbb98f25299ae92e44aac97df95ea35c0233d2cf756fd09881d03dcf22164b3f14fee8d910771f109b73c810687339d6227ccbdef05204c3cbcbd7317d7a88ecd623a03a79025b4078ba8c97f976267c852d558c8919af26991ee60bb217d5f209dd1fcfd1942ac9b039e9f65a461fdaa3feb597c88c93a3cc1f6a1cfb3fb7bd20cfe9dacd078c9f1ec7822fa4c01a95b1d3e6bab7f5f0e74a4303204ed0e0afb268503882513e3c9387921235b2eef8e91568407650b7276c8612cd994f7bb3b97c17c6c21ce27f50c11bd757346156faef313493401c2094b574b82c6232a289285daa18150f1bb523a1089a9fd6c1ed99cef8c65b0e32cf781fb2fc6d54c1e8803777c0786a1ae8c6c82be21e245f800000000000000ff01000005000000896ad0fe94372b15f7bea1cb48c7d73e1cd86238e0fb69a90b087b4db37fcce4cd0fe73f843c4dd315b20309e3ae19b01a11f21b619e44114ef94c65bf6dcf4879c6dceba83022ba7769fe19c42f7ef035992f614fb8af02b53a6e9d57390b8a0d7eb6944e44d88dda565c2fb38b420f7e1a449db7673817462cc00bbc1710c81349520cf0eae5b4611268af0e7f777ebebd5858a0a461a73ee8d554ebcee9cb24c943d1a3528290669a1b07bc5ae5413b3863f3f33bf870256992583e788f850d956fa9a3f800c2268ce90ea73416b6d7c6f87b1880da1e2409246146ee3e659dc5000000000000"], 0x42f0, 0x8001}, 0x4080) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000440)) 2018/04/13 16:41:30 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:30 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x11, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1028.125864] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1028.139992] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:30 executing program 6: r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000d81ff8)=0x101) mkdir(&(0x7f0000000180)='./control\x00', 0x4000000000000014) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x70, 0x0) ioctl$TUNGETFEATURES(r2, 0x800454cf, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) rename(&(0x7f0000000080)='./control/file0\x00', &(0x7f0000000100)='./file0\x00') unlink(&(0x7f00000000c0)='./control\x00') close(r1) 2018/04/13 16:41:31 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1028.192119] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1028.221361] binder: 6627:6630 ioctl 40046207 0 returned -16 2018/04/13 16:41:31 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000001540)=ANY=[@ANYBLOB="7523c688813930c0ec1e22230c68d2162ee18fdf92a3f31415e5"]) getresuid(&(0x7f0000000140), &(0x7f0000000080)=0x0, &(0x7f0000000100)) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r3, r4) 2018/04/13 16:41:31 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500e4ffffff00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1028.342197] binder: undelivered TRANSACTION_ERROR: 29201 [ 1028.405284] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1028.451181] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:31 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x78, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:31 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:31 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_ifreq(r0, 0x80000089a2, &(0x7f0000000080)={"6272696467653000e7ffffff00", @ifru_settings={0x5, 0x0, @fr_pvc=&(0x7f0000000040)}}) 2018/04/13 16:41:31 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500feffff0700", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:31 executing program 0: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000140)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000180)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000080)="1d370200000061707300") mbind(&(0x7f00002f5000/0x1000)=nil, 0x1000, 0x8003, &(0x7f000071f000)=0xffffffffffffffff, 0x65, 0x0) pread64(r1, &(0x7f0000df6000), 0x0, 0x800000000000) fcntl$getownex(r1, 0x10, &(0x7f0000000000)) 2018/04/13 16:41:31 executing program 6: syz_open_procfs(0x0, &(0x7f0000000580)='gid_map\x00') r0 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000220000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc1105511, &(0x7f00000005c0)={{0x0, 0x0, 0x0, 0x0, "386aea20273dc03c3d18dd0dbd4a0ca15f9f580393cc4ec3b8ee256b9aa630224ba64c6ff43ee01d2996c914"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "eda422cd37591b3a5a7a683380f7e0b9e790bab72cd0a4f3342f7431c1699a305ca3091bb2320e8df4e29aa2fdff6637866a68c1426ffbd8a6c7da1d8ea77d9d", &(0x7f00000002c0)='%[[/vmnet1\x00', 0xb}) 2018/04/13 16:41:31 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f000000affc)) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/sco\x00') setsockopt$inet_int(r1, 0x0, 0x17, &(0x7f0000000040)=0x2, 0x4) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00006a3000)='/dev/audio\x00', 0x0, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00006a6fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x40400) ppoll(&(0x7f000026c000)=[{r2}], 0x1, &(0x7f000097d000)={0x77359400}, &(0x7f000016a000), 0x8) read(r3, &(0x7f0000000080)=""/72, 0x48) [ 1029.194345] bridge0: port 3(erspan0) entered blocking state [ 1029.200311] bridge0: port 3(erspan0) entered disabled state [ 1029.220766] binder: 6690:6694 got transaction with invalid offsets ptr 2018/04/13 16:41:32 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:32 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x800000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1029.254502] binder: 6690:6694 transaction failed 29201/-14, size 40-8 line 2991 [ 1029.290140] binder: BINDER_SET_CONTEXT_MGR already set [ 1029.297347] device erspan0 entered promiscuous mode 2018/04/13 16:41:32 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1029.320771] bridge0: port 3(erspan0) entered blocking state [ 1029.326617] bridge0: port 3(erspan0) entered forwarding state [ 1029.345839] binder: 6690:6694 ioctl 40046207 0 returned -16 2018/04/13 16:41:32 executing program 0: r0 = msgget$private(0x0, 0x8) msgrcv(r0, &(0x7f00000000c0)={0x0, ""/4096}, 0x1008, 0x3, 0x3800) msgsnd(r0, &(0x7f0000000040)={0x3, "6a272ded98b9e02cdba1bc068f9d43c27bcef4416916dc7ecefe329ad72a1dd4fd11dcb2427e4bc1916c0089c5acc37791a0c9effdff5bd7597c8625395e2524d1820d963b0cc811959efd858d670857db6a14da015f9c492c5af639b1c4205079919636dc26fa694af9bf33e11d98c1ba8dfa"}, 0x7b, 0x0) msgsnd(0x0, &(0x7f0000000000), 0x2002, 0x0) 2018/04/13 16:41:32 executing program 2: io_setup(0x4, &(0x7f0000000000)=0x0) io_destroy(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000002f00)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000002ec0)={&(0x7f0000001dc0)=@ipv6_newroute={0x34, 0x18, 0x7de1124c6ffd611d, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_MULTIPATH={0x14, 0x9, [{0x9}, {}]}, @RTA_METRICS={0x4, 0x8}]}, 0x34}, 0x1}, 0x0) [ 1029.385548] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000093000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:32 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:32 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x100000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1029.436215] binder: undelivered TRANSACTION_ERROR: 29201 [ 1029.443166] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:32 executing program 6: r0 = creat(&(0x7f0000000b40)='./file0\x00', 0x40) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000bc0)={0x3}) r1 = socket$inet(0x2, 0x6, 0x0) syz_mount_image$ext4(&(0x7f0000000b00)='ext4\x00', &(0x7f0000000b80)='./file1\x00', 0x2, 0x1, &(0x7f0000001280)=[{&(0x7f00000010c0)="c34327a236e387b61267767a76e4571aedbeb5150f28d3644f88bd411030eebe87f0af76b136a4df74329f2a140d420ba7e5298b1fd40d773dc43cc452d20cbbd5f470e7c24708d9cb0cb269f54bb2ec75157285949da428046efe30c0c1aa91", 0x60, 0x20}], 0x48, &(0x7f0000001300)={[{@data_ordered='data=ordered', 0x2c}, {@nobh='nobh', 0x2c}, {@data_writeback='data=writeback', 0x2c}, {@block_validity='block_validity', 0x2c}, {@debug='debug', 0x2c}, {@abort='abort', 0x2c}]}) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000008c0)=@broute={'broute\x00', 0x20, 0x2, 0x3e8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000280], 0x0, &(0x7f0000000240), &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000000006970366772657461703000000000f8010000000000006e000000000000000000697036746e6c3000000000000000000073797a5f74756e0000000000000000000180c200000000000000ff00aaaaaaaaaabb00000000000000007000000008010000580100005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a30000000000000000000000000000000000000000000000000000000004c45440000000000000000000000000000000000000000000000000000000000280000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000049444c4554494d4552000000000000000000000000000000000000000000000028000000000000000000010073797a30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff010000000d0000000000000086dd73797a6b616c6c65723000000000000074756e6c3000000000000000000000007369743000000000000000000000000069666230000000000000000000000000000000000000000000000000ffffffffffff000000000000000030010000b001000000020000697036000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000ffffac1414aa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696d6974000000000000000000000000000000000000000000000000000000200000000000000000000000ec00000000000000000000000000000000000000000000000000000049444c4554494d4552000000000000000000000000000000000000000000000028000000000000008100000073797a3100000000000000000000000000000000000000000000000000000000000000004e46515545554500000000000000000000000000000000000000000000000000080000000000000000000000000000004c45440000000000000000000000000000000000000000000000000000000000280000000000000073797a30000000000000000000000000000000000000000000000000000000000000000000000000"]}, 0x460) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x7}, &(0x7f0000000040)=0x8) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000001380)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(0xffffffffffffffff, 0x40086432, &(0x7f0000000100)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@dev={0xac, 0x14, 0x14, 0x19}, @rand_addr=0x5, 0x1, 0x3, [@rand_addr=0x3, @empty, @multicast2=0xe0000002]}, 0x1c) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) syz_mount_image$hfsplus(&(0x7f0000000680)='hfsplus\x00', &(0x7f00000006c0)='./file0\x00', 0xe7b, 0x3, &(0x7f0000000fc0)=[{&(0x7f0000000700)="dc84d2cacc41f9c47509aedfca6314", 0xf, 0x80000000}, {&(0x7f00000019c0)="ca11aac3ef4f1ad5b7d5184083496b5bb065d4368cadd1f4b5e69be4d88ef346001433986f8e5d95659cde2baf45d97f2757aa2f924c82a2b1737e5aa0cb3cd849d1a019c3002003dc41ba847c461f47c373219fcec811d9c862a800085dc8e848882313daa62a8907e784cddf6afee79f65ed2de196934fffcc61cab901c390bdc73365497c4021ecb6c04870887ce68d674cec6c4901a063d500988bbc90457d68a292fe4d67bb8dd586185fe285f0e3d8f1aec0e716b1b11c3fb656ac8cb68d16559754b1abe46e9c3e6cf0c7db1b271919e4fef87ecb6ea628a24da0518438710d923d663efb614f1ef27ba0d7d678870b6cc08d62a6e8a4d8c823a834710f8efe65d5e0f8702b33c98b4643e3caf45d58b6cb867a956418d2e434e31bd1411b36c4409799019cc038abc15d61bd13410ef80d793c3d5fc8b002ffaf1fcd4d648fcc643e27e4c3727195b71a12979527afde4d35a8f933818bf87f3585b2f654ce77a52b8d8eb0b0f47dba01aa0d850c036cdabcddc95446c3d06b259e74a541d96184a55a474f8740c7ae727fa86030555fd5bf052b863eaf58fb8cf6b127a043f36e5217cf6323882db44544188a230af0f95d47a1d8c2dcb413d1e89295ffe4ebb5277775dd1a2b4a6d9c3c295c79d1d892b96ef9c7656aa6fbee75e0a2cc1d9efb5389768e1f50d93a87b9d8ec7c50bd17dc99dc67b47771d03af996aacc41ce94acdf24ab3365303303eb5a8cb217297f71f569bf88143c76b8a04d3b92c084fb3f0664215dcee04bc882ab1749b0ac65514616e7520af8c29800259222ba1aa6e3a705aac433e8e0c668393b2c68c1805a7314d14bfd50efa6cadda940eb9f2e670b60ce4cc20f42eb913618ca8b5a24762042754c95cd0cae47aa21b9a573fb375242653372721644a4c5cb4f706bad07470cbacee1e192ea4ac979014a1960f6c2e16c41c32c9f1bd3b924493f11bb7f2cdf320c23918a7c2d8da1ad37e59724e64f885c90bc1f12b887f8832cc682487677423fe4e54b302dfaf08fde1b55d3db5aaf87addb2e78d50348eeb88ae7fcf4ed4b8fb7db95cbcd36418f0e4f0b7e9826b1eeccd753552adc6f9b7a01b6aa5d9041ebeabcddbfb97970e24a6cdb2b566306fdf5040351d3c8665476be7c7a0a750b4a001c819d4cbb1c24dbed13a34ca76605448699996e78ac9d8e7ba7088990aa838c5790143877c73a923da279ca9e489bd64493d371bf3b01f7b625a8fd6f78a130f6f25ebcd2514f8fcbf2bd78bc03aef7562a6e6b5bec30b2b3ed3774b10b163672223512f2295b1cd4aad5eb0b7e2c6398fca582e0f028df974f08eff663f73a426224cec90df3c0e53d480edc90278ade923489b399a51a11a275ed3b954b2cfbe2bd875ec8d1e4b16cdd90c6fe83069358cbd88e2b46efb3da5bfe62995fe0a9672429fca38be126ddffcc5711d4bd6b21dae357594b8007ad521f70e98ea3e0a93ce8c0dc548730292d203bab6c3558591ae915f242badd2649251dc971a4f1f27932759484f2721205f099945b243ba33a7539376de1f2caac7fb45bdd7615c193301844ed6c2327862d35c30fb4bf5a7c6fc42adf6412ae97e28a265cd74dfc3421ac51fb86f2f62c0d1fcd46827cbf7509d31c01fbf41c38d45f0e0ea7baef2a93fe7da74a5896943d1f763ffe16388b6e4e1f911c9c2f1de9bd577c7c533ec7822c21dbc80eff5a68be4226077c2df35ae794984ee45c5d8b832826f4968cdadfab6c3e191548f4b7526f08be4240878253ae393c92b9b4e94b95df64997da294528f75604fa99c3c6aa45c8c7fc53ade4e45e39d9da60adffe64346547e84f6785059131172b94a1a8cc794ac2f262c4e043091a0978a0a4637a8f5281898615d9a5d15d10b002a4d4a5764cd269c77c7a644d0fda6e06f33c294c37ba067070b6c845bced7062d230a327b5ca6aec709fb4bfef22ce85176e20aecc917f13f5dfa7744c403e04fae9881b60db9fd0fc8701c8ba026d01a1186acd6203190c3026f7f7ef0f9769df3a64539440545da3409b0c23f1612024e7a303968f2b71033688b1cfbf16fabb31592ec11027b086bd2e1892edb6fcc9e05f731df9dbeac5ac36236440a2d51a8e32207d1f04f835ccdb1ef1064dbda6c369a57ae1785279acaeca0ee667a4c06877f877603e0083857b6f0caf579993a062de9feea49304ec4206c8dbe6b4e67026ee13f87c7202002a1fa2d38c18cf37f3f9752c8079c08db128ba87e70967a3e68023aa4c611440209485386bae643d34851fb3f793c41f064674edda3b5e0410e6b85894eac8ca02484d693f90d2bbbe46075e0652ac4cf43bef184fefc0c2db550725ac6829e822625172896322c45a2d0c5354d146910cf43acd085e9a36738e09063e8f456793d9eab9bb161e3a18db6856d48476e72e082f4a788f55e8f757c3f00b9a352d15edc37d56f884e28d307cbe44485cd8b9b40b8819c41b9727e2efdc6fe4bde1ad321781797734289dd9da6c4a98f6b3732577889b8add1c0268bcb36ce6a0983dcb663d04516117e5f44cb628c12ca561437d0b09bf57d5c6695bcde1ff7b988590ea253972380f961a859fd25b1d6e3f4335ebc7446b3f40b23cb5b303cd6ec7eeba733bd154fc824a1aa14de1b4a3b580e42fd5a8190899c005e4edd6e20a02a4e31bf7b93ac239762da0a7fb6fcd5b346079fde1389f350909fac1cb33f0550e4567b9f4523a522ed790abc142ceba807202742d37c73aa6ff761bd04caade1ccfa9d4fb9ac382ab480f76ae450ead50c65b1c8e47c162cea5d24244242ba61e2afdcf8ffe7597c4e94203017adda2612d018251e20dfeee0c1b8e40d05da074b77889bbdd866589e508e89f0ab4d99d41aeea58b2997b311a2ecaedd992bf9617d9a8c072802099f7e8256f1c29490c8a7c37bf82bb46a6057366ae7e5abdf3313408d3a0b749e36336b7a7abb1bce9d18dfa53016b2f143989970827f98d314982a96e08d5e5bb93b4072daf7b38d5d52118fb39ccf5faab58a1d1662f13c1303bc868487be739aea978f2c22410cb7fc9d0de2960b14c6eaa12a9fc9aedfe07ed92cd182c99aa3689748158e41810952c71209738bb75d823f2c00163633fb8deb0d96b6b4c5a59f70adff053f05309a9e43300aba93a03dcf93e794857fbba05ebef4a06076a2cac25ee90186696377aed9052dacb9fe995ab2dea9d3ff4d4b764a5153c3a0b4160edd4d2dd52da41bfd724f251146e8f23972e079e8ec356fdc50893ca74e488eeb241d5079aefe18f68fea96ad8e38903825b9d32160d8ae075bca210ebc26449bcc387380fc97c4af8246ac79938c0d21b748859e4d46a4a042f7c9e44098084228ebb9b1f04b9e50d868a0b3da16e009ba8c6ed469f13d9737a121fc041b1d319ce76c77390cd39fb203e0fe542068fa9f38b47b5fbf0b93b08edbf7a36eb400530183bde22e9cf32fd0c58dfd55fea8d41f01fd3d284d1fec51c1a83d5162505a664b6e3476e8d86c9e2042b513e47cdedeaf3f7d46e00621ef53921d7dbaad7690bd57cb874b7e7248e7f0f1065ee7758dfe527acfdf06f3fcba408a22f9556eefba41db1f648e59c6c4fe23a825c313a7fb0f9218415bb71e875fc5c7d06d2dd3cb5ee541e738c0ccaf6981ab7ca32d76c7c26c5edb11f6674402ec1268d05fd383f93430e0d3157caa0fef8ddf38a8c2127acc6410606d5aacf517f41a872262962f6258355a3b6c8f8d05f384a71fb207b3237dd62a58007aba4358a9470b8d110fad01c4b99f53559c5c6b51782982834bba4c4d50d9bd787f24879bd3755a547318789eb0c3d741dd3b4c083482d2aa66d28a5923d3ad2f113738a67183cbc28f5a8f49ccc389111152f2eb7f66bd67778148237f6cf45c93edafbb73a8f12fbbe779e3ede8b7ea7858f81ee54d303f9d384a50685ff50282a469ad96fcf3df8f6bdd96f1007788719e0c6225558515fe4d58fa6225008b9a93c318c3b218d700402ca6848bc1d91b0ff3977454c2694b0a85a0a62d613d160c5c6dcb9c2efd2125d40da41714040e01756d2bbef9a773367fb73b2469405ac3f58cbc75c697302ee86182af927be3ee1a3d9d77ac4b7264d23485d36813ddc584deb8b4603bb6a13c746614eeadf8e2e380cef0debe81d85b192073b06211b2a0f71da09d137fd38efbdfa786371bfb31b9431c0af891b9bd28e1a89dbb9275438e21104c94aab270db319c84610938273260fde2a03c808816716df575253c60348856d334907454e7e5734de2a0c446aa5aac5d7c7f7af30da47cc4bf9dd71d0871e6d0fe11bbd53d80492582ffe8a30271b5fef10ca7a8ed7342d22fb5c2f06cbc8b90e35a6536316700455340ae884fe7a2615844472032c873ef53e698baa10e05022a34c2460412ef15623e2c6b33d3598a8177e104eb0190c1548e30fadadc0b694b72829b0e00f1e96773f2e9c8a05470d62948604418a126e231bbbe776b7142fb30b44c1af55272d1a5893227fc2f7c32a8158c4e6acd58f18a0b4bc3e0a274c7e2c2c92e2ead2dc0519f91d9afefc317dfe3f3ef593a447b4f0015b8dba5a22a6af9ef17544e381ab185f9faade327ffb81898ab2332073ea451d16e3dfe1ee25d4e5531b5d4c381c1808dd86e0aea1efedcc1b5b1a2fbbd1738601a1fa4f0d084f809a3d17bbe91fae9df518b549147d09c14f9013d7846ca288f14864d888e4b9bf165a0fc53e372b8be7fd379f318749298a59e5b6ce930e069fbf8e8c21d3fbe2b0e2b805e57bceeb79ffe4e449f527f22be6417f1980697d9f230d73909ed4587f5fb891932f29a93202051216798db8d0d33117d73fb471bbd8ac92b711655eef4dfea8a41e2354332cc2dea8df5c664f248668f98de01e70db42b2cad587c2320658ed156f30f786772da49e80e6279f45297ed7884572c4e5f6676f336c845869eeba63869594db33087f1248f3d2e74eacc6215d03654a2bf1e2edea0f48cfeb001dff01187e2a06f1caca0caa85775b56636d5347287ab88fb2e69e27dd8916d37da07b848e1a3261a9d829a4210eb4c6f2741074e67f071d7e93bfa41674685959e817ef16af01278edb51ec3a272d3a661891fd2fd36d6a6be939cd97a8e28ec4e0dbd778ab4a84655419832bbcf8ae04ffc3ed9e72986df4c565b37bca307899af180a9aa4bb83fd845b18622fb38cda8df05e2f75fbbc1447bcccf1ce41d7864be228386f35fec116fb84688b768cf3e60ea9ce65137de481f504bda77e16dd8bdc53945ca574eac949e5d6724c136e36f97fdda5472ec25cc7aa9708af64bff517b7e1fdc92c04ca03ba70c6e27b5ddd7f427d0a924737331d8db5823c76d9e079f026e40d23b40c6f42d42e7cc19036a0b5d5bc352d3e49f6383d68612d3369874d64c278b4c12fe4dd66d31dbb1b31917de01cd58d834f87c896965398479d8c6f13915e399d7a14482ec9a789cc432d3506fa8ee315b3b0363f5584797283309adab5b41c0b5bd705e9f3c21149955361d81aa699926ea39a1e69d3b39723ad60e2b728e18171cf26020cdd07fc0652a0fce209930ce13d1b2fbd3e79ca11b97b462cad9aee9c91e6574bb4f7a6195ae9c7f7fec1209512dd354b437c726fb5f923cd4af7c7daa9e72fa3e8fe2f5df459f3b76a1904899da164352adea79d5fa3b1e0ab59443bea7f7a6a39c73cffa98872b9a95ce3163062a9bdc48a207b01d475a9cc71f0178f84dcd908a57067c198600127c0ed8994", 0x1000, 0x8}, {&(0x7f0000000ec0)="9fec562a8d754f401151477ac852d4a630ba4ccea61e10ea082c8df5423a97b2915fb6435346b094a884aa65aff08645ec17fff16f88eaf45bc1bbd9fc75cfed4f2979b053795833e66c5aee845eb1b1957c93a13a859fb680261bf36e9288f22e54cbcd91b3858cff660d8ea45c208e0a83a5dfa9877d1f7bb61544ce40c297185ab67b953d0a46919b8394354c235d97132f02ea4ad123a0fc95276a8bed980dbe93dfe178f083b42a17ed921da8278c5e25b43215888a2a1a027c3acba985b87e", 0xc2, 0x100000001}], 0x20, &(0x7f0000000780)) ioctl$TIOCGSOFTCAR(r3, 0x5419, &(0x7f00000007c0)) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x48b, &(0x7f0000000140)={0x0, 'erspan0\x00', 0x1}, 0x18) r4 = semget$private(0x0, 0x2, 0x611) sendmmsg$nfc_llcp(r2, &(0x7f00000012c0)=[{&(0x7f00000018c0)={0x27, 0x0, 0x1, 0x1, 0xfffffffffffffff7, 0x1ff, "9a73ce286ee6728d5347057f163ad9b00e2d7b73b781cff48415140f36ac6b6aff2146db45bd24ae10231cc18d9c28d359d9ad7ec586c56891a67c19b6a710", 0x27}, 0x60, &(0x7f0000003c40)=[{&(0x7f00000029c0)="c99e6d34de876ccfec46742e34843b30c187c33c8ba2f4ab05b6e5009b2eb64957fbef15a7991e3862f650e8d043af87223afaefdfb3c2c5c1c435d18e97240cb051715ca8db553c1cd078d9e4ba68164410887122f258ec37996dc1e72d404d4417f7a89cf4e90dd50d3b88022d1a981bfe12ea3290808d957a18c3c7d8f38dccfa41e1cb802101c7a151c0385be6328b48ab284c71c5012493", 0x9a}, {&(0x7f0000002a80)="fb2cc657e2ef16a30f7a340f3781e6d797287f19f8a37958ccc535e0656810cb6ef11183c48d39830d5b2d629539f2fea97137939dd8d4527e111e92563be45ee62ef6e29bffd39e7a883fb09f3adc9ed09d9c377d0e85f16f7b212f18f49425c26fd22b51c1746501d1d38a3c445cb5866e67f8f826358305bafe8b725fe8131579dbc0b8930865935b66bf695b712c0e4ec666d699602e62f679f3e1f553cf17c2496baa861aa15149837eb6acabd46ddbb8bc697e50dce53b", 0xba}, {&(0x7f0000001240)="566e018d76be2d06b1059082585ac264aa8861468bcc570a51de1d2bb6274bc0cffb5a663d0d382d0eb6aeefdfe6578a05ae3bb4f01b7e7d52c11b", 0x3b}, {&(0x7f0000002b40)="bb0ce7ff6a559dcacbee642b74ad46c9ae508bfc645166c52b898179b9afdcbaf1f7c73eb82f514cf816701860088ea35182de86e54f073370df4bdc8e9f42b0b1", 0x41}, {&(0x7f0000002bc0)="508953781d841aafd38470a7b094306d41d59a77995a55636c582f87c198e1d620263ee3ee7dd06e5a98707725886f4cd4abf84420be1438176eba5dd304186efd0b6cca9bf9fbbb3ffda64bbedf6b0cb8eed29f94e56d5fd6cda23f11ffc565e0af36b6e932fdd689f35beeca8bc9d3cc8e741855dd2adb1127a0d14861514db0ee9257fb4475815ad7b22e64510ac981cb9d3612b2efef8d74421b244c05c71b9089fd744115ae0540f4c5c4d560aeb720e32ba9ed955a6709a58da2a1ab194f3b7fc94c15282fcfc31dc42c96f829b877433a5833e23375b3e6d038219b88246a2538940678ce9871614bd0a3feccd47940327f6790316e2a4b3a1e23df18599fa817e026fdab451d6f6bc3d2b2f166a2498cd403b7a6f77eacbd1875965401188f96a360b1375382fb3e01f5a7185706fed60b6d97c811d3f13c3d5a68d4b4e47767353242d8c650f1c8b80166aea7f009163bd38c9994144f245cdd71c1479c4db9cd8bc8095eaa6b1dc750b065a0bd4e0754856a7be50ee4ca69ecbae2c860b4368828097b9d868da2a21cec8e920da318c5633d6da7905bb8e963dd7d2869deb2afed73a78296d9d6778b0b6f228cbd974c3ba8ec47656f56bb3ec842a30aeffbedf35840e182aaf7d7262062c6fa10eda504d192ae20a0030009d24e97ba05baf88539933905353e2afa86461086b0b104eb10caacb69c18731c63cec82edf7e40b8949fe81c1a2b2176aee5c6945399335fa4506c616fb027d0bab15cbb3f1358c268e31aa5c5766b690193b9527f55c12de22af1025fb52ff8bde5d187574bce21ddaf291961948ec038efba04ecaad7157d1e666693a27ae3c5b637fb68269b5682601e05bb00b98c4ab396e214e71323ef34618e312db5a827d08cdea03c8525f4c41456860952d9388f8dc1a4d4f49c6120e958e361a6ba8ae999fed83f12c11e7d6b4ddb1997546f956cfb0973981d4c497425d5ebd53cf0ec1e5943a7ca4a1231dfa3543ae1841194d1172345d917cf69678253f3592874d15058510b321b862c69614e04550bd3541934f0176ce874c7077b215a8b30c2a1d7998325f31a9a150ba17b60edd4ca1beeac59896bd513fca88daabdcdcd90fd20455ea0ae5b8f73148a269b471ff973299ff597463af6dd960175fd9706f125fddf8a135b3afb7a9b524d30592ec5915f12b9d7b35f534bd9745380b76dd8918e621bcdd1d5c0c33cd6d257742cd52c5980883d2952fc7adfcbc2d47650e14bcc2678b847c45b42b75ccc33235cc17fd68ab5acaa1ced05970592c364baaeed730428da0736752771db219c620c6832daa21413139f5bb391ba7238f70915b732b9b4d6fe6026abf4e0429d3b86a291aa6c60972d34c5f840c46dbd269c67d9f5854dac6de2926ceff524f50f45b706def471176e6f892dbcc41938673288fbbef7e79f05df90f75de15198e5979fe52e9431d0619b06e27b7af7379eb5166d25dea7477cc316f47f528481e4ed2f56f8303303a57fed3d94b48d26a5196e902d2e59ee1d80cd2fe3cc409ff81e4d02acae908fff6c04a731376bc14cbcfd8ec03f90f99048ff3b68f39f75f766539e25e2fc4e2c76262d24ab86f9272ede32e79894e0ff9135171fa4412e3e77e39a9d4b7c3ae529ee4c441712fb2ce04292062ed684ce88cb171ef99a20839ca968f160af00ef8454dc8e057d9b8028c3a02d42c8af6a96ff79b84cba2bc442bcac9a46a0c8faed958839260df84563562e704ba9e6bc21f9da4ec6cdc0975e2bf59a9a5a4148ce027cc5d356cab09a2f5005b63483d98decf47b98ddb18cd7c7f5f7c76a7fbd5229051d33cd26d5d684bd3e713bfb1a73cce585cfb4d9bcb04ae8854924805e4c2d7e76d245ddaa58bf80ae4a3c651e2bac569ee2b9e231786d88c51d46c6d69147d5aa0526cbcfbbc0249c30d483a999810f48ac98589516d8eb3a1ac8fccfa345a7c912b06c42876373e38482aaaabcea3ab84b47cd1920a108d1dc30db1bf66ecc1894a2d935309de179285fd774e0a48a9f92476b2af171a1a5c00689e322d4a58b727a518e5b2e38cb0d2e81d6af4791b2605cf2c856541c20b67ff2026710de457a20307ca68d88d312fee88c55304de50659305407e22db825f85302aa2690e0e18a327a454c9ff9c3746178bef67458e66fb8d719cc09f21aca482234407dafedd0d5baa28ff9aeac9e69e0e3fe1ee560d008ad77682e2a9f096930e06b0da9f38ddb762389406dd2f59263f1b81d739ac85523615f9d751f61abd4a758681ab81a2115ba742b80acbd4ca66689a5b7fc9d0c636ea0eeb8cd00351eb07cfd8a40e3360eab84fecae26145c0e597c4fa4e94945a72dd5ba41687282a97f97eef4571ece788b1cf372bca4d5ce925529858349af78232498f0ab75e437888d5c20a539328278032e036b996d1e35d3c982be871b7e1f9541ac75b5bf7fcdd6c3c395a8320a7883bb5b5967f83387f308386a95fa85f402bd34f4ce4127ba17464f70185109799e95b8fa9c6dbcdc1458a7a010dce24ad3d00a9c463e5cd9a8579d582f0e19ab9fa4cbac935de21aef9ca69199517764e29404f749857756c3744f258166c03a6d87ad485c58a29babad477b32439a21824dac7143e60666e7ef0c96578ef52b16554aaa23b38c19bd300f869a7f9ddaf6cf3eb2c7a9ed06ca6d9842273e2e72cdf60f4c91aa9eb9501cc3f1a9fe658930947ef63c092ed640e97402c3eed19f28ba5e07ca553d6ee9761a928a365551176ec7df2a1dfa3bed057bf240355b7a6ce79648d61f8c588d0825a62e8aa0013ba4ca9328939168a274e49982af81b55ddd89d710517e13795b7830773a4c2af5a18e590b276f20598c52560de8f4540ba543226c1c4b7054007ab632c7781383fa962188de8af734db804cc9068fd5d794a2e2a9a132d5e4ce5d5c74a4635b7dab0ccaccc9def00f474eb9a953ba5ff213c3f3700ee87c2513d9e22ad1d4e315ffe72278870b1ba9a9b5ea92e6a864212e84f298dfc57dac66560823c92bc5ba47f1ff2c570793f4ac1d0cd244988d75d1891550c5e9cef5107a98dd0eb4a16577e695dfafa15f93ff55a1a90c3709901dc3d81c6b14a0bd7a960954fa04db768ab078b504dac3e094f7bca3e5dda809223aac99907684976ccf5cb8772f6a65e9c7a99ac1174c21311669071942efedd9daeeff26fd1db8575e2def29cd677f9f45fc59c9d105f26db2970eefc5591e785e333ec9b9c449df1f9bf5760c18fd0c40c916a3a4c8cc84a5a3f8b53f7b4197563f8ea7046ec0b79a076847262517740a6892196f1999a853f59e8f2ce716c8f474b30041c1f837a1d4a43f57cd1d2708923497c8ffc27493f243244b7378ceea738035632f744159d6c785218c442bbacb30f5a96dc549be75064d64bb7a75f4854d0e71e7309b4da66e59a97b117ad8c2aac81cbd433435fbff9d39123902b042fe823b5cfcdb7a87f5433db9573c9f17be22c1fc9fba10ed985a152b20c124e42c412e8803f02b923c41b0c46747d4f256869730f22fbef68ae6f9fd5065366944398a7768f522b0577c9283846cd016e81e0d3df72c5a221cb0c8f621dda700518728ba8c0cf03ccd5430dcc7e65788412905a6c9c5c16fd150f06900934526d8930c21d0f22ad43e98c66b201c3a7ec3101fb6d3a5511cb6e9fc8402914b2aca003cd86511e8db3fdaaa1288a5220f9c22309b5e4a8dafbd98836362505974ae70082d003d2ad6c9bb47df6e1ee073521b3c980b049e12dd575af910f70e647c63cb8e3c2296332979a8e2568730c15f2c0e712e7f44f70a18a9ab9ed56e48d1834441d12d2660ddd4804f02103538ca09add506a2c61d6eada75ee7dc3f27e773907e52e5c234a6b41fdf6312b0413b23e51334110d0dd6c4cf26a5e05d35b840458c516cc88bf54f986f75470b1608f5891e66bea6cbcc8e7622a15834ec820ccebab89d25af1c119c3f70d2466c152c5b095f83c9a4229afc4a0ef292e118b7bdad03991289d700bb5652d83ceff7ffef2d52e75b31ed7188a4450afb29a5c03dd80e31d3304674416c23488da4e49b162f4617a8e7bb0533c89ae6d850d945e68a7a7de68325b9a1806fb31960284348d4a1b5d1238bf9368966b44e7f1a6679fd5f950bf65a037c727d2b5fa08ddb7d6536902824b24650bfbb4afbf3d190fe06a8d043e93651e5b6c29767a2e09a7306c6651f69952948091dfc93c57e2d29122650799d929029eb7aa2a7601d90e165b8115ac8821b6f9a4567a80d5fad1b15ae81c76b57804fe0917eb2f80dd4fd88c09768c8293e61c1722599f998444275f9e1469c1efa47cd6f307ff30f44095e74c97abe09314cbcf095b672bd33b45f097b15f5e5d36f6381d3e4e977bff8bfccc28fad60d0fe1bbb993181197267582285a7a2ae80051d111511e347b2fe24f45853eff10f6a7339ca48df3c1d55923c4654664bfbe1fbbee27f1989defca0404bddb7e41622b213b4e9f203246519d6cc9a0fbc526466a59133018f3a1d5da2a0b1b2e056877f03c85619b0bab3e2772f6b680f6c68e964dd4a9816023c4c51368ff171c9b558172c1c1622f8b78333e13bd924dcf8a6180e6fe5d0bac53416c47346e4fd894ad2890713d3e92f1d885e4484322b0db6118628f7295e1e4984e388c183f12bdec60fc7948b4226ceb5e6f8469cb97d73e1a76e540336295918cffea539b6592fa99e686766afc26c44370e21722910bfcfb0d6f196a256e8700678ecbab4fa1543ef19ad29cd4c4a1c955e84ecf9306352c6af4a869280de16c951743124b2a67545f1a3e0067da6c22a0770018d4edb4580366e0b8716a515f5ea77013835e0fe41d387d1378bf04952c5a4c89f6c758a50a4d1f1f251c801220e77814506b97190cae8d1bd021b8f75d1083731c2bac7916d4ab4c6ea09fa2007266d3334f3c03d2e23ee0c8cb6ba37b9b5bb234a250b309c34596bdd59391514c7d25b666f6a567d8a4c5aa814d922bacd5a61600676323994ff414e65bdb08306ca92eab9011d8a0a981754c729d8dcbf1369b7fe663db2a82f0e48ed33c5508d6fd4c29b60756cec812c584fa9825d913563a1d3c250fe75f858057a7daf0f804cd1b3561767be269eb1b7f57a3761c06cfa959b8406d7177227461ce1855d77b35ecaa298ecb0478ec9087abf5d65607e88f221d6e53900f7e964f2704ce810b14e3a4f610bf2f3a1bfe620102bfbd04a709bb7c4e32b4b47c9e748c2c9003685b6bb280ecbe1be54595a845da8d4ad07865217ce937402abdfe20673e355d21791a50c75107099580a5916405e9653124f3ee3d63f46b7f2dabcccf287ff9dcbdde56dd9f522af58ce85a425c324d11a36c20bf0ad680cb459a84ab59ae5ab23e1e073cecc5bea4fb333c58519188273337c4f865ba5900cd463a60da9ca4e78d8b1cf1a7243d5a0e6818cde7fae756a688ada99c05b4d9746607f041cd9329ecebe746cd964c26f17759dc8c22331ab4a87c4ec406ed784bd0b4ce8f308f5c198d96bab5b9b6259a8f60c03d9dbea3130c2ac5a0740c38da812113abe02af16c7a89bc03f4cafa0ba45a9297e7e5a39c1fe09f047fd9995f8a866268918b6854485ef96de805508941403ee114dfd3fb62a0deebe066850d527614daf1d15d1ca2cc76dc03764192986b4308b53575f567cea8cbb7e7c207eaf6f1c3ac5978b48202d25a9c717ef8edaf62fc83cb83d38536fce7ed72491ba9686c6344aa61610e033acb", 0x1000}, {&(0x7f0000003bc0)="9c9c67527b096931cdce69ca8053c1700a139bd2de59c3f75c5a8274c7cb47f939c998b1dedc76f7571b2fdccffb6b69d317e4fba91e34780d0c0c7e531175aa7983f5b39a1ceea23940ec524b6966e6413ad7d234e4bd8fdd485f398d2664af6fed98", 0x63}], 0x6, &(0x7f0000003cc0)={0x110, 0x10c, 0x0, "95df3ca60a28639c154573bcef3cc2311b6e3d1ffd5f7cba3984f3812c89b6afcceb54507a634c358390ebb3bed281571ae6e9c5b5dfe12ad984985b12ad019f67de6028c5ea0f5993b99014bfa68c2faaef59531595fe6ceb31f8b9ec3ebf3bc96d12f5d7e1bf6f1289c04959995ddf68faf102c069ebf9b080b1018270fe50050f51ee1c6c79dbf300ec27ee860622ba03d2b7dfc3ee43faae1522c7838bec720ce2209bbccf91b1668aabe71e311b885c56f0b0a4ffd7c7bef51c4f49c0d7bc36c727e59668da5dd552b435720d7b222561f6bb712758db6b461c792dcc882a9241f01308a10c4976a0e15747293f10280be174773024c5"}, 0x110, 0x40000}], 0x1, 0x8000) connect(r0, &(0x7f00000001c0)=@nl=@unspec, 0x80) semctl$SETVAL(r4, 0x3, 0x10, &(0x7f0000000080)=0x2) syz_mount_image$reiserfs(&(0x7f0000000740)='reiserfs\x00', &(0x7f0000000c40)='./file1\x00', 0x4, 0x7, &(0x7f0000001540)=[{&(0x7f0000000c80)="b81a35ae696bf4090cd8fe4209652c1528099e28b2671edea262fd86640995a556d083676ca3a85cc330b56d8d1aded537ae4baa136d1d3eaef8bb53f3b6dceea3aba29d04caf807d5fee31bf7f2b1fb4ac6cfba45e98d", 0x57, 0x100000001}, {&(0x7f0000000d00)="cf0e4546c9725026a4ab177b39d98b8888200ff4dbee7f272756db17736246b337658a232d95b5a0f4a128a0f7ce6490cd816a614b81de3abd27edef2a913436555cf4309c176dcfba2dce9a33d626a2ced8fe3aaa4c6aa15755d3e1dc316169bc31e10a8a15d02bd1753ed6e54cfecbd637b5eade47f00743a25c6a96cdec004b91ce250cc6324b573a4521308597d4bee850477266a4dc7bc0b0d195a80a7061912bf64d2cfb2e9c87309aff64cf70ce68fdd386ee442dc5272ac021b473574145cf72a4e39033432bcb9881b438a7ffb9e60eb48f056bfd5a3a678742430a", 0xe0, 0xa5}, {&(0x7f0000001140)="c51abd4a21111f5de142c427143353d0ac7ac2fb863cf16e6decc2a64db7220c3afbefe1f02ee1e47d259fa4c337bf200b36f1cdc1259a67a8033f160eed6a5e7b795534f9f66648ba8a94e6b1a95e3bae280496ced21daeb6486d3e6ca2ca72e64bd56f40ee2be973c4fe39176027483514d1a0aba8e73e74bdb7a008942f60ae405f0f3a7767cf93c42f3f1c3c393002b6823da2c4f424ccccc192a393be0e1ae8a7df0eaa8b2e97ad24d0a9eabcc78f5dd78da57b07ef59a7261ed6124611172469f6d932dc5901b0f87615b4f59ab207042a52c84bf7b6daf3", 0xdb, 0xfff}, {&(0x7f0000000e00)="9e4c69f583b8fa1a8634c81a841a2c6ef998ad4468d0c91326a8227f2407d4970ed80115e3e8b02d918d3cb50b149a3c5688848a7616fb7873907f285ddc84790504ec690696768bea59b4d600ae9df97545f9c3873a4ea8071066df1ce43beb5f5adc04709e574ee9297b0ba80d7334a927afd255ec652d31eb7ca16511ad0b1f8ec18319f97c172884552fd5cc10fab9bdb8cefbf8b80ac7ab6787cbf44c900b7a36316f5e", 0xa6, 0x2}, {&(0x7f00000013c0)="57b78a58d272812a9e351de75cd5d1dc2ed22b577a0c0654c2a5372e0d1382cd7b3508d8d17143e0e18b8bddc0e817ba77f45df70a64cc1ed5c757e1d06b40b49e66eb0545273b9c988be3ba828ce6dfc610f1dee9765094212f6cc5d1563c6ad301c7713c6b396a41158720274c661472bf604e9e7e2f8102512110858c4cfefbe4b8a52db7e272777413a67bbd896b519245353bbb58f558de13cefe61d4aded8406459aba7743aa4c65e930cee9e81a2c79357a297da1c340215d", 0xbc, 0x3f}, {&(0x7f0000001480)="72a29ee744568487d281a157d0c3cbbd56ba460db398b08c42653f4c4ee0d4a8925c7f2ff106bb2364dfa6616ad0bcf1ebe79f9c4c20975ccdfe6b889301e6195230149dd9729d9ac080fae638d00cbe51c8d9c9e429c9049906330d8b56d7c2264c2ab50b0a12769aafddf5b4c60a7818c09c2c54a58ac5f4211060ef8cc5fea3b34b0a92927ef8e9659ba162dfc6fb40bd8f0b2f5dba22d7bfc617e27d932e81ae6b", 0xa3, 0x100}, {&(0x7f0000001040)="4a85bca8a67fe7f76701ee3a58c911092da3cf96", 0x14, 0xe28}], 0xa2000, &(0x7f0000001080)={[{@tails_off='tails=off', 0x2c}, {@data_writeback='data=writeback', 0x2c}]}) syz_open_dev$sndmidi(&(0x7f0000000c00)='/dev/snd/midiC#D#\x00', 0x100000001, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000001640)=@broute={'broute\x00', 0x20, 0x1, 0x1b8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20001700], 0x0, &(0x7f0000001980), &(0x7f0000001700)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x13, 0x0, 0x0, 'vcan0\x00', 'ifb0\x00', 'syzkaller0\x00', 'vcan0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xf8, 0x128}, [@common=@dnat={'dnat\x00', 0x10, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, 0xffffffffffffffff}}}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x4, 'syz0\x00'}}}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xffffbffffffffffe}]}, 0x230) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000840)=@nat={'nat\x00', 0x19, 0x1, 0x1b0, [0x20000940, 0x0, 0x0, 0x20000970, 0x200009a0], 0x0, &(0x7f0000000800), &(0x7f0000000940)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0xb, 0x0, 0x0, 'teql0\x00', 'ip6gretap0\x00', 'ip_vti0\x00', 'nr0\x00', @empty, [0x0, 0xff, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [0xff, 0x0, 0xff, 0x0, 0x0, 0xff], 0xb0, 0xe8, 0x120, [@time={'time\x00', 0x18, {{0x0, 0x3, 0x13782, 0x14fdf, 0x80, 0x4, 0x1}}}]}, [@snat={'snat\x00', 0x10, {{@random="07901c8f0140"}}}]}, @common=@dnat={'dnat\x00', 0x10, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0x10}}}}]}]}, 0x228) [ 1029.500573] binder: 6719:6723 got transaction with invalid offsets ptr 2018/04/13 16:41:32 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000000000200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:32 executing program 2: unshare(0x8000400) r0 = mq_open(&(0x7f0000000040)='-$\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0xffffffffffff014f}) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mq_timedsend(r0, &(0x7f0000a0ffff), 0x0, 0x0, &(0x7f000066cff0)={0x77359400}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc\x00', 0x0, 0x0) ioctl$sock_netrom_SIOCGSTAMPNS(r2, 0x8907, &(0x7f00000001c0)) ptrace$setregset(0x4205, r1, 0x0, &(0x7f0000000140)={&(0x7f0000000100)="9d0309e2fe2d2b42", 0x8}) mq_timedreceive(r0, &(0x7f000033b000)=""/4096, 0x1000, 0x0, &(0x7f0000f36000)={0x0, 0x989680}) [ 1029.546523] binder: 6719:6723 transaction failed 29201/-14, size 40-8 line 2991 [ 1029.586481] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:32 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1029.599657] binder: 6719:6723 ioctl 40046207 0 returned -16 [ 1029.670880] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1029.732605] binder: undelivered TRANSACTION_ERROR: 29201 [ 1029.749443] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:32 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'aead\x00', 0x0, 0x0, 'echainiv(seqiv(rfc4106-gcm-aesni))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="d179f2508fb13583605d0008a230e7a657f9cc6e", 0x14) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002780)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="020670da30779052cbdde7af7f88ebe1abe54172fd8b797e", 0x18}], 0x1, &(0x7f0000000000), 0x0, 0x1}], 0x1, 0x0) recvmsg(r1, &(0x7f00001b0000)={&(0x7f00003a4fa0)=@nfc_llcp, 0x80, &(0x7f0000045000)=[{&(0x7f0000000300)=""/88, 0x58}], 0x1, &(0x7f00009f2000)=""/190, 0xbe}, 0x0) 2018/04/13 16:41:32 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xfec0000000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:32 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000000007fffffffefff000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:32 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000016c0)='/dev/sequencer\x00', 0x10280, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000001700)={0x0, 0x47, 0x30}, &(0x7f0000001740)=0xc) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000001780)={0x8, 0x8, 0x1, 0x3, r2}, 0x10) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_ifreq(r0, 0x89fa, &(0x7f0000000140)={'sit0\x00', @ifru_data=&(0x7f0000000080)="48803d6b61439579b6d04dd4102d09b21f8e3ef66a49b9acdf65e7fc2c583929"}) 2018/04/13 16:41:32 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:32 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'aead\x00', 0x0, 0x0, 'echainiv(ccm(cast6-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c50400aeb995298992ea5400c2", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$can_raw(r1, &(0x7f0000477000)={&(0x7f0000000640)={0x1d}, 0xf, &(0x7f0000000680)={&(0x7f0000000540)=@can={{0x4}, 0x0, 0x0, 0x0, 0x0, "6393838f382228fc"}, 0x20}, 0x1}, 0x0) recvmmsg(r1, &(0x7f0000003340)=[{{&(0x7f00000000c0)=@sco, 0x80, &(0x7f0000000100), 0x0, &(0x7f0000000140)=""/94, 0x5e}}, {{&(0x7f0000002f40)=@pptp={0x0, 0x0, {0x0, @dev}}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003100)=""/226, 0xe2}], 0x1, &(0x7f0000000440)=""/239, 0xef}}], 0x2, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) accept4$bt_l2cap(r2, &(0x7f0000000040), &(0x7f0000000080)=0xe, 0x80000) 2018/04/13 16:41:32 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f000023efa8)={0x80, 0x0, 0x0, 0x8000}) 2018/04/13 16:41:33 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1030.250111] binder: 6786:6787 got transaction with invalid offsets ptr [ 1030.284554] binder: 6786:6787 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x8000000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:33 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip6_flowlabel\x00') r1 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r1, 0x89f3, &(0x7f0000000000)={'ip6gre0\x00', @ifru_addrs=@in={0x2, 0x4e20, @rand_addr}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000040)=""/88) [ 1030.330433] binder: BINDER_SET_CONTEXT_MGR already set [ 1030.361287] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1030.362927] binder: 6786:6787 ioctl 40046207 0 returned -16 2018/04/13 16:41:33 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1030.429469] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:33 executing program 6: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$sock_ifreq(r1, 0x89c0, &(0x7f00000001c0)={'yam0\x00', @ifru_names='veth0\x00'}) r2 = socket$packet(0x11, 0x3, 0x300) unlink(&(0x7f0000000040)='./file0\x00') setsockopt$packet_int(r2, 0x107, 0x5, &(0x7f0000000080), 0xf15617e3128495c) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f0000000100)={0x0, 0xffffffffffffff4c, 0x2, &(0x7f00000000c0)}) 2018/04/13 16:41:33 executing program 4: mlock2(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x1) r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x20400, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000080)=0x1) r1 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000000)='cgroup.type\x00', 0x2, 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r3 = dup3(r1, r2, 0x4000000000000000) ioctl$DRM_IOCTL_RM_MAP(r3, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x0, 0x0, 0x0, &(0x7f0000b1b000/0x3000)=nil}) munlockall() 2018/04/13 16:41:33 executing program 0: mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40000, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f00000000c0), 0x10) 2018/04/13 16:41:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x6000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:33 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:33 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000000000000039800", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:33 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$getflags(r0, 0x9) ioctl$KVM_SET_ONE_REG(r0, 0x4010aeac, &(0x7f0000000040)={0x0, 0x6}) [ 1030.490726] binder: undelivered TRANSACTION_ERROR: 29201 [ 1030.573772] binder: 6829:6833 got transaction with invalid offsets ptr 2018/04/13 16:41:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xb80b, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1030.626504] binder: 6829:6833 transaction failed 29201/-14, size 40-8 line 2991 [ 1030.661147] binder: BINDER_SET_CONTEXT_MGR already set [ 1030.661633] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:33 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1030.673520] binder: 6829:6833 ioctl 40046207 0 returned -16 2018/04/13 16:41:33 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r1, 0xfffffffffffffffe) setsockopt$inet6_tcp_int(r1, 0x6, 0x200019, &(0x7f0000000000)=0x1, 0x4) r2 = memfd_create(&(0x7f0000000ffe)='$\x00', 0x0) write(r2, &(0x7f0000002000)='/', 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) sendto$inet6(r0, &(0x7f0000eb9fff), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x3, @local={0xfe, 0x80, [], 0xaa}}, 0x1c) r3 = accept4(r1, &(0x7f00003ad000)=ANY=[], &(0x7f00008f1ffc), 0x0) getsockopt$inet6_tcp_buf(r3, 0x6, 0x1c, &(0x7f0000000200)=""/106, &(0x7f0000000140)=0x20) 2018/04/13 16:41:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:33 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1030.794974] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1030.796250] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x80fe, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:33 executing program 4: r0 = socket(0x5, 0x1, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000540ff0)=@req={0x3fc}, 0x10) r1 = socket(0x1e, 0x4, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x300000}, &(0x7f0000000080)=0x8) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f00000000c0)=0x1, 0x4) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x0, 0xfffffffffffffff7}, 0x10) sendmsg$netlink(r2, &(0x7f00003aefc8)={0x0, 0x0, &(0x7f0000847000), 0x0, &(0x7f000048a000)}, 0x0) sendmmsg$alg(r2, &(0x7f0000f3ff58)=[{0x0, 0x0, &(0x7f0000511000), 0x0, &(0x7f0000000080), 0x3c1}], 0x1, 0x0) dup3(r1, r0, 0x0) 2018/04/13 16:41:33 executing program 6: shmget$private(0x0, 0x1000, 0x54000841, &(0x7f000053b000/0x1000)=nil) mremap(&(0x7f000053b000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f00000cc000/0x4000)=nil) r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xffffffffffff8000, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={r0, 0x2, 0x1, 0x8, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}, 0x20) munmap(&(0x7f00000cc000/0x4000)=nil, 0x4000) munmap(&(0x7f000053b000/0x1000)=nil, 0x1000) [ 1030.838696] binder: 6855:6856 got transaction with invalid offsets ptr [ 1030.849736] binder: 6855:6856 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:33 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000affff7)='/dev/kvm\x00', 0x0, 0x0) r1 = eventfd2(0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000ae9000)={r1}) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000b15fc8)) dup3(r0, r1, 0x0) [ 1030.913954] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:33 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:33 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x500, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:33 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000080)='/dev/snd/midiC#D#\x00', 0x10001, 0x80000) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000180)=""/170) r2 = syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0x0, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) r3 = accept4$alg(r0, 0x0, 0x0, 0x0) io_setup(0x401, &(0x7f000014b000)=0x0) io_setup(0x5a28000000, &(0x7f00000000c0)) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f0000000100)={0xbd29, 0x5}) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x7) io_submit(r4, 0x1, &(0x7f000049bfe8)=[&(0x7f00004dbfc0)={0x0, 0x0, 0x0, 0x8, 0x0, r3, &(0x7f0000391000)}]) [ 1030.946208] binder: 6855:6856 ioctl 40046207 0 returned -16 2018/04/13 16:41:33 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1031.093363] binder: undelivered TRANSACTION_ERROR: 29201 [ 1031.111281] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1031.152180] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000O\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:34 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xe000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:34 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:34 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) shmctl$IPC_STAT(r1, 0x2, &(0x7f0000000040)=""/92) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000333f88)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x70bd2b, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @rand_addr, [0x0, 0x0, 0x2bbd7000]}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1=0xe0000001}}]}, 0x50}, 0x1}, 0x0) 2018/04/13 16:41:34 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000020c4900", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:34 executing program 6: syz_emit_ethernet(0xe5, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00001400000091001700810022000004aaaa879a9351f289f7ae84e4e281e667f7e742abeb2eea915348480648306d70a5d92397fbb34b80d24a993324c440b63e1480e6928e16be0fe05c739e7508c2c4fa2d84f77084cfc3d502de2456787512610731351a70952ff7c571dfc7c6a047433622ba1b9da3212ac51dd22c8f70ec654a5048ac408f28f83a4c4e408d9a27f7351100262c8d7b3d50d95771e3c37d1f1d48ddd918880660905aac699fc47e4263aae69b8ed0eca706abe87d62c25763a780c52c83d5f24b1b8a16d15dd349"], 0x0) 2018/04/13 16:41:34 executing program 4: r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000080)="d33c5e3026639e45f22b235315549aef796d1c627bda8dea673b3a03431a3e357fb17b0f1952", 0x26, 0xfffffffffffffffa) r1 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x4, 0x10000) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000400)=0x5) sendto$inet6(r1, &(0x7f0000000140)="72c5db1a4d0a40f1bdb1702e90ee5c131c2d395997e7df3cd79caf28a6f22dda4b9f93dc39e575c3b253c7a58a318ceca6e76af58b4650a5ff7c21f9b1c7611878690e9a9d7ff63709d21399a69a06db4fa10ab8eca6c1a92f76903bbd193777f0881c42b5cd587e11e76c3480a55b21cfd1d331e5fc5ddd023f282a39f4b87b4bce9b9cd02756e146cde6bca84b7fbd5a100b3c341e6f7af6ad78b5a2a4de50ff13c65306fd50a09e9f039b80aafe4e4dc8fb6b3d4c7ab75db72528b7459974436c1b2e9f3f", 0xc6, 0x4000000, &(0x7f0000000240)={0xa, 0x4e24, 0x7, @mcast1={0xff, 0x1, [], 0x1}, 0xfff}, 0x1c) seccomp(0x1, 0x0, &(0x7f0000028ff0)={0x1, &(0x7f00000b3000)=[{0x6, 0x0, 0x0, 0x407ffffffd}]}) prctl$seccomp(0x16, 0x1, &(0x7f0000000080)) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000280)={'syz_tun\x00', {0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}}) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000340)=0x5) keyctl$get_keyring_id(0x0, r0, 0x9) syz_emit_ethernet(0x2a, &(0x7f00000000c0)=ANY=[@ANYBLOB="0180c20000000180c200000e08004540001c0000000029907800000400ffffff00ff00000000000000"], &(0x7f0000ea3000)={0x0, 0x0, [0x3]}) r2 = msgget$private(0x0, 0x8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r1, 0x50, &(0x7f0000000380)}, 0x10) msgctl$IPC_INFO(r2, 0x3, &(0x7f00000002c0)=""/9) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40082404, &(0x7f0000000300)=0x5) 2018/04/13 16:41:34 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_type(r1, &(0x7f0000000040)='threaded\x00', 0x9) recvmmsg(r0, &(0x7f0000000040), 0x948, 0x42, 0x0) r2 = fcntl$getown(0xffffffffffffffff, 0x9) fcntl$setownex(r1, 0xf, &(0x7f00000001c0)={0x20, r2}) 2018/04/13 16:41:34 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1032.038953] binder: 6910:6913 got transaction with invalid offsets ptr 2018/04/13 16:41:34 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x490, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1032.094705] binder: 6910:6913 transaction failed 29201/-14, size 40-8 line 2991 [ 1032.110887] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1032.147627] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:34 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:34 executing program 2: preadv(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000140)=""/156}, {&(0x7f0000000040)=""/62}], 0x39d, 0xffffffffffffffff) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x141800, 0x0) getsockopt$inet_mreq(r0, 0x0, 0x24, &(0x7f00000000c0)={@broadcast, @dev}, &(0x7f0000000100)=0x1) [ 1032.175740] binder: 6910:6913 ioctl 40046207 0 returned -16 [ 1032.185112] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x100000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1032.282446] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:35 executing program 6: mbind(&(0x7f00007f8000/0x3000)=nil, 0x3000, 0x3, &(0x7f0000000040)=0x3, 0x7, 0x3) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000440)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f000086c000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000c22ff0)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 2018/04/13 16:41:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x90040000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000000000000000006cd000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:35 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:35 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00@\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:35 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() syz_mount_image$jfs(&(0x7f0000000040)='jfs\x00', &(0x7f0000000080)='./file0\x00', 0x2, 0x2, &(0x7f00000001c0)=[{&(0x7f00000000c0)="0ecf42da1345ffee52483b458ba42620b851524435eb745e497ed08fe95c37b834e4af9d8e34cb07ac9eb89d006157aa4b47fbcfbc210b812507e9d4def462a3666c13c108a21ebcb7edeafc543817985b8f153c37e3fa2fb4030d117cd529e3641c4150784d95202837f4eef7768db623cd518c88060639030e4fdc7bd9fba0a8426f378af0070f33119b1019486e051fe55f0f17671773e51642b5d0ddb09cc9c5", 0xa2, 0xfffffffffffffffb}, {&(0x7f0000000180)="324048c56085d737a793f1f67560b637d4ab58763da5b7c2422a0615d7998a791fa8f3", 0x23, 0x800}], 0x10a0020, &(0x7f0000000200)={[{@nointegrity='nointegrity', 0x2c}, {@quota='quota', 0x2c}, {@gid={'gid', 0x3d, [0x78, 0x32, 0x0, 0x38]}, 0x2c}]}) getpriority(0x2, r0) 2018/04/13 16:41:35 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open(&(0x7f00007d5ff8)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000080)={0x0, 0x0, 0x1, [0x1]}, &(0x7f00000000c0)=0xa) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000100)={r1, 0x9}, &(0x7f0000000140)=0x8) lseek(r0, 0x3, 0x0) 2018/04/13 16:41:35 executing program 4: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000000c0)) r0 = getpgrp(0xffffffffffffffff) r1 = getpgid(0xffffffffffffffff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000400)='/dev/sequencer2\x00', 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x0, 0x0) r2 = syz_open_dev$sndtimer(&(0x7f00003aa000)='/dev/snd/timer\x00', 0x0, 0x0) getpgid(r0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0f85403, &(0x7f0000748f08)={{0x1, 0x0, 0x0, 0x3}, 0x0, 0x0, 'id0\x00', 'timer0\x00'}) r3 = msgget$private(0x0, 0x80) msgrcv(r3, &(0x7f0000000100)={0x0, ""/133}, 0x8d, 0x0, 0x2800) socket$pptp(0x18, 0x1, 0x2) r4 = syz_open_procfs(r1, &(0x7f00000009c0)='smaps\x00') r5 = syz_open_dev$urandom(&(0x7f0000000300)='/dev/urandom\x00', 0x0, 0x80000) getsockopt$bt_BT_POWER(r4, 0x112, 0x9, &(0x7f0000000200)=0x177, &(0x7f0000000240)=0x1) sendfile(r5, r4, &(0x7f0000000000), 0x7fffffff) [ 1032.415822] binder: 6953:6957 got transaction with invalid offsets ptr [ 1032.449268] binder: 6953:6957 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:35 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:35 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = open(&(0x7f0000000040)='/\x00', 0x6000, 0x72) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000100)={0x2, 'ipddp0\x00', 0x2}, 0x18) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000700)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x20000010}, 0xc, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2400000010000100000000000000000000000000", @ANYRES64=r2, @ANYBLOB="0180000014f3"], 0x3}, 0x1}, 0x0) unshare(0x8000) [ 1032.520521] binder: BINDER_SET_CONTEXT_MGR already set [ 1032.525975] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xf000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:35 executing program 6: r0 = inotify_init() ioctl$int_in(r0, 0x80000040044900, &(0x7f0000000240)) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x100, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x7fff}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000000c0)={r2, 0x2, 0x7, [0x0, 0x4, 0x5, 0x3, 0x800, 0x5, 0x3e6a]}, &(0x7f0000000100)=0x16) [ 1032.563320] binder: 6953:6957 ioctl 40046207 0 returned -16 [ 1032.576139] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:35 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffea], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:35 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x3b6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x5, 0x80b80) syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x1ff, 0x10000) pipe2(&(0x7f0000e3eff8)={0x0, 0x0}, 0x80000) dup2(r1, r0) 2018/04/13 16:41:35 executing program 4: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000500)="6e65742f74637000178d8d445967f69a0be8f96cd3283f5b90ad2cd2c1ea399ac737c60a32dc1374be1fff008d5cffc7b729c5a23ba9589869058aa3cedad0ba311afd9f405ed38282964f2a8dde286b854c1c256528a7caa5f88b1eca68008d328fc8e3795d3e57da1058b56678da98720ad238f9f9f8c67d7677b91661420c154bb7539f7c543eeae2f3d4b8c29b4ac70b4a3edefccb57bf644727038c3bbe89c3a39529c5e5c6a3c22ebdaaca51cbbaabcfaee291db4d8e6fc26dbc7c904735b0692e0b3154e471f506c77a439b7cd70d422f3046e7a52838a7b2049ca1c5aefc903fa0ba28387ff31cb4044da0f6cd78d2099d21599750fb70df4e8b07e156a5d1fa8cc5000642e6fe45469a1faf4c72d178e0fa304b08e716e888e88f3231477e56d3d1764436abd2f5740a2345f3427a1b81c910b52f0715ecd4d799e5dc58eebbf0ae605d18b29a388a4e4ec280faad1085566b95c67cd0bfbef5ce6dc0d6cdad59ca5eb795e64c0c4c99c262") mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) writev(r1, &(0x7f0000c4fff0)=[{&(0x7f00000000c0)='1', 0x1}], 0x1) 2018/04/13 16:41:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000006cd000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:35 executing program 0: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x101000) ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ca9000/0x1000)=nil, 0x1000, 0x800000300000d, 0x2011, r1, 0x80000000) 2018/04/13 16:41:35 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) vmsplice(r0, &(0x7f0000000340)=[{&(0x7f0000000040)="832d3c6c9b8609dc2c899f4d2fd7ea60be3832d9d711319248811a56a419569ca343e36d28241f5ac2f199", 0x2b}, {&(0x7f0000000140)="9aff3e1ced8039e3547810c0f8b54c8a5940a43e7f88786ba421d4be0f6b7f33bde3a08c040dd5fa3ee1109b1b651d86a1e2002d4d6d57013d8a8daab9f329c358f4bb6428bc5680ff72fef194138b1719d7a78a5bbaf031d47c1954813d9f957b9a8890636c0aaad05aff48762111ddfc2ee56ac7d8a915dbbf1734a0ad3c94ca50bca4b6cbecc1c2f859973a0ce846bee656a64385e29cf096d9fcd4f34a736fe8ab473b921edc47189870b55db8060c2f21169dbd04eb9881dd459c2d2399c802e14e716c82a29231f6843c1fa15f", 0xd0}, {&(0x7f0000000240)="b60eb57a938400a71b3c77d3466c9639f44f1b29efb71c58547660ae648ee515fee1a5cbc1ef962112efbc1f905f67dd50ca283b53f1f7e8f55da016efe046ac61464d239aaa79836fd631d77d132ba184da6139a3150ec54b99dbe1970ea3a948ebdc4cb9158966da4be76aa6aaee791ab2d6e1980e6b162eb159838e51bb8e06bc8b544ad1be4f4c556377d70836361f85647442f69165d7c6be20011dd7de456e2bf13cf652d606e8c6d8e46940a4afaa974aad9c60f64a2d05fd8186d9b4340a", 0xc2}], 0x3, 0x200000004) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_mcast\x00') bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) writev(r1, &(0x7f0000000480)=[{&(0x7f0000000380)="3bd0025de9860268106819f3b972b97ff25407e86852888ed16c66ec5099f0a7cb2eead9bfd9f75706a942b2bd6e74d04111fe11b64fe8d5631f7e7148f1bca1e2b4ef03c2b91286254b6147ae239bcd0bb9f649a30b4cf8d41c92a56e05ad47bb32f9e71a8004f5b01276b76e5de0a8be39f73f327e196eb9b012b6f0aae893ee7c6df3fa", 0x85}, {&(0x7f0000000440)="fe112f5724b116ced5291febf2d53929116ef80467811db623cb471caf5b663e0fbf018a1d5e96430abd2ec6d9204ac1", 0x30}], 0x2) getsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000000540), &(0x7f0000000580)=0x4) fchdir(r0) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendfile(r2, r1, &(0x7f0000000000)=0x2, 0x208) 2018/04/13 16:41:35 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x3000000, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1032.694105] binder: undelivered TRANSACTION_ERROR: 29201 [ 1032.781274] binder: 7001:7002 got transaction with invalid offsets ptr [ 1032.803434] binder: 7001:7002 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:35 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1032.834817] binder: BINDER_SET_CONTEXT_MGR already set [ 1032.843578] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1032.874316] binder: 7001:7002 ioctl 40046207 0 returned -16 2018/04/13 16:41:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x300, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:35 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000b15fc8)=ANY=[@ANYBLOB="ae0200000000e8fe0000000001000000000000070000000000000000000000000000000000000000000000000000000000"]) 2018/04/13 16:41:35 executing program 0: add_key(&(0x7f0000beeff8)='big_key\x00', &(0x7f000051effb)={0x73, 0x79, 0x7a}, &(0x7f00003bb000)="a1", 0x0, 0xfffffffffffffffd) r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') shmget$private(0x0, 0x2000, 0x100, &(0x7f0000ffc000/0x2000)=nil) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffff9c, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x32000}, 0xfffffffffffffee0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='\t\x00@\x00', @ANYRES16=r0, @ANYBLOB="01002cbd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) [ 1032.889633] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:35 executing program 6: r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) r1 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x1103}) r2 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x401, 0x0) setsockopt$netrom_NETROM_T4(r2, 0x103, 0x6, &(0x7f0000000040)=0x8000, 0x4) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f0000000100)=""/227) 2018/04/13 16:41:35 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:35 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x44033, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) connect$ax25(r0, &(0x7f0000000080)={0x3, {"d268ecdd2db9d7"}, 0x5d}, 0x10) ioctl$TCXONC(r0, 0x540a, 0x3) 2018/04/13 16:41:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000cb06000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:35 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xfc00, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 1033.026096] binder: undelivered TRANSACTION_ERROR: 29201 [ 1033.077568] binder: 7036:7037 got transaction with invalid offsets ptr 2018/04/13 16:41:35 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) fcntl$setown(r0, 0x8, r1) writev(r0, &(0x7f0000000000)=[{&(0x7f0000001f8d)="390000001300090468fe0000810000000700004003000000450001070000001419001a00040002000700005d20b412020000080001010c00f4", 0x39}], 0x1) socket$netlink(0x10, 0x3, 0x4) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2a0001, 0x0) ioctl$KDGKBDIACR(r2, 0x4b4a, &(0x7f00000000c0)=""/115) 2018/04/13 16:41:35 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1033.136763] binder: 7036:7037 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:36 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0xfec0, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:36 executing program 0: r0 = socket$nl_xfrm(0xa, 0x5, 0x84) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) getsockopt$bt_hci(r0, 0x84, 0x1, &(0x7f0000001200)=""/4096, &(0x7f0000000040)=0x1000) [ 1033.177236] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1033.209545] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:36 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:36 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000480)='\\,!\x00', 0x0) getpgid(0xffffffffffffffff) r1 = getpid() r2 = syz_open_procfs(r1, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') sendfile(r0, r2, &(0x7f0000000000), 0x401) [ 1033.249288] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1033.259945] binder: 7036:7037 ioctl 40046207 0 returned -16 2018/04/13 16:41:36 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x7, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:36 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:36 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="1a0096a0000000000000000000000000"]}) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000140), &(0x7f0000000100)=0xc) [ 1033.366220] binder_alloc: binder_alloc_mmap_handler: 7059 20000000-20001000 already mapped failed -16 2018/04/13 16:41:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1033.428608] binder: undelivered TRANSACTION_ERROR: 29201 [ 1033.479670] binder: 7081:7083 got transaction with invalid offsets ptr [ 1033.510642] binder: 7081:7083 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:36 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000b", 0x10) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000000040)={0x7, r0, 0x1}) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={r3, 0x200}, 0x8) r4 = semget(0x2, 0x6, 0x22) semctl$GETPID(r4, 0x3, 0xb, &(0x7f0000000240)=""/255) write(r1, &(0x7f0000000340)="791f7dfde0815c48c13197fc2e324deacdee8360e87bd43084d6d6437c203d5341837d777a928801bad3b40000000000", 0x30) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/13 16:41:36 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000001ab7300", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:36 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000ac9000)="290000002000190700003fffffffda060200008039e80001040000040d001400000000000000000001", 0x29}], 0x1) r1 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r1, &(0x7f0000007000)={0xa, 0x4e20}, 0x1c) connect$inet6(r1, &(0x7f0000012000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001100)={0x0}, &(0x7f0000001140)=0xc) getpriority(0x1, r2) setsockopt$inet6_int(r1, 0x29, 0x43, &(0x7f0000000080)=0x9, 0x4) recvmsg(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f0000000000)=@generic, 0x6f74, &(0x7f00000010c0)=[{&(0x7f00000000c0)=""/4096, 0xffe4}], 0x3b5, &(0x7f0000000000)=""/115, 0x73}, 0x0) sendmsg(r1, &(0x7f0000001980)={0x0, 0xfffffffffffffdf5, &(0x7f0000000080), 0x111}, 0x0) sendmsg(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000014c0)=[{&(0x7f00000039c0)='\a', 0x1}], 0x1, &(0x7f00000049c0)}, 0x0) 2018/04/13 16:41:36 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:36 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x9004, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:36 executing program 6: signalfd(0xffffffffffffffff, &(0x7f0000000040), 0x8) perf_event_open(&(0x7f0000fdef88)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x0, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000180)={{0x5, 0x1, 0x40, 0x8, "5167fe01c35205033ea8432c0998e03d0f3e8347a49ebdb2f3c429dbdf823bf0307c7c5220782c7c66216b6a", 0x7}, 0x0, 0x0, 0x9, r1, 0x6, 0x57bf, "a6baec590c6c7bf69d769d52554599ea3502a52423793739a29ad4b241f917d76fb121b9a5411c89c32dd2cdb5d6d9b1f1eeac63ff00c8c94bf7674963489535", &(0x7f0000000140)='systemposix_acl_accessvmnet1wlan1\'userself&\x00', 0x2c, [], [0xec6e, 0x5, 0x1ff]}) socket$rds(0x15, 0x5, 0x0) pselect6(0x21, &(0x7f00000abfc0)={0x3ffffd}, &(0x7f0000f08fc0), &(0x7f0000086000), &(0x7f0000b16ff8)={0x0, 0x989680}, &(0x7f0000d0a000)={&(0x7f00001da000), 0x6}) 2018/04/13 16:41:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000080000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:36 executing program 4: recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000100)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)=""/11, 0xb}], 0x1, &(0x7f0000000200)=""/113, 0x71, 0x200}, 0x20) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000300)='fou\x00') sendmsg$FOU_CMD_DEL(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r1, 0x0, 0x70bd29, 0x25dfdbfd, {0x2}, [@FOU_ATTR_IPPROTO={0x8, 0x3, 0x6f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000400)='/dev/hwrng\x00', 0x101000, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000440)) clock_gettime(0x4, &(0x7f0000000040)={0x0}) setitimer(0x1, &(0x7f0000000080)={{0x77359400}, {r3}}, &(0x7f00000000c0)) clock_gettime(0x0, &(0x7f0000001000)={0x0, 0x0}) symlink(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='./file0\x00') setitimer(0x1, &(0x7f0000000000)={{}, {0x0, r4/1000+10000}}, 0x0) [ 1033.548527] binder: BINDER_SET_CONTEXT_MGR already set [ 1033.558408] binder: 7081:7083 ioctl 40046207 0 returned -16 [ 1033.578589] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:36 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1033.638357] binder: 7102:7104 got transaction with invalid offsets ptr [ 1033.652741] binder: 7102:7104 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:36 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x34000, @loopback={0x0, 0x1}}, 0x1c) [ 1033.701928] binder: BINDER_SET_CONTEXT_MGR already set [ 1033.728615] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1033.742448] binder: 7102:7104 ioctl 40046207 0 returned -16 [ 1033.796294] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1033.836191] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:37 executing program 2: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f000045fff8)={0x0, 0x0}) write$binfmt_script(r0, &(0x7f0000000080)={'#! ', './file0', [{0x20}, {0x20}, {0x20}, {0x20, '('}, {0x20, 'ppp1('}], 0xa, "ae309760c9f53c91c05337146bb58fca9d"}, 0x27) timer_create(0x0, &(0x7f0000000000)={0x0, 0x0, 0x4, @tid=r1}, &(0x7f0000000040)) 2018/04/13 16:41:37 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0xff) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@loopback=0x7f000001, @in=@remote={0xac, 0x14, 0x14, 0xbb}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3}, {0x1f}}, {{@in6=@local={0xfe, 0x80, [], 0xaa}, 0x4d3, 0xff}, 0x0, @in=@dev={0xac, 0x14, 0x14}, 0x0, 0x0, 0x0, 0x1}}, 0xe8) r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x2, 0x408002) ioctl$DRM_IOCTL_SET_MASTER(r1, 0x641e) perf_event_open(&(0x7f0000348f88)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpeername$inet(r1, &(0x7f0000000080)={0x0, 0x0, @multicast1}, &(0x7f00000000c0)=0x10) close(r0) 2018/04/13 16:41:37 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:37 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00003f1fa8)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) r1 = syz_open_dev$amidi(&(0x7f0000000240)='/dev/amidi#\x00', 0x7ff, 0x41c100) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000280)="bab9878f95bf6cf08f4233") setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00006a9fef)="e5fcb5bf", 0x4) sendmsg$nl_route(r1, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@getstats={0x14, 0x5e, 0x22, 0x70bd25, 0x25dfdbfe, {}, ["", ""]}, 0x14}, 0x1}, 0x800) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, &(0x7f0000000040)="ba2000ed66b9800000c00f326635000400000f3066b9200000400f32f0f7950020baf80c66b8740cf28666efbafc0cec66b8050000000f23c00f21f8663500000e000f23f8b81e0b8ec00fc79f0d00f20f7dc966b97e0b000066b84a00000066ba000000000f30", 0x67}], 0x1, 0x0, &(0x7f0000000140), 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x100000000, 0x20080) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000440)={0x9, &(0x7f00000003c0)=[{0x3, 0x2b03, 0x81}, {0x1f, 0x1, 0x1ff, 0x418}, {0x5, 0x100000000, 0xfffffffffffffff7, 0x81}, {0x8, 0x5, 0xffffffff}, {0x200, 0x6, 0x4, 0x1}, {0x9, 0x0, 0xffff, 0x101}, {0x0, 0x5, 0x3, 0x7}, {0x6, 0x2, 0x1, 0x78df9eb7}, {0xe053, 0xfc13, 0x8, 0x6}]}) getsockname$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0x14) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000200)={r3, 0x1, 0x6, @random="967d8a3df4c5"}, 0x10) r4 = accept$alg(r0, 0x0, 0x0) sendmmsg(r4, &(0x7f0000003500)=[{{&(0x7f0000000180)=@pptp={0x18, 0x2, {0x0, @loopback=0x7f000001}}, 0x20}}, {{0x0, 0x0, &(0x7f00000004c0), 0x0, &(0x7f0000000040)=[{0x10}], 0x344}}], 0x2, 0x0) 2018/04/13 16:41:37 executing program 4: socketpair$inet_icmp(0x2, 0x2, 0x1, &(0x7f0000000800)) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x400000) fsetxattr(r1, &(0x7f00000000c0)=@known='security.capability\x00', &(0x7f0000505000)="0000000201000000000000010400000000000000", 0x14, 0x0) r2 = accept4$inet(0xffffffffffffff9c, 0x0, &(0x7f00000000c0), 0x80000) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000008c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="98000000651b13f8f9495d9bf41248204dc8af503b3ba8679dd6092f74ffff3a8e207c2976d065c5d701235d0100010000000000a9b2c4ae6d13d67ec55af995fb10c0e89c679764cddb2f21c9718b94703e87bf1451170291f4f005c4566d1313adcae9d7c170eefc35d91bb40134df09ed3b7dbc13d4ba5ea9c2933448e86b0211c13a33834f2c0100becf744225b4f773caaa540c2bbd1a1d70790b6dac1d6db6f2eb672913562bea63d0acfc0b72f990e72776b7b0cded8b6b667d6126375e5c93168d2bb0aa418d2f5dad2555dd1f9a5cb0935454b87a0dc44ada9d6367a6e7f5f111974659dd29fae7e2e8621d3f30635ac16b7f4d2d1c10607368ff82be8495d71be12ef25d32924e9eaa3a5583400a1bbb2d43fd00a42c7ddade47ae8ccd01b9b974472660dfe1a7efe3c273a89dfa6d5b61fa27c4b019e4e104fcfa14fc53a9c9f5da7423ddb55c2c5045dc4f67a91c4eba94a9a2cc9fdb609490c7887dda0ca8f98c5573f7a9492516b1c4685d"], &(0x7f0000000200)=0x2) socketpair(0xa, 0x3, 0x5, &(0x7f0000000cc0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f0000000400)=@sack_info={0x0, 0x1f, 0x20}, &(0x7f00000005c0)=0xc) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r5, 0x84, 0x1a, &(0x7f0000000600)=ANY=[@ANYRES32=r6, @ANYBLOB="340000009e97353b13b119b928b4f48219c66eb3e682cfab5b85564c0ebbe00c876955763ca65432e847bbe5b1c86dc1ca71ec0eec000000"], &(0x7f0000000640)=0x2) ioctl$DRM_IOCTL_ADD_CTX(r4, 0xc0086420, &(0x7f0000000d40)={0x0}) ioctl$EVIOCGEFFECTS(r5, 0x80044584, &(0x7f00000006c0)) ioctl$DRM_IOCTL_SET_SAREA_CTX(r2, 0x4010641c, &(0x7f0000000700)={r7, &(0x7f0000000c40)=""/97}) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000480)={r3, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x10}}}, 0x1, 0x7ff}, 0x90) r8 = semget$private(0x0, 0x2, 0x0) semtimedop(r8, &(0x7f0000000280)=[{0x3, 0x20, 0x1000}, {0x3, 0x0, 0x1000}, {0x0, 0x6, 0x1800}, {0x0, 0xd50, 0x1000}, {0x3, 0x8, 0x800}, {0x3, 0x80}], 0x6, &(0x7f00000002c0)={0x0, 0x1c9c380}) sendfile(r0, 0xffffffffffffff9c, &(0x7f0000000180), 0x4) r9 = accept(r0, &(0x7f0000000840)=@alg, &(0x7f00000003c0)=0x80) sendto$ipx(r1, &(0x7f0000000f80)="662df4a093cdd7b35ff6ae42cd7d4c930c1fea26aee3a47d99eb39c72fb76601dc87206d4eb86e00240f2194fa63c4e57a634a03fbc5a09ef3dcfb35ce84046ec80043aad86ba46f2e3bf4f8838948f37ed11548ce4f4d249f8e3912a1b49e92bb082095f69cb2974e5d54bc7cdf14f0c138b637244cd363fc8e20a4de869312929d4495a96fbe658e986e39a70a08c4f2daf1f7a6bc674c43e7816b75647e7b3e15b87930acbf11fbc1361b20aad2c7976e75fb95f260fdcd74a0e9d55015cdcb8b1827680bc83c963241c40045a7176d98d43be1a066289869e0", 0xdb, 0x4000000, 0x0, 0x0) setsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000340)="f6fa4b79ba6f6c4c5323e2af43013ecee5c86b06eeb23ef53a19c375a5f79c47658a554390c336a7455599d8f112c413f52eec22356dd4871dd874ff3eeb849bf7f48b056e1ccdd135800a9abba99cc4db4e02cfaac519c0bc3587121524814260ae93745387f031b19f289b21e0", 0x6e) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000001080)=ANY=[@ANYRES32, @ANYBLOB="ae000000b4c3543505ac61941d1496bbfb006e5751d3eb237a3ce177e53df41dd39937afb83181651220f090cbbb8b0c6ed9f1eecd008db6ba7c45e6db877c1cc87536d95a8f7864e2ffff000026f2a4f0fc1d77929cb7856c42244d8f4396fffbffff3b00ec064d80e6df5826d1fc5840239474a49583a14bbbbe023c756162eb5c3b907651dbd2f736165e62aecff4ea08198af1bd7991c956a675aa78dd3d6435d09fe8370a8bb1eaf4184c403ab65b565f44bc825f6fae8894087e59ec7257838bf00ac21a6691b680d49595c07ba5776bf9b51105001e49b64e372deb3bdaea342102895267bc07ea204d01d9cd29c2773220064766639c0ee13e6553db924ba4223103c9a9fa37b4c3d4ad81220821bad72ef703d5a61c766285fdffdcfc84f140e79803b199613fb2cd37669b8d7c4ac68e51532b2d96b0be02bd6b7f85a54179c6649859e7f9faefda828ae8b3f1d2ee8b94ce916b1214b206f90ece27074b5e865b1f31e407c26f9baba042cfc7255972a63c041522cb54acda0bd36376a032f2783b5569c8720d89f511d4a31d068f9b13c65a7a92005cd8ba830e7049bf9b6b5d5b0d00f5b08a8a9dcb2753006a491521d68a7a62505337b72be2a41b76f580b25e438e7d9dd1a3fed2e08211595d6751991e6c82822480003b51b4ec360aff88d3c2c8b4e83fa6632bf043870000001a6e6800000000000000000000006b6688250cefc079242a960e77e2e8f58fd633976182b8092d50b2d72fc0a2fc2993dcb1cb4a751215e2a11eb324b085333c68d5fabbff5a8bfbc0bbdebd27cc18d1458c7da4976247f372ec0c639b2b2ae23003ba7bb5fcf8326bf1ca6e7c75ecd4eef39ac6ac3b60a16fb9e4f960cc205d047279d756b36f5b710f13000792cbec7b43a9e95431f53e59412eeb8150503844a0de577ebea5eb2262c6750983ff9b51085ce8b2814e990fbbd3ece725af53fb3d3cbb6804f72f0fb743850c3ea0f88fa6b56bd2f335eabb06937a73f0b9d86022c217fd121e10466efdd74e8d43a80ee9fdeba051620017dada233bc869c7e06d666a64f5bdeafb390aad25eddd8848fbd95625b9f843349d88c3bb87428617305c49adb1134968ef2e8558f0c1d7db39871062462df5d9b87d96e3c914e9dbef5d07fce11cc57e485d114e86e76563c72b4f8aa4456ee2373b6ff6f4bad265761b25672ac9439ec19b4bac6fbcd69f9d47275d0194988ff86e69a53065fdd4"], &(0x7f0000000040)=0x2) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000003c0)=ANY=[], &(0x7f0000000240)) r10 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000540)=@broute={'broute\x00', 0x20, 0x6, 0x446, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000a80], 0x0, &(0x7f0000000300), &(0x7f0000001b00)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff02000000190000000800000089146970365f7674693000000000000000006272696467653000000000000000000079616d30e9ff0000000000000000000069705f76746930000000000000000000aaaaaaaaaaaaffffff00ff00aaaaaaaaaabbffff00ffff0000007000000070000000a80000006d61726b000000000000000000000000000000000000000000000000000000001000000000000000d0ffffff00000000feffffff00000000110000001c000000020173797a6b616c6c65723100000000000000000000000000000000000000000000626f6e64300000000000000000000000677265300000000000000000000000005f8e8e51489f0000000000005dbd189918d0ffff00ffff0000007000000070000000a8000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffd945c77f11e55ac76560d8e2c557a6ffffff010000000500000010000000886c6966623000000000000000000000000064756dd8c30059121683aa007ac1cc419c6d79300000000000000000000073797a5f74756e00000000000000100069726c616e300000000000000065e6d2bdd65be4c517ffffffffffff77d27bbe39eaff00ffff00ff00007000000070000000a0000000434c4153534946590000000000000000000000000000000000000000000000000800000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000ffffffff010000001900000014000000ed5e6270713000000000000000000000000073797a5f74756e00000000000000000073797a5f74756e00000000000000000069703667726530000000000000000000aaaaaaaaaa0dffff000000ffaaaaaaaaaa14ff00ff0000ff0000d0000000d00000000001000061727000000000000000000000000000000000000000000000000000000000003800000000000000000088f7000400000000000000000000ac1414bbffffffffaaaaaaaaaa1aff0000ffffff24f1bea10306ffffffff00ff060400000000000041554449540000000000000000000000000000000000000000000000000000000800000000000000010000000000000002413954ab79a2169faca0f2eaeed0489153a98bd6a75fbc28e0564968a413fd98df731b5a14e5b436a1927baccc07e18c4bd66cee41148a92658ba0bed1aa1e73cb44afac0162cc782a807bdfe2ab29596575c723b5d7f2aea5aced46a28e8e5f7f6c604ac185cfb056f372c6f8d9b5e8c97d2bf9f49f2401815989e4939c88cfb8284462adf3c12de74907dde60304a237c11038dcd4ec106b0f9275ff5247bf63b1d4c7751d6e4c"]}, 0x4be) ioctl$sock_inet_SIOCGIFBRDADDR(r9, 0x8919, &(0x7f0000000140)={'teql0\x00', {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}}) bind$inet(r10, &(0x7f00001edff0)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) syz_emit_ethernet(0x1, &(0x7f0000000b00)=ANY=[@ANYBLOB="aaaa3ea920eb1faaaaaaaa00000000000008004500001c0000007300119078ac2334dbf77dee8d11a7518f6fa3fd2b726d5bd3f5197943178a8f27b6674a810b591cb8be19596dffe7647b5da686d2cbc3d4a283c37ce70d9bdff9174de81289e45cb2453c841540383d20dc658a1ec8bd2aaeadc0c84e903c50909c86207ae4faf34d016b6befd75183428d52735c2ab0ffafd800c584301734710f5169ab792f1cd4fcd037fd2ddb0004"], &(0x7f00000000c0)) setsockopt$inet_dccp_int(r2, 0x21, 0x800000000000004, &(0x7f0000000100)=0x1ff, 0x2db) setsockopt$inet6_buf(r0, 0x29, 0xca, &(0x7f00000001c0)="3ec20182afe92359c5c8acdc796328457be6e9", 0x13) setsockopt$inet6_int(r0, 0x29, 0xc8, &(0x7f0000000000), 0x4) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000440)={0x6, 0x1, 0x9, 0x4, 0xcb0b}, 0xc) close(r0) 2018/04/13 16:41:37 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xfc, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:37 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000007fffffe00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1034.494697] binder: 7130:7132 got transaction with invalid offsets ptr 2018/04/13 16:41:37 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:37 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x100000000000000, @loopback={0x0, 0x1}}, 0x1c) [ 1034.543988] binder: 7130:7132 transaction failed 29201/-14, size 40-8 line 2991 [ 1034.565569] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:37 executing program 2: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x11da82, 0x0) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000040)={'bpq0\x00', 0x4}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000100)=0xc1a) r1 = socket(0x1e, 0x1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000080)) getsockopt(r1, 0x10f, 0x0, &(0x7f0000003fb3)=""/4, &(0x7f0000000ffc)=0x4) ioctl$VHOST_GET_VRING_ENDIAN(r1, 0x4008af14, &(0x7f00000000c0)={0x0, 0x410}) [ 1034.592205] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:37 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:37 executing program 6: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x1, &(0x7f0000001fe8)=ANY=[@ANYBLOB="e92be2b31eac75c34f"], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000001fd8)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x25}, [@ldst={0x7}], {0x95}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x437, &(0x7f000000cf3d)=""/195}, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) write(0xffffffffffffffff, &(0x7f00000005c0)="260000005e0009000000eaf83a0000000000000001000000ffffff000008db1ee9ff4435eade", 0x26) 2018/04/13 16:41:37 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x2001001000000000, @loopback={0x0, 0x1}}, 0x1c) [ 1034.643410] binder: 7130:7132 ioctl 40046207 0 returned -16 [ 1034.666543] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:37 executing program 0: mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000040)={0x80, 0x8bb, 0x4, 0x5, 0x8000, 0x9, 0x1e, 0x2, 0x401, 0x100, 0x9, 0x6}) mlock2(&(0x7f0000898000/0x4000)=nil, 0x4000, 0x1) keyctl$dh_compute(0x17, &(0x7f0000000340), &(0x7f0000000380)=""/23, 0x17, &(0x7f0000000500)={&(0x7f00000003c0)={'sm3-generic\x00'}, &(0x7f0000000400)}) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000080)={0x32, @multicast2=0xe0000002, 0x4e20, 0x9, 'rr\x00', 0x2, 0x2, 0x53}, 0x2c) mlock2(&(0x7f0000788000/0x4000)=nil, 0x4000, 0x0) 2018/04/13 16:41:37 executing program 2: r0 = socket$inet6(0xa, 0x80003, 0xef) ioctl$sock_proto_private(r0, 0x89e0, &(0x7f0000000000)) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000080)=0x68) [ 1034.749191] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:37 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:37 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000e4ffffff00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:37 executing program 4: r0 = socket$nl_xfrm(0x11, 0x3, 0x6) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000040)={{{@in=@dev, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x4480, 0x0) socket$bt_bnep(0x1f, 0x3, 0x4) write$fuse(r2, &(0x7f00000001c0)={0x14, 0x1, 0x2, @fuse_poll_out={0x80000000}}, 0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x89b0, &(0x7f0000000000)={"6272696467653050000000e4a0938700", r1}) 2018/04/13 16:41:37 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x7000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:37 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/arp\x00') socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$tun(&(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x3}) socket$inet_icmp(0x2, 0x2, 0x1) pread64(r0, &(0x7f0000000040)=""/8, 0x8, 0x1ffff) r2 = memfd_create(&(0x7f000088f000)='b\n\x00', 0x4) ftruncate(r2, 0x1ffffd) write$cgroup_int(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="d9fccf5a20"], 0x8) 2018/04/13 16:41:37 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000000)={0x3f, @broadcast=0xffffffff, 0x4e21, 0x1, 'wlc\x00', 0x4, 0x7, 0x4e}, 0x2c) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in6={{0xa, 0x0, 0x0, @dev={0xfe, 0x80}}}, 0x0, 0xfffffffffffffff8}}, &(0x7f0000000140)=0xb0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000100)=[@in6={0xa, 0x0, 0xffff, @dev={0xfe, 0x80}}], 0x1c) setsockopt$inet_buf(r0, 0x0, 0x60, &(0x7f00000000c0), 0x0) 2018/04/13 16:41:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000c93000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x9, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e630c4000000000ca"], 0x0, 0x0, &(0x7f0000000f4d)}) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f000000cf68)=[@enter_looper={0x630c}], 0x1, 0x0, &(0x7f0000008f37)="c2"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012fd0)={0xc, 0x0, &(0x7f0000007000)=[@dead_binder_done={0x40086310}], 0x0, 0x0, &(0x7f0000012000)}) [ 1034.913335] binder: 7191:7193 got transaction with invalid offsets ptr [ 1034.946704] binder: 7191:7193 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:37 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1034.974257] binder: BINDER_SET_CONTEXT_MGR already set [ 1034.987118] binder: 7194:7202 ioctl 40046207 0 returned -16 [ 1034.993967] binder: BINDER_SET_CONTEXT_MGR already set [ 1035.000933] binder: 7191:7193 ioctl 40046207 0 returned -16 [ 1035.005629] IPVS: set_ctl: invalid protocol: 63 255.255.255.255:20001 wlc [ 1035.010106] binder: 7202 RLIMIT_NICE not set 2018/04/13 16:41:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000003000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:37 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x400300, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:37 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x40, 0x20a41) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2040000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)={0x124, 0x13, 0xa, 0x0, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x1}, [@nested={0xc, 0x3c, [@typed={0x8, 0x86, @pid}]}, @generic="983b416eb996a69b774efdec3160e77ef06456ebbbc799d08e000fc290b1488e484b35a05779d8a7a5afc2252fc5309825ef32148f0c461e5ce542d739e4e017ddbb173ae0ff2ce9bf55831961d7e310b9e806d7b0a90f84d107841e9414127cb49ee4a15b15af4db68f7ad569fa4392e79c85523bd62cc72847407b9929883a506c5aefd55b4c47a3e86e951bb1e82c99def24537da3de304f152d845f6ae9626e8efd2c11b34f6536938faa4fe9f31ac5791f06fbdb6980481a8108d2182622391d727b03640b631eb40ad7eb778d994fb3b436d1a4234205948391bcb4723bfbd5e0cd67f56ec7d93282af9216446375fdef39bfccfb0", @generic="936fd2a7dde4c89bbb3a"]}, 0x124}, 0x1, 0x0, 0x0, 0x4044000}, 0x40000) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@mcast2, @in=@remote}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000180)=0xe8) r1 = memfd_create(&(0x7f00000001c0)="0608000008847f00", 0x0) write(r1, &(0x7f0000ffdffb)='#', 0x1) perf_event_open(&(0x7f0000220000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) execveat(r1, &(0x7f0000ff7000)='./file0\x00', &(0x7f0000d0e000), &(0x7f000034bff8)=[&(0x7f0000ff7000)="00000000000000060804002000fffc0c6565643b799365005f1b76"], 0x1000) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000440)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000480)=@assoc_id=r2, &(0x7f00000004c0)=0x4) [ 1035.034498] binder: undelivered TRANSACTION_ERROR: 29201 [ 1035.044443] binder: 7194:7202 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1035.052584] x_tables: duplicate underflow at hook 4 [ 1035.062933] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1035.072785] IPVS: set_ctl: invalid protocol: 63 255.255.255.255:20001 wlc [ 1035.093200] binder: 7206:7209 got transaction with invalid offsets ptr [ 1035.101521] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:37 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:37 executing program 4: r0 = socket$inet6(0xa, 0x2100000000000002, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x4005}, 0x1c) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x32, &(0x7f0000000100)=@filter={"66696c74657200000000000000000000054000", 0xe, 0x4, 0x348, 0xffffffff, 0x208, 0x208, 0x130, 0xffffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, &(0x7f0000000080), {[{{@ipv6={@mcast1={0xff, 0x1, [], 0x1}, @ipv4={[], [0xff, 0xff], @rand_addr}, [], [], 'irlan0\x00', 'eql\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00'}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3a8) sysfs$1(0x1, &(0x7f0000000580)='CONNMARK\x00') r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x2000, 0x0) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000040), &(0x7f0000000540)=0xc) [ 1035.135618] x_tables: duplicate underflow at hook 4 [ 1035.141606] binder: 7206:7209 transaction failed 29201/-14, size 40-8 line 2991 [ 1035.149302] binder: 7194:7202 ioctl 40046207 0 returned -16 [ 1035.157177] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1035.157569] binder: 7194:7202 tried to acquire reference to desc 0, got 1 instead [ 1035.173818] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:37 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000000ffffffe400", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:38 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x20010010, @loopback={0x0, 0x1}}, 0x1c) [ 1035.194623] binder: 7206:7209 ioctl 40046207 0 returned -16 [ 1035.275566] binder: 7194:7202 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1035.278441] binder: 7194:7222 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1035.295769] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1035.334629] binder: undelivered TRANSACTION_ERROR: 29201 [ 1035.342545] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1035.365161] binder: 7212 RLIMIT_NICE not set 2018/04/13 16:41:38 executing program 6: r0 = socket(0x40000000015, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001000)={'syz_tun\x00', &(0x7f0000000fc0)=ANY=[@ANYBLOB='A\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00']}) 2018/04/13 16:41:38 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:38 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x900, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:38 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe2(&(0x7f0000e3eff8)={0x0, 0x0}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, &(0x7f0000000240)="370f32ba2000b001ee0f01c9baf80c66b810813a8e66efbafc0ced66b8010000000f01c1360f01cf670f200766b9800000c00f326635010000000f30673e662e660cee", 0x43}], 0x1, 0x0, &(0x7f0000000080), 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r5 = dup3(r4, r3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000decfe0)={0x10005, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f00000002c0)="b832000f00d867f466b8400000000f23d80f21f86635800000a00f23f86467660f3a410e07ba200066b802d3a45a66efd1a65900b84d000f00d0e63d0f01c96766c744240084ad21706766c744240235bc00006766c744240600000000670f011424", 0x62}], 0x1, 0x0, &(0x7f0000000140)=[@cr0={0x0, 0x40000000}], 0x1) getsockopt$bt_hci(r3, 0x0, 0xb569acdff09da2ab, &(0x7f0000000040)=""/14, &(0x7f00000001c0)=0xe) ioctl$KVM_SMI(r4, 0xaeb7) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000200)={0x80, 0xfffffffffffffffb, 0x8000, 0x7, 0x1, 0x3f, 0x7, 0x4, 0x0}, &(0x7f00000003c0)=0x20) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000000400)={r6, 0x66, 0x2, [0x4, 0x100000000]}, 0xc) ioctl$KVM_RUN(r4, 0xae80, 0x0) arch_prctl(0x0, &(0x7f0000000100)="6c254dfaef0faa") syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, &(0x7f0000000340)="b809008ed0360f017801440f20c0663502000000440f22c0baa000b80000efbaf80c66b8e679618b66efbafc0cecba2000ed332ab8bd000f00d066b95e0a000066b80080000066ba000000000f3065643666dec5"}], 0xf6, 0x0, &(0x7f0000000240), 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2018/04/13 16:41:38 executing program 0: r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000df8fd9)="2600000022004701050007008980e8ff06006d20002b1f00c0e9ff094a51f10101c7033500b0", 0x26) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000330000)=0xfec, 0x4) sendto(r0, &(0x7f0000cfefee)="120000001200e7ff00ffe90009144a000ae9", 0x12, 0x0, 0x0, 0x0) accept4$inet6(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, @ipv4={[], [], @local}}, &(0x7f0000000040)=0x1c, 0x800) recvmsg(r0, &(0x7f0000fa3000)={&(0x7f0000d0b000)=@ax25, 0x10, &(0x7f00002e6f80), 0x0, &(0x7f0000878000)}, 0x0) 2018/04/13 16:41:38 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000000000000000200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:38 executing program 2: nanosleep(&(0x7f0000000200)={0x77359400}, &(0x7f0000000240)) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000900)='/dev/audio\x00', 0x8000, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, &(0x7f0000000080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndtimer(&(0x7f0000471000)='/dev/snd/timer\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6}}, &(0x7f00000001c0)=0xe8) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f0000000440)={0xce3, 0x0, 'client1\x00', 0x0, "ddde1508b55cf5fd", "c1b2758dcf885f9a683e1e0da3c586bb53bd03ec4d2700e7f7d4822aa0013e3d", 0xf41b}) getresgid(&(0x7f0000000380)=0x0, &(0x7f00000003c0), &(0x7f0000000400)) fchown(r2, r3, r4) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000001000)={{0x100000001}}) syz_mount_image$hfsplus(&(0x7f0000000500)='hfsplus\x00', &(0x7f0000000540)='./file0\x00', 0x4000, 0x5, &(0x7f0000000800)=[{&(0x7f0000001040)="560314ee5ce11a3cbc14e2423ab67d41f26234cc5cca7b2ec32602d9000ad092eeea1e81cc0bcb81a4592d307c7b73c7fe9c20f76dad1904ffc0247acb8cc5202c124b3b7d0320eb0144b99c6f69e2df6873ad4b239da0099b31e1545bc6256f8c27189a61ab4e86f8e1fc939ea551715aaf21488b854153de5b978e20610692268e42c483b31f54fac1ac48f8e9d4219637b50fdeb7655895cc765af15e5549c3ca26cfac0dc031947600b7ce351cbd34fdf7bb043eb0c67b99a180c5e2676680e0b8f533e31ddfd39beabdee5f3e41322b09c1d9714899d67ed79802177ca7f5185802b7ca847380c7a66bbdc995c44666ef89e16b920470d832062400c10346acba38ee03b7324ced3a25e14e5467ceddf007ecd7fdb1015accba1c3685d8622433b1f93682be08f03366cd64a5cb622a1066f42d4ed9b612ab7ef5678e654756c1fddeeefc6882c1e473a7ec02c62cf6e176ec078bd47cd0f2209ec70ce46fa48e00918d58a48ce384f30d4227f48b57fb9ab5ad1701ea1e9ed585a887808add6b30e5393cb6f5ccff2bb370112d81ad3aa4ba37c09e12ca6e6a82e50a6ce9edb974a3a10885443e04d49a65521aaf00be72718c7c2e0614e8739e424a75fcd8dea7af6d247cf23dad997ae756c6a0339dc56fa60821effe467f5e9a2c766ce50a35421c18fd5169c8deb3fa9f318b79d297bbf9af2fbd038fdb9daa9aa9430ebf24401bc7945a2b7cfcde47967255c88a984ef7b9132849171df2a300caf49d664fa155161bbfa42052766ff489c4b04c3398f00a05e8a8f272a399a64103df5000af607b5e5889a37068cb8c8a606e4746950376da67173edd73bcf858ca41e53d57074347e85e122cd71c09ff47a370eaca0dbb1bcb8ebd85feded515deaad9c8a5812ebc5b174e1b51f970861dabd5d9deff3e3b761a47cbb779913e40cce8b8a7da23c2e2cc66ded465c473e09638dd1144aba3b726935f9bc0d4df41c89a201dbf12750f02a88619efb4a4251d216a2cf0c003d789cbcdfa81797d54e2f820788efa02e39c473e6832bcc3ad21f4e9eca874aecac7c3ba3c094463fcb1497fa47c2a43a5bebb5d11b967cfa73bcac363f0e2422dfbab42de46ad17520dbdbd7c6cd68cae1306057d31e433f5fe5f3fc0e9eeec9a973d2269f316eaa11db303fd1d638acc8f13af3b395eeca8f369316b4265ec368a90c77129cfd3371aa7364a4c36c2c8a13d202bc823c735ba48d21555b844a2b5192e635cf46c247a5569214dcbc30cfef58aeaa4a93840ee11cef5f35ae4ce06954482df5eb8dcdea8b3c7da68c1fd5a8deeb7b93fbd352143d4c033ae9f93d5ec04a6e14934186e96ca6a69e938863c1aa0a2c3b560363d6250cd35c1fc93aed82e2fa0703e82904d06a469a7b6cfd7b47f3e0caffa2a8f87b258382c0dcc5107ca23739fa5b06696988af42db9ecce9c5e208f23f363ba23ba0c21aa30588d3159a05b2f64a885e27931886cd47fda952629340c4d4befd22c64848dc68bf49265a0a9a750180033a25cd9e73f566375f01c0925a16374b46efcad4c218e5b6ab15ad5e2a1fa6717a94d33d6bf17b3866e0f079b249bc1b3f52e035f5f0bdfbf30c32b9318649c0ae9272b7178e9c207909e58e5b81c70adee5a2b52b46cfe70982390e5ad1791efc02e7152b26e7177fe0f0f6abf2624253db73eb4cfd93c3801aaaf120aff1a5f9adb037b97fea602c420afe191d7885960d82685b4c643c1187f78d9930b0f0508d1fbf11c13e2ca2a279f268de957692b06e2a41ed117a26bf8cf4bf0c713482f8d7bfb0fd9322fdc2fe8e77f3be943a8dd3698e4e07f2e381ef46e65bbfeda417a1e96ba3301144a4854ff5481c9ef0f6af28b445d4ba890a8a3b2613043104abb5f867163d233fb985c6d54720de91f4bd087b107191eb2fa606c2253acf458ea27f1f2df49b97c6bc2a589dcc52b7b9a307503bbc3f565b5bd1fed31587f306204900e7212e53c61a75f8816c4dbcbd315170b1026e47184b54286d6cf74ab0bbdb61e4380aeabd2827c8ea081c35a02935e893dfe39e827dee2a2dacd5a6f8aed017c71165c64cacd7648c547ec74f094481d4d17d56520151b050c2df27aaea4e991b2bbceabbd29b11a821cddfbfc2be0c023a9264c0a8657036c910b31066ea4a2785f055925388d80120ae808623c1b8ee4c637d6bd781cffedd2b4ad12c66e1f20fa20d1fbd355a4a21e4ea8773b1b2a690b2f43ebb99282e5cfd0947811a95b1b12cbe69d589edcf1b8f56983e86c53c26a9c566f37021eba09a57414788a7380a4783e411d54d0dc766700799558497f10a259d79b264d0fbf3e5c040604f5de50ea1f99c20a6add0485e3b4efcb1b03057886e608f87789496638a4bb556d6f8617017ba956a5fb8a3e715857df447aae310881b42377f5b82a108ed952753cc46d48f0c3037d638ec38972ea4c0c5c30471f905de6dbe4d031139f610d32e054a873bd06ce3876ba1b4ca60059568f2254f23ca3d6c9ab72dd0c6d4ede4f319aa8365c74457e2791cfc26fbb3e7ddeb160b00937438c9a71a4c40cded31935e78a58859f0af48847338cd3977a3563e2139f4ad46761b4a8261fa468582f0c333656e312467cd94efbd6771d2f7a72bd7ec4b6e84865f03ae782e57ff74585f247cb3e56b63e07feb182aaad5d6bf3afdc9733af8210ceb7b8e11e104f8b4b945beaadd7efa816ffcea84e904b624187e192c24b243badee4f40423b612eee360010e3535d6b847269b1092c6d5c878d381162e8cbaa52efe329994a4abe8e342a9cca263e003c2034c54003dc0e38322923050fb134d6e2be258d02f9bf1f426ca8c7efe6fca0bf9b0529b66c1e58c4c62c28008ca407eb65270a5d1f9dd63ece2674b831774a6ecde09fcbd81c4e6b82cf153f16204c82015aaf7038af943b152b7e807f08d487e5955954fb20310a4caa6da1a516217bc1e131bd282df0318ed1c8fcefea7e92a3224b84287bd9327f40dc3b15b30ee47f02451bbfa8d97717a3fc43685a6fd84249be000edc0bbdc804445b56a410bcabc34918cc7e661481d86b8954242e1d5f2f1c393ab8977ad747a44059d578e69346baf7eb66740d6d7eea602815f3a358d228af8e23998b8c7047e57118742ae67e2a93a0ee01ffcc792fb6b8a821b9ef5dbef194c9cf308e0237f0744dc07a7d38cb45f9bb5e2351c3e5107a8e395bc67215581efcc497c952b1c0666f4606f840c07f23dca470c641d67fa6872e455cbe7ee9a19a4b07474fdb9830262f757f5bb9f24115e1bcb4739218bd7aae0f0b7344fc7d95dfdb5aa589645c64d8059b84f66686db75d97d0ab03bd91bd03dc768e18a13b8504523ca749fc59a5d5b9e11712ad45a158169dcb422b93c45dea6efbe83999e593a2820db3fd003cb149c4e28921a43c395154ea44e4fdfeb43497f5ac44d2f6179b4cbadd3ea09cd553c0398746846ebcdd0ba59eabd322374bd0a63e9725e24f3d1246733c6184fdb263d5220f51416e057cbc7fe23791626ad902b88fe939ddd97ff29b1c68760d99b0d6d0e7ddf5e2b1b3cd927998a4d8e23cbc917a83b4240b5140f094c287d889c09ae76870c32c5a7ada50e2cebe2b0b8016c2edbaa69dc822829a129f876126ef508c9a730ce76a4117619986c47643ac05f96007a470adfba82434d935c6d3499763dbb9dd74c8422947060fc24740ac43b6384dfa03c06a60b3de0e1073664d2c50127eaf71e6c9883a5160f082a3b3edc494623c598507e1bcb4205be46385660f6322dd96f66a6a05b48a48ab1a9f5a323b34b4d104083f04965715aad257a3d83f13e61f04a7dc79cbe689c70778888c1f041796b0dadf56e9dcc17a376032623924bd63b97ce67d08d35f19225e53e60fd00d1dfe59c261ea23435c2e9f6a9f80764a81fb502887ed6f5a4bf08b847a7c614593572bf7d32fd1171e0d5ddc3b57e1d48b0bfa075381f40cbd55bc5b83c9a2097be35ef921726a115c82ee3940c1cddaa3556b1dee24a4ab2666f2de79c9277605d79dc02ea6759e7c49d060559515f9d99cec4cafdd286ef23df4af294397f34a19f35e2fbdfa7031cb4cb435e3f294f667edc25b1c50f2763f4e3bb679b73f13e6e4730b3cb46858886f5311e5e27df7a0be396d845f115caba7d52dd8b12093414ef0afcbf21a926359f5c2aff2925cb1bf1bfc96535ae22150704513c418385babf1c8d361bc43b82e8b25d1c05c3e248c2d0afabe3aabe933486bfc1ec86fe5c730e37d359498ee14d7758a3c196e72d89ea75fd8e787e4143baf62768de5ceb62d57388a34ae1c3a12db0eeb2e22af0cbaa3a6520852feb38c73513a21019d426d33b516e1bf213ade6ad50b101ef8afcedb6903dc7c359596c93a0baba41358062a56aaa244e73dc3b647bf0a27b9952039b75b4e70b90661dad94949f53aedece1725500f8c2c8ec079a06c44dc4e44440fe6c157bc1d21f91f09a805d18fa87e4faa3c219659fdac63976aea964fe461c92013abbf48e58b3298a532be348e27e46ca25e4a6330bb0d7a635f8d56a95f6bf9e395b4eb7002e109a0652b71262e9fab6c6b12f4da082b3b3360f01d3e64339d3f45007a5f32f880e19e1361638d13b56a29e214f32bb9ed9b5beca4fdce56dc5e0af38484712ba4f1d1d76a1ed250e7583b9df97fc7ac35895829dab3fe93dc2414c2694c621df2681eefd7e63a48067cc4fc32115c5981e9dea7e73cf66170420140d7510de3ae2290e68bb01a90ebc5ffb0b9025173f849d97043beff389b0e6a2c06bb840278d526143b168500ade695bce8541b9bcadc445ef32316ed58f0256a52e5ca5a9a382b7acbe15c6bb0fc8a859fb12d15fcb4de5c826d8ac8995da290c3409a3fdaf7c8637252cfc82208d848c54e3edc92353f0182ff8bf96a5cc53e9455c4f48daf04fec339a43f12fcff4a7f2fcf410a5907e30797d7f4aed2cf60f6b042a49e2d71cf374ef2307a22c7cbf5ab7d90205f5caaf7f83cd304cb34e36067d1b6cbf6cf70dcaefa8e7885844092e0af7054cabcedc82ae73785957a50a5fed003eeb80e13e8f64035aea05f96aa1ba97e23b54b66b2a896e52bb03a5830b8d11e4507e73b1bf574cababad1e28e4fa9b1a44509be707626181e634441f474f979dcd6a5c4d3193187dce5f02ece336b73b55aff17e0e551ea21331680f5b0892e3edbf61985c75e685c73e2381738921b0b9c28b576b998eca877bfe3df0c45cecfb7f613dce513f573beab166dfea416307d7361b576ee447d0a1369aee3fcd2703288eddf5016b0497ae9f2cc55cf6561d28b524307488b0169b81d6b784fd9ea102a968c86e68130cf69295da213d90f88c3c1b49917124325e20fb180de1536531d90391edca975631597141b754c1a2b84251a3b19f3720e3970b195c2b811baf62e13f6c993a3f1a86f2bae290c364ea92c524c2add74f4a1d9f5dd142a60c1c8acca3fbb4b4f54934f4c5b72beb9a1f38c38e94c5029c5ad5567ff7a4ea2761c74dc43c60d7059013dc0bb202e0335007f77d2ac0dabf0a7597a30515ddbd34ad7fd1b2d5867e62f489252090a181d83dd557c28cfaa5db4ba89251b413d9c82b365914983b1a72879e6317f3d17a82839d1db1eae04ddeab2d1f2011deb5692af783a779c2b12c7fcbdca7fc7afb5907c10f63e6ea16fe43bd797b0699e8c4c57349f72f8878bee58cf998d4b8dc86cad04164e80dfd3602c69f8e1eed1d7ec361383623a1b1c", 0x1000, 0xb48}, {&(0x7f0000000580)="a08fc51847063ba2aaedd91002fb1e29475fbe7b2bef7258b99f81d6cc11189efec5ebeb786673519e1f6d52c83aa71ee07a447da5003cc09685736d3589bc6bc0a50713bf168438f3b61d123db58912cf3a3278", 0x54, 0x7}, {&(0x7f0000000600)="1670cf185f63e49ec47a4ba3ebaaa63b91bf0ee71248e976b7085bae0b87527424af7412273afc7f93005909a13e600163704f1200", 0x35, 0x7}, {&(0x7f0000000640)="8a7b40430933d7c086465af3298ca967e7f6e91deddfab5b14bd6cfb530363fa94f40bb9e53c66b678eb6d7294ca2599cf4193bcac46f8bda2a5ce16436f5e9ae284a8fc736ab2bc05c641c310cc8b1b70476fce6414685d0384dc4892170cc13e8ae9ce2b0e0e126b4539a2ac02c8df442f851c8b5ac2cea2d46333f1a57662c1ef2d6fffbc3f71d587716c4ea7497c95a88fc431ee5bc1dc3caf2a84ac6d1b48cf9caf4132476251fd68d27a9257c0cae24c71176388a388a74ca5de81b188232c1c4c0f2b6a2c6839af2c0b5425ebd20f1eb7d5f7cf81890e8d77db68571e3c4b", 0xe2, 0xcfbf}, {&(0x7f0000000740)="35a1957c4f4fe57d2f884e1035dbd4053c3adf50ad9cf18abc73222af1068c90881f1a6fa837d0a74284817936a2bb3736ef991ac0e933a9d90d0dae91143de4ce00100feb3c4d86ea3799428ac3c36b8ec2228c7ffe89250fb65111da258224926b3f09f7973f32228fabef588879a7555a4f3cc299c056ffe35280052bbdae24b1c6109f293cbac02c2bfa69fef4b1dc249ef3f20b2c42e60a21", 0x9b, 0x8f1c}], 0x2011024, &(0x7f0000000880)=ANY=[@ANYBLOB="7569643d3332352c706172743d33332d332c6e6f6465636f6d706f73652c666f7263652c6e6c733d6d61636963656c616e642c73657373696f6a3d382d2d2c626172726965722c747970653dd609261f2c73657373696f6e3d2d34397e2c6e6f622172726965722c00"]) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000cfe000)) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000180)={0x5, 0x76, &(0x7f0000000100)="010ccace2bb08988b391cead670257a3028f3b1a524669ba0382475312b8e761ce1ccad3811b4b6cb26325bcd9f10ae12f1883bc0e9daeb774a2eea3932550b027ef86ac61f6b40d7ebecfacbd3aec2197c85782be94c3501feca8385d4073f3c4653cf44ca1df6f6dd4807173e67314593ea3e0b0f3"}) prctl$intptr(0x29, 0x0) getsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000040), &(0x7f00000000c0)=0x8) [ 1035.470691] binder: 7258:7260 got transaction with invalid offsets ptr [ 1035.494734] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1035.507675] binder: 7258:7260 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:38 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:38 executing program 6: bpf$PROG_LOAD(0x5, &(0x7f0000903000)={0x1, 0x5, &(0x7f0000519fa8)=ANY=[@ANYBLOB="180000009df6873a00000000000e0080250001002e00004a3f100000000000009500004000000000"], &(0x7f0000c43000)='syzkaller\x00', 0xfffffffffffffffa, 0x1000, &(0x7f00009ab000)=""/4096}, 0x48) utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x2, 0x8}) 2018/04/13 16:41:38 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x300, @loopback={0x0, 0x1}}, 0x1c) [ 1035.528257] binder: BINDER_SET_CONTEXT_MGR already set [ 1035.544432] binder: 7258:7260 ioctl 40046207 0 returned -16 [ 1035.556127] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:38 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:38 executing program 0: syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x1ff, 0x48600) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xd7, 0x40000) r2 = getpgid(0xffffffffffffffff) syz_open_procfs(r2, &(0x7f0000000080)='mounts\x00') ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f0000000040)=0x1) sendmsg$nl_xfrm(r0, &(0x7f0000fb9fc8)={&(0x7f0000397ff4)={0x10}, 0xc, &(0x7f0000fe8000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200100001a00090a0003000000000000ac140000000000fcd48300000000000000000000030000000000000000000000000000005758f1c454b47a13d5eae43adb7e0d4cab87e35e8f5d7c35fdef7008683d3ce94d487a97db621925fb5aceaff1ab1bcdcf31386d88fa135e0249ed57eff6eb44500bd5f2009f01199a122c8d7eb68c1b21865993a76608fe2c900ea9d908b3151d08cbcfc40ccee9e72198d0a18cc4e93bed501903715cd2ab5eac00af5c4c9297dad94f1c530a8b2c0973909ba814d3afd51f69a672707b39e24fbc1b0928deb97dd4ee8cce4d9dc36bf5a67e1e06db4fc5f6691d04798b7c3e3cac35", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffac14ffaa000000003c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000cf000000000000001c001700cb010000000000000000000000000000000000000000000014000e007f000001000000000000000000000000"], 0x120}, 0x1}, 0x0) [ 1035.633967] binder: undelivered TRANSACTION_ERROR: 29201 [ 1035.681683] binder: 7283:7284 got transaction with invalid offsets ptr [ 1035.718196] binder: 7283:7284 transaction failed 29201/-14, size 40-8 line 2991 [ 1035.760681] binder: BINDER_SET_CONTEXT_MGR already set [ 1035.785811] netlink: 48 bytes leftover after parsing attributes in process `syz-executor0'. [ 1035.800312] binder: 7283:7284 ioctl 40046207 0 returned -16 [ 1035.831275] binder: undelivered TRANSACTION_ERROR: 29201 [ 1035.836448] netlink: 48 bytes leftover after parsing attributes in process `syz-executor0'. 2018/04/13 16:41:39 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000ffffffe400", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:39 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xfec0000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:39 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:39 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f0000000300)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x40000000000807, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f0000000080)=ANY=[]) ioctl$KDENABIO(r0, 0x4b36) ioctl$KDADDIO(r0, 0x4b34, 0x5bc) openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x0, 0x0) statx(r0, &(0x7f0000000100)='./file0\x00', 0x1800, 0x8, &(0x7f0000000140)) 2018/04/13 16:41:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000000006cd00000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:39 executing program 6: perf_event_open(&(0x7f000025c000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0xa, 0x6, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x2, 0x398, [0x0, 0x200002c0, 0x20000410, 0x20000628], 0x0, &(0x7f00000000c0), &(0x7f00000002c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x9, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller0\x00', 'rose0\x00', 'dummy0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0xa0, 0xf0, 0x120, [@cpu={'cpu\x00', 0x8}]}, [@common=@LED={'LED\x00', 0x28, {{'syz1\x00'}}}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0xf, 0x0, 0x0, 'team0\x00', 'rose0\x00', 'tunl0\x00', 'tunl0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x148, 0x198, 0x1e8, [@physdev={'physdev\x00', 0x70, {{'ipddp0\x00', {}, 'ip_vti0\x00'}}}, @time={'time\x00', 0x18}]}, [@common=@LED={'LED\x00', 0x28, {{'syz1\x00'}}}]}, @common=@log={'log\x00', 0x28, {{0x0, "fcc1a8bd7c24c00733bf45725a1a107f9982a8dafcdc759e0413cef8f13a"}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff}]}, 0x410) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x4000) ioctl$KVM_ARM_SET_DEVICE_ADDR(r1, 0x4010aeab, &(0x7f0000000080)={0x2, 0x10000}) 2018/04/13 16:41:39 executing program 4: socketpair(0x11, 0x80004, 0xdc44, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bind$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, {0x1, 0x2, 0x7fff, 0x11b218bc, 0x4d, 0x1}, 0x1}, 0xa) r2 = getpid() r3 = getpgrp(r2) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000080)=0xe8, 0x4) ptrace$peek(0x1, r3, &(0x7f00000000c0)) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000100)=0x6, &(0x7f0000000140)=0x2) r4 = syz_open_procfs(r2, &(0x7f0000000180)='net/ip6_tables_targets\x00') ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) r5 = getpgid(r2) ioctl$TIOCSPGRP(r4, 0x5410, &(0x7f00000001c0)=r5) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000200)=0x5, 0x4) ioctl$sock_inet_SIOCGIFADDR(r4, 0x8915, &(0x7f0000000240)={'yam0\x00', {0x2, 0x4e24, @multicast1=0xe0000001}}) mkdir(&(0x7f0000000280)='./file0\x00', 0x40) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r4, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x80, r6, 0x10, 0x70bd27, 0x25dfdbfe, {0x6}, [@IPVS_CMD_ATTR_DEST={0x60, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x401}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x200000000000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@remote={0xfe, 0x80, [], 0xbb}}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x100000001}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x4004815}, 0x40080) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000004c0)={r4, &(0x7f0000000440)="bcaa1d9a13cfb48bd05747d763cc9b5537ef0ecf4a42e395e0db65aeec8f37a06347a1ab1fccd9e78dfa7dbb18a454c3ac65509299e733f9937c6b4ee110742e23f3f0b321da098426736483a9d125392fba48dfe71fd40d4bc70daf6fbe36a4efc699ce710ed94e57ce12ac736bd4559b3eb52af923"}, 0x10) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000500), &(0x7f0000000540)=0x8) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000580)={r0}) setsockopt$netlink_NETLINK_RX_RING(r7, 0x10e, 0x6, &(0x7f00000005c0)={0x1b, 0x1, 0x7f, 0x34ac}, 0x10) getsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000600), 0x2) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000640)={0x0, 0x3, 0x8000, 0x3, 0x9, 0x8, 0x2, 0x10000, 0x0}, &(0x7f0000000680)=0x20) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000006c0)=@assoc_value={r8, 0xffffffffffff6c9a}, 0x8) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000700)='/dev/loop-control\x00', 0x2080, 0x0) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000780)={0x1, &(0x7f0000000740)=[{}]}) ioctl$sock_inet_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f00000007c0)={'veth1_to_bridge\x00', {0x2, 0x4e23, @multicast2=0xe0000002}}) syz_open_dev$amidi(&(0x7f0000000800)='/dev/amidi#\x00', 0xffffffffffffff41, 0x14080) setsockopt$inet6_MCAST_MSFILTER(r7, 0x29, 0x30, &(0x7f0000000840)={0x31480000000000, {{0xa, 0x4e21, 0x6, @ipv4={[], [0xff, 0xff], @rand_addr=0x9}, 0x2}}, 0x1, 0x5, [{{0xa, 0x4e23, 0x7, @remote={0xfe, 0x80, [], 0xbb}, 0x2}}, {{0xa, 0x4e22, 0x4, @mcast1={0xff, 0x1, [], 0x1}, 0x653}}, {{0xa, 0x4e21, 0x581, @mcast1={0xff, 0x1, [], 0x1}, 0x2}}, {{0xa, 0x4e22, 0x100, @loopback={0x0, 0x1}}}, {{0xa, 0x4e21, 0x4, @dev={0xfe, 0x80, [], 0xd}, 0xfff}}]}, 0x310) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r4, 0xc0a85322, &(0x7f0000000b80)) socket$inet6_tcp(0xa, 0x1, 0x0) 2018/04/13 16:41:39 executing program 0: lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.system.Security\x00', &(0x7f0000000080)=""/34, 0x22) r0 = syz_open_procfs(0x0, &(0x7f0000337ff2)='timers\x00') ioctl$sock_proto_private(r0, 0x89ee, &(0x7f0000000240)="945f808607d25d6e637329e252d287deac610918d2460363a19d5689e6d52884333142f1a9af1ea1823240c2b23dbc480aa176e9da8255fe2b780e05807067896ed36dca8491c87ebc9493abaa880e64ca1109fd6f3d7142659ee1561db68926f09b684f5009f8ac4ea990c6a955c0f1881c0842a8823a1e9e43a73d19d32a850f7ffe9ac037defaaed26f4b8514fc39aa7977624abc42150286114c9f14d4d5") signalfd(r0, &(0x7f00000000c0)={0x81}, 0x1) close(r0) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f00000001c0)=0x7f, &(0x7f0000000200)=0x4) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000aa000000ac29698654fa888731fb9c4e5f2e53163b25f15bcd138885740e2b53435291dad2c0de5885c18e87e0617ca404f7835e151217988148531ae700b24ad5cfa1455d52bec45352daf38fba59fdc30bae5688c79bc964a74c68c69a779dd15672c4799c70edd6e5c9246f015f3c32f2d297fbabbe537f3fe4eebe4a507417d32de44c7625ecf38e46eb7646ebccc7b6b450dcf5cc0f7007c1f5b3a1c194f25aaba8f08463f009c8de2f5a"]) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000300)={0x0, 0xfbd}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000380)={0x200, 0x2, 0xb, 0xfffffffffffffffe, 0x10001, 0x3ff, 0x9, 0x58, r1}, &(0x7f00000003c0)=0x20) [ 1036.785203] binder: 7312:7314 got transaction with invalid offsets ptr [ 1036.803091] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:39 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:39 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x90040000, @loopback={0x0, 0x1}}, 0x1c) [ 1036.845279] binder: 7312:7314 transaction failed 29201/-14, size 40-8 line 2991 [ 1036.880990] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1036.881230] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:39 executing program 2: prctl$setendian(0x14, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f00000000c0)=0xffffffffffffffe0, 0x4) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ion\x00', 0x4000000000, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xffff, 0x0) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000080)=0x3, 0x4) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(0xffffffffffffffff, 0x28, 0x6, &(0x7f0000000040)={0x0, 0x7530}, 0x10) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000002c0)={0x86ab156, 0x1b}) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000480)=ANY=[@ANYBLOB="050000000000000001000000020000000100000004000000030000000300000001040000000000000000000000000000000000c000000000000000000180fe447f0a0000030000000600a2000000000000000000000000001f0000c0cc000000050000000100000001000000c1060000060000000000000000000000003153ab0e0000000700000009000000030000001e000000a400000009000000000000000000000000000000000000c009000000030000002000000004000000ba7c0000050000000000000000000000000000006c2ba43fe6f07296dc101878526473c61c3d6d66917ccb4d946cd6d8762714b6358c5d72e0e17c1ebc11a262551604234277a87c103aa1e059d5f5f235d5c5659004edbdfeceb5340315bdedeffaac946da01d495290ffcfe2288d2e3d2cad8b0a80d5064eeb4c367311780581fdce79404680194679fbbed81e22f033a0d312fb1a11632fe11ce8ecb6003c654dfe8d34dca86611"]) [ 1037.017191] kernel msg: ebtables bug: please report to author: NOPROTO & 802_3 not allowed [ 1037.021300] binder: 7312:7314 ioctl 40046207 0 returned -16 [ 1037.088378] kernel msg: ebtables bug: please report to author: NOPROTO & 802_3 not allowed [ 1037.094893] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:39 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:39 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000200)='/dev/snd/controlC#\x00', 0x6, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r0, 0xc008551a, &(0x7f0000000140)=ANY=[@ANYBLOB="ff030000a3ffffff0000000000000000c9580567e1c520d836f874a8b10ba790afde98943e0169787cdc6edc116b83588eb2dae0a65e898624f2f1c50557f5fc7a2b92e3dfcccdc25478c0d044195353adf2a1e3671e9a3031d7d4de70a1d7747968d33cb9298707cabea74b18ba729d487e38cd0a217c56751531411902fc70106c5dc91e30"]) pwrite64(r0, &(0x7f0000000240)="9a5ce49a900e705a81748d828293c2ca7b4482408c0f2635834233c4008e459c7c7246395dd83c2a0b09e77869f62943bd175f5d8041f812d13dffba2a23f91ba5a866eade2863ed172c7a78e05267b64859d2ca7e20315346eeec85ab6bf4dddbf63768c8b7f35765b3140c023b17f3d10d0fc7aaaa3e5e81a1c74ba76024af342930866114859b2ddcabeada0be61d1d494fd26ed2f5a859bd01176f81353a43850ae86aa039", 0xa7, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x8, 0x10000) r2 = accept4$alg(r1, 0x0, 0x0, 0x200000000000080) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000040), 0x4) accept4(r2, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800) 2018/04/13 16:41:39 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000039800", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:39 executing program 0: getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f0000002940)=ANY=[@ANYBLOB='\x00#\b\x00'], &(0x7f0000002980)=0x4) perf_event_open(&(0x7f0000000200)={0x3, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000c000/0x3000)=nil, 0x3000, 0x3, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000048000/0x1000)=nil, 0x1000, 0x6, 0x31, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f0000000080)={0x5, 0x1, 0x7f, 0x7, 0x7b, 0x4, 0x100000000, 0x5}, &(0x7f00000000c0)={0x8000, 0xff, 0x1, 0x7, 0x0, 0x27053df3, 0x7fffffff, 0x7}, &(0x7f0000000100)={0xfffffffffffffffd, 0x9, 0x35b1, 0x7bf3, 0x7, 0x5, 0x3, 0x5}, &(0x7f0000000140)={0x0, 0x989680}, &(0x7f00000001c0)={&(0x7f0000000180)={0x20000000000}, 0x8}) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, &(0x7f000000b000)={0x77359400, 0x4}, &(0x7f0000048000), 0x0) r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000000)='autogroup\x00') ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f0000000280)={"145e4f5127f4dbdbfca34972c296891d78562aca42e69823d5c8425a3ba0efe19554a04dfd014a2b355f99e34c7978ccd20147fa15b0e6a3ad2529f3b90ed69ae004e8243c63464f365c152210c5aee752aac4a037dc10c454c82f36961919f52c079bc3016fa8b4fbd7ec573cac26c6c398c5c959c559f18ff0fdd2f9005ccc3874a1da77ba9bcb69f1704c82a9e5ce4dce025429a064bbb256913516a1872ae7b14162533bd4dc8d8848e207de67d53d37561d74760b54001e448c652c78fe493367e7639b431c3a4323ea465e0a9971745ceaed32fd019e35774ec790e40deab8c70058f7d755329d09c21ace5925c79eea0d682ddd6029bba855c696fc6ef037e5ca0ec435b72733a3b76c00a18536529afb8664012cf5bb817b7b724d0f908c757dce55dfe4d02bbcff6053d4a1da159cc213793fde9c2bc1ba34339601a879c1cbadea1f5e8b3d89803549678b9339a47d83bcea4e2194ca789639a800b9d989710140f5e20a582bd1d3eda3ffca548ccef54460526419796f897d6fd80480e1cf6ad0af3373e4ee284b0705dc3da0fd10ade5841f5d32702ce016558f565c33cc66329ed3f92398f6d4f7f8a5e170d832fdbc8b25e68535978c98a5112afe29df397cb8b3d63b3ce3d00c6992d274b9776661360353183dd2bcb5aa8fad6ead0663649447bde14b79d4d8dd8321bf8e4c481964d94481fe8121f1df006e3b3a5865a710f3d9e65cc7fedcf80f3d07f9f44941c48b8af876906432c6b635209070acf56a5cc9f367be56fd30fd62004ac04150d8a7ce28a018e80ae0903b2b62c07795e97db30365896a066162f0cc0967fa88c28c0bd98c85a72f027beae28bcc715f97e6f26b068c0f1f562057e3a4cb589a64caaa4cb36671c3cf39536ba28ad03f6f96b1fdfdc6e8014a42d94b7bf68051735d599cd8a83721a2e6e126c43974f434bb7b725580f28ffea73a1afc6ba876f6f39c28592f10eded24ad7c34d9a1a57186fdd3dd7144b25f69a9efc782a4936e47a3d40d36e32cd9a206744e3031012d9ff5c464c07ba283f85eafc3d7a7c71f479e4e16611b5c03c5356222e1881df6f1618d64065f88c61d37c458afce70fc10121e72c1f377db4242a5ef5c908c5dffcfaee3bcee6ecb382a910a7da3a9f7089241422e4f3a0a1bb62900a2b718a50a44d7eabae74130a82f2538cbed55f612385c582c1f6774529ad697182c2f3fe9bfae90f88549b438ce85de1230738c8da273e781ff5c2ee7adcc617321377f34f6664c14ba4564a94eef2db5030f1e0cc172b831f97e03f2bb9b1629e19fafff9ae21c0ef19eac351f85a348f55e42554f46ebebba9a8fb781c38cfeac9d58004cc7fa2d1cb3ecb878394b291e01f7d5a0764266efb48b63ea8bbf325254c6e12c92fd583ee90916420484fc15b6218ad265f045d7d031da"}) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000000), &(0x7f0000000100)}}, &(0x7f0000044000)) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000000680)={0x2, r1}) unlinkat(r1, &(0x7f0000000040)='./file0\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x15) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f000000d000)={0x0, 0x7f}, &(0x7f0000048000), 0x0) 2018/04/13 16:41:39 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xfec0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:40 executing program 6: r0 = socket$inet_dccp(0x2, 0x6, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(0xffffffffffffffff, 0x400448c9, &(0x7f00000022c0)) setsockopt(r0, 0x800000010d, 0x1, &(0x7f0000000080), 0x0) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(0xffffffffffffffff, 0x800455d1, &(0x7f0000000000)=""/79) clock_getres(0x7, &(0x7f0000000080)) gettid() 2018/04/13 16:41:40 executing program 2: r0 = creat(&(0x7f00003f1ff8)='./file0\x00', 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000100)={0x1, 0x1f}, 0x8) r1 = perf_event_open(&(0x7f0000fdef88)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() timer_create(0x2, &(0x7f0000000140)={0x0, 0x31, 0x1, @thr={&(0x7f0000001700)="abd78fdbf0a2e99976dcff2391c18ddbacc42d1aa8c4b31ee63b4ac2d39faad9ce5148c54722692b15b62d925d34961393375440b09e8b5224bc051d11af1ccea53b202594c6aaf9f03a6996f82b30d2f73b85eb438e26cc630a9055060b99be4b4ebae67df7e906fd93632c1bd1d18935e54fcea443be0a82a4c819a9504a03afe271a34d5a22c8f6b170c4759de4f8fa59bf017847ac91711a689cfe49e2c9fa9ff9c26ecf04b4b97429a211610673db858d03b12af6f6ba54e69bc60cbb", &(0x7f00000017c0)="df5b08d2778222b7d64c79d4b3b059c6f1e9af825dfa3f66864d5af866a47a5c9dcf1f804c205c4be763cd0a20edb0d69128d8371aaa792ef2cc6d81b2092613dd67043cd23127ec418d67cabcfbca4a3456953e02d5adef64b54eee16f9682411bd7d4ddf782fc11a3a"}}, &(0x7f0000001600)) readlinkat(r0, &(0x7f0000001540)='./file0\x00', &(0x7f0000001580)=""/16, 0x10) lseek(r0, 0x3c, 0x1) ioctl$sock_ipx_SIOCIPXCFGDATA(r0, 0x89e2, &(0x7f00000001c0)) r2 = getpgrp(0xffffffffffffffff) r3 = accept4$vsock_stream(r0, &(0x7f00000012c0)={0x28, 0x0, 0x2710, @reserved=0x1}, 0x10, 0x80000) timer_create(0x0, &(0x7f0000000080)={0x0, 0x1d, 0x5, @tid=r2}, &(0x7f00000000c0)) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x1) bind$pptp(r0, &(0x7f0000001500)={0x18, 0x2, {0x1, @loopback=0x7f000001}}, 0xfffffffffffffeb0) mmap(&(0x7f0000730000/0x4000)=nil, 0x4000, 0x4, 0x810, r4, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000001300)={0x0, @in6={{0xa, 0x4e22, 0x100000001, @remote={0xfe, 0x80, [], 0xbb}, 0x3f}}, 0x9, 0x8, 0x40, 0x8fa, 0x81}, &(0x7f00000013c0)=0x98) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r0, 0x4008ae48, &(0x7f0000001680)=0x5000) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000001400)={r5, @in6={{0xa, 0x4e23, 0x7, @local={0xfe, 0x80, [], 0xaa}, 0x9}}, 0x3, 0xc0a}, &(0x7f00000014c0)=0xffffff6b) perf_event_open(&(0x7f0000001240)={0x2, 0x70, 0x7, 0x81, 0x5318, 0xc3, 0x0, 0x0, 0x800, 0xb, 0x9, 0x101, 0x606, 0x9, 0x400, 0x5, 0x0, 0x5, 0xfffffffffffffffa, 0xb1, 0x6, 0x3, 0x6, 0x1, 0x3, 0x6409, 0x7, 0xc1e6, 0x6, 0xffffffff, 0x1, 0x3, 0x62, 0x1, 0x5a467187, 0x6, 0x20, 0xffff, 0x0, 0x3ff, 0x3, @perf_bp={&(0x7f0000001200), 0x4}, 0x20, 0x200, 0x80, 0x6, 0xffffffffffffffff, 0x9, 0x9}, r2, 0x6, r1, 0xa) mmap(&(0x7f0000000000/0xe73000)=nil, 0xe73000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setscheduler(r2, 0x1, &(0x7f00000015c0)=0x1000) r6 = socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r7, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r6, {0x2, 0x4e21, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x4, 0x0, 0x2}}, 0x2e) connect$inet6(r6, &(0x7f00000016c0)={0xa, 0x4e21, 0xb2, @remote={0xfe, 0x80, [], 0xbb}, 0x4}, 0x1c) sendmsg$inet_sctp(r7, &(0x7f0000002540)={&(0x7f00000001c0)=@in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x2}, 0x1c, &(0x7f0000002480)=[{&(0x7f0000000200)="30031f74a7390d9264a64d69e587f7624fe40724e6d44760aa673a82888719c07f97050729f67a8e85c58afe922b25b52ef250f948abb77c8219e5b0ec66951e88a8dbe8d675fcab2a80857b79828e20cd814c5a0c1b51e68b8be39b854dcd2ea93fe2109078f7a29d4d490b2a15eebc40298370edcfa21cb4523b070a68f73c611f6ccf56230a6234b22bc43f97b0d2521a41b90ab2dc4996151d522049442f3c15f9ef420a9a04ed2156ee3b2cfdcaf7cd8f2c6661030711068c318169b6e577d6b22791bc3180b87f10fada56591fa6d88f71d53add919872318e8edc5ca019eebeb3d64935f7411638a70028d455a34f292695f1a3566fd6cd9ef0120d4d24e8923079115006e31f36855b93644d57537c85a8da8df8e46b349dfbd790e2521d1d6375af2efbc684054bacd2791a0031095cbc6a62cb7f9e924854ddb0626ac03eb9889c4dcbb7bf550ad53b541263535fbe5c03c6b59c719528d9bb6402168f31a4fa265ae2127e6fd84d86c3dd9ce2082b9a4e17a8794d7cbcd11e89453d8bc00c721a155e903fa26fd042d804c0c60bdc3b76dfbebf62676934a761050186f4c7fd98f3407e6f63637877b0fd15ef4542330aee1205509e751688d2d818913458ac395e26cb1f67d741c9992717982b60a81b8d2fee60b502aa7e8489766293f659893c593f9918c6bb0465ffce89ce296d38dfa70e8d9627b49464c3f746be11a06ae9cdde3173e38b19a4d3bd4f6c23cdd1c0c0ed08af7a5ca7302bc0ed8927cb8d7308629469181863a813479ca0abf15d487ce90441f428bec2e83c908ccfd419537d57886eb33a6d7806f44e146e40284a3ab095e0a462b8c1841583c806f76a962b5be9db7aafd01db3e71eb417784187044a4c01f86066464375a1ea322114dd9d6d044c0ee8f7d3b7388d8508b82997987775ef8fd5656161ac9baee1523822093e45dde0ebc3c72f864ee100e34e7e7ecb620ae8b046a55a3cf700d6ba2bac8c604e5cc98b054512019c0121284e5613780627723f3905fa4783688184b27dc1e11925f49a5a50d6a3b81c9da936d3d26f5deb390f0033a114c8791034073dccc8657bd154b15e5b9187722473a471fbd36b62f44c41fe1ba96f76fee0ff52783ffe038ad0b5c7d6034f5e5f61a91e0b7a9422f8f57404c202064f77f52755899222ac411cfc13663765b722c07770c35325275ec647ba9cef867e8d7f912f2e59e71a3b37c60518d8920870e085627b969087d65240b36fd1048229c6a73d4d885098adcad98147747ffda69c83e05c3b004ca1ec985a3e7876460da505f54e57cc80c4ca2978c4b50c5a0be518edbe7bd46db79b50c6debfb7f2db273d3190fd3b3a586e7424413d45239a25d2d326dadd0b2de7144a829ec1a8743b3eace6521b75f7b4173dc5c1525fa3f863713c2448825a9cfb5f525d977f19359c765242d2c164b0c0fd48915a0bad1a221a421d67da925a268977edc5e01f5ed2ca3d1a3b42a4bee66916b3d4d01e196e2e40d9f500ad08543e3d399745b8e89e035ea5935adefc5a74d34bd030bcb0d4ce6416284960d681c00bacf677588da9444ff4c708b2786a1a78eb5caa4c5f40511c36086177e368f2c50661b9d3fd538ec50f00a99f3afa54fb0c72b074860f232652ca44c06b8dc1bdd8014ed1c0f00038e4a9b3860e649e4e8c8ce48736f040a6e33870e27d8cae8e477d1252757b4449a8574f1d87b904adfd73cf6b1dae427bdcfe339abeb5b799e3287844af026f412b26ebf324bbcb820f23ca619ed2d6235c42aa4b5d1679ea616f34b1db1a6caf8102296e1d642be6a03e986368b41b42b44dbb72aa551b3a409130c6d8c7ae7b917a3065979f398a14efe7086db5e5424441ad81ddc3e1b0991b5654d19730105affea9a08592be1f65535efefbc7072bb90cc6ade30fc889cc5e064c4eda196c991fa9d1135dd52921f1aeafcfea517ba57bc54f47686c3e8625b8a4bb1b8911a3993312caa3ef51465c01b7d1b5f095932f89e143fbc56025be9a59bdc98b648fe0c61bd7ff3f9238f230e4931b3545d0b087acec9018ed50b1a6418651e9a8dfe73a8a982a4862050edf2d7d7f6dbd92f2ea15e3b29d5b2809c96125afccbcb75acfe7440fd2c18e1ce14c8905eaa4178c8d88c7ff943f95630706793202df0dc067575d5da2ef6bb7b19cac8d8e883efb9c5bee443eb9e9319bfa09944197defa52ae6cf97587f632c5599acee89589da71779e221d74cbd6322461a9b375dba3962991b89a203f9be4eb743d35459dd5a869667ac8879766f6b8c650eb3447df47c2adb798de3a872fb87de30befda32454c49badca17723e79bcc63cbf52fdfc7a3a5d8d3998b88175f87af292871ae69b866ae8778d5a1da9b9807a049cb310f5f8881208273217997a6940afdf925fe2e27e8aa0ef9ae7b0b88d80a81b66be80e5e842edea7f577aa46a8155a3ee7557119c47aae8da23ea46669d06db83cf689cb237354763f423a536814e951035188b36fed52d67b28f05c8c84354f5ffd63c2bcd86d0dedd6760a739046661bf8401236322ab090df0950e12813fd20d417fc291405e6dfe376ee3152118b08a64df9e697a80f7a8dc5808ed19af4490ccd2456531fa161e02f51c3ef879080596781206eb1238ab9a6824f25557834b78eac24e4cc612d9d71fa8a7c30100ef9fd24615b91e136e4bc33559c2382e09bbf3fe26c1b9fe7aac2ea1098001007fda3d1c0e2654ee0c530c288b4c9271b5eef5b24cdecdc2490c652af33695691eef25f511aece0897dc871b000a41d9307018bfd01cbf0a85e4af5da53affd7bab3f76bab2a4f450aa32b5dfb9c8f3620a1024f925c0fa8f6a006a66ff638d421e4a75909399031098f003eecca4da171f2977f3021645175fbc0b81d264e5d6fcda03eb9a291eb43f6cc7f41c702d9096906a6aa847299fce5c88ce9ecb16d746b7ca89844c0fb0411926aafe096c4aeffa5ddcb825b4f0c706cb6b32f91781c1c4bcc895e872b868596164a2ed5807e7a6b5341fda68d517562410c764511490a5c2dadecdfe0d27a7164c125b3a72ad56f699e951d4a6907f7b1beb15fe046829d15d5727e1d21c0c6cad9673a3a6318f5c7be121f133cc396e07de529ecf84b56a13bc6543c2ed67274dd37b38ae549cb9e82f45740031ebab8dafeae652df40cc589e78efd8341abeb1cf838fb52f51084a443e3d1bb021d1ef083b776d2a70ceac71fb62d52af2180aa0caa49c91a6cba62306ba8ca83f940edcb5cac845370211f20bc4c022d894060398c0dde55b5e22ba422e865e8604ed5e5b577311a064e51925f9684424b6592c56f81d6111eb3dde0a8b51eaa4713b945f0ccdc3a35a3b2f8e90ede113934f90824904e584819525a3d6592e72cd01ab08f9404809ecf76ed06b47ee78475c24c495353c8cdee6e0b5ade18405d8686dad53e0b0974d8e41f8dc526c110e4cb6ef6f0ad18c70346d0899c1f17dd04c2537040d0dc2bfcb2d14acaada5e78936d5687564e30ea4ee02d82d134d7e1a37df37a229b78fe158a108c58bc754147a132cb72021f2328742e509a9b2e3b46c1ef8b7d58f121fabf931ef24c72ba96b82f46c64c75959c994e2003ab7d914b63f75c838ef0f7e6930390284529ffa4b2ea58c1d9d12403edf2a4130b18a2e7b601147c0d6c0600d7bea2d8b91465ceb641bd619336a98aa603b55378ae8bb5cca9990657e6a28ed6d11b1441fe834dd07e661bf74ba66c4174a5e0a9ec9565b4866945def9701bce345815b5f676e971d8a99fe0b274953e986029a47736d6174babebfd07065322f065eefaaab0d671d9f843db1e73f5b406e99369378c3135de6120df9e55161cdfb0f21b52d273397d3efbb3c306dfa595f9c4010e7f4ff7ce7b280c011bb91cde3aaa885b13f3feb86617899212d7676ec72cd837913c6daf47239be36c8a5055f07ca6f7cbd1ca7585cd0cb56d031cb0d6eb3baa7a98e956eecb8bb6995201ed010d6ac2bb74c6ac95b11048e9272c0713d213f0a79f8f993d28029629c28ccdcae83db9da726b35c633dd15b65a4f04ca52fa9af36dfa2daed7d261e32b8618e8e04580b93c7061463abd239cc595916dc353e5fd5003ab36bb52f95da8680644c8c94df2a90e75544e913d2c2a5dfccaa69bbad3c534c94bcb4045978dbb27f0a45e6ac0533d0f590cfdd844e46dbe4250837be655257e97cbf73549938444e4dab6fc771cc38ee356b551337ab9f328ef74e8548d8c22bd86f590ba65a010ddd83c485aa4149cf3a7b4dae7fc7ebacfbeb050b381a1529926bec71054d033b1233de674482bccaa18b01c17c982ea27f1ea7743e108de82938fcc809a27c96ba139a43de7ef70ad3cfc6605898f94be45e54c66396840cf313a0e5e6337b86fd047554848c24b0b4f4735ceadf0ed5866067900ac51f6b32f34ff1065ed6e0706c5b521bb8d30e3fb5d780e7c79a61c945de6dc2d33dce4d53ba50a2fd925b9a2fd438ab04a5c6d008c870d3b9b0c294fd16c25b8aa12f161ba974e03d900c583caf1798a16f23aeef1f9d03d91708b6952ea109d0cc615a0f390671bb588c2945f16b9c6c39b9a8f07ad919b182a359eb75c523b932cc4c250257cf1bf0208eed5ebd1c65625c2ae396a35f90e004a724f632e61efb078e0aecb2e1aece499ba697127255b9996643522bcc46bb9d71a6aba17ba269cfd89b7052234a943ec4354bcfa7d5e47ca3666969c2620118d6cbfb8f435a65a98a94e081f1257ba4f3691094064e1de6848c34ce5b5c1fed54807d881a5f8096ea722a3b02ef3f159ff6dc24adb11e7b3bfe4a2023d16c44932b1405e0b027c0c7fb1f6ca00597ab37767195b92c9d98e051e14cc3636ecf7dda394e30a4987847fa6b6498a0965f45709bbde80ee7046de7760f18d089353c01ece5f73b7c5da0d50e51556567a50d0fa0c2690fe4300c2d480660cad234c167a4c76bd61fa46fd88654609a15ce2fedcba0560b0f77b65ff7c4fcaee79b8a499b9b1169fa1e112f3d0f7f120fea498ed1fc65b7138cd66c8e3af9bd93f452d264fc64ca3e3559da98ec6311950849e16d1d6eb4909e3a2daea8fec37c223613ba94a76a01bdecfd7110c3c46fde9b9a51a5d08c29a024d7436048ddd1778ff97548ae1b77b05270fe3a1b5f98322132e8c20ad7292222ec34a7d43092be33476a1a343a9947b437c653c29f6726582e6ef384d7bafa908d5c770499517c098c3cd42c3e3891ac8136c8803ee96bd4f22ebeda55554c6cba575543a7761cbfac01a583087a19f8bcd97d6eefb0faa29754079eca49bb127755f518f0c630ebeb7d6395a7de3283c67dea04f2266d6396a050cb109cf0ad37485a0e105caacc45b0262af73a269260d3d7028dbb3fd73a61343d808da90e30cd41e8961ac680782fdacc32186e9b1072fff55149bc39443e00689e83e725d3b3b19ee5b4eef4bea791d7a081dcc43c847ec3eee40b1095d0d7fa0ac62ca183a0d1a0a4c8170392cd37c3cc93b8aa108a240f17276d1d260ce79d68b4def4a59bcb80d7fd0ad8ccd4636473a602be923f58f1686f56f37f1612f019b63dae1da089b5c3b73ef253bdb24dea81458e700f4d9d803e45e6192043234a24bd1ee04f92259f2c3eeb527a491d5bec3fbf97f6594583bc16129cd1ae57a183b51742ddfc4eda344325b79d34b7c58b11b732e4f5fbb09bfea65d80368f333fbe836513414d72c2a3479de4d1f46388e4eb199ce1faa470", 0x1000}], 0x1, &(0x7f0000002500), 0x0, 0x14}, 0xc045) getsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000001840)={{{@in=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f0000001640)=0xe8) fstat(r3, &(0x7f0000001940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_mount(&(0x7f0000000180)='/\x00', 0x2000, r8, r9, 0x4, 0x400) [ 1037.252148] binder: 7355:7356 got transaction with invalid offsets ptr [ 1037.263091] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:40 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:40 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x490, @loopback={0x0, 0x1}}, 0x1c) [ 1037.297734] binder: 7355:7356 transaction failed 29201/-14, size 40-8 line 2991 [ 1037.316773] do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app [ 1037.317275] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1037.365625] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:40 executing program 4: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) lgetxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='security.capability\x00', &(0x7f00000000c0)=""/49, 0x31) fcntl$getownex(r0, 0x10, &(0x7f000045fff8)={0x0, 0x0}) move_pages(r1, 0x1, &(0x7f0000000000)=[&(0x7f0000ffe000/0x1000)=nil], 0x0, &(0x7f00000000c0), 0x0) 2018/04/13 16:41:40 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000980300", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:40 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1037.397844] do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app [ 1037.398089] binder: 7355:7356 ioctl 40046207 0 returned -16 2018/04/13 16:41:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:40 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xfc00000000000000, @loopback={0x0, 0x1}}, 0x1c) [ 1037.472465] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:40 executing program 2: r0 = syz_open_dev$sndpcmp(&(0x7f0000000280)='/dev/snd/pcmC#D#p\x00', 0x8f8, 0x400000) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f00000002c0)={0x0, 0xfffffffffffffffa, 0x0, 0x4, 0xf2}, &(0x7f0000000300)=0x18) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000340)={r1, 0xffffffff, 0xfd, "44f06cd884f0f8300321d063e254e7558e1a6da0f042465659a6ffec874d89d67084b212468f1ac6a54c3fb8fb273f4dfff606e0bc36090b8bd24390d18df854f51a7152979f819db6ca06b3480798740b10f8523d6b845cf98e157332b15b3e2c2e053d7f068b4c23e654db5bf01fd434461957da3ada997bc5eec76e6c0e8af580f0865553ab01de2c3368b4f07d56774b7a831f7e8db15e4d9117eaa8e55fdd9c29c529ee57b5da4291b3e9a91f34abf742c11f63dca6f6721b877a0d770ac27cee9e3db99c7d2b75253245891f6d83f3c19caac11d98d401de6ca6e8b04c944c065eb522af1ce048b2d474941eea2bd4851cd94066a88968e6c6d1"}, 0x105) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000480), &(0x7f00000004c0)=0x4) ioctl$sock_inet_SIOCSIFBRDADDR(0xffffffffffffffff, 0x891a, &(0x7f00000000c0)={'bcsh0\x00', {0x2, 0x4e23, @multicast1=0xe0000001}}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x341000, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000140)=@assoc_id=r1, &(0x7f0000000180)=0x1) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f00000001c0)={0x0, 0x4}, &(0x7f0000000200)=0x8) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'gre0\x00', 0x0}) fadvise64(r3, 0x0, 0x4, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', r4}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000080)={r4, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2}}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'veth0_to_team\x00', r4}) openat$mixer(0xffffffffffffff9c, &(0x7f0000000500)='/dev/mixer\x00', 0x2c0080, 0x0) 2018/04/13 16:41:40 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:40 executing program 6: r0 = socket$inet(0x2, 0x200000000000006, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x0, 0xff}, 0x0, @in6=@remote={0xfe, 0x80, [], 0xbb}, 0x0, 0x0, 0x0, 0x3}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000e40)=ANY=[@ANYBLOB="0211ffe0020000000000000000000000"], 0x10}, 0x1}, 0x0) [ 1037.533489] binder: 7389:7390 got transaction with invalid offsets ptr [ 1037.550877] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:40 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000a93fff), &(0x7f00002b7ffc), &(0x7f000029e000), &(0x7f0000000040)) r0 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x0, 0xa0200) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000080)) [ 1037.607406] binder: 7389:7390 transaction failed 29201/-14, size 40-8 line 2991 [ 1037.621114] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1037.716719] binder: BINDER_SET_CONTEXT_MGR already set [ 1037.738519] binder: 7389:7390 ioctl 40046207 0 returned -16 [ 1037.785097] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000930000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:40 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000b3dfc8)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f00000003c0)={&(0x7f0000001600)=ANY=[@ANYBLOB="2800000022000901000000000000000004000000140016000000000000000000000000000001"], 0x28}, 0x1}, 0x0) r1 = dup3(r0, r0, 0x0) connect$vsock_stream(r1, &(0x7f0000000000)={0x28, 0x0, 0x2710, @host=0x2}, 0x10) 2018/04/13 16:41:40 executing program 4: capset(&(0x7f0000594ff8)={0x19980330}, &(0x7f0000244000)) r0 = socket(0xa, 0x2000000001, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000000)={'bcsf0\x00', {0x2, 0x4e23, @broadcast=0xffffffff}}) sendmsg$rds(r0, &(0x7f00000019c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)=""/173, 0xad}, {&(0x7f0000000280)=""/186, 0xba}, {&(0x7f0000000340)=""/4096, 0x1000}], 0x3, &(0x7f0000001840)=[@fadd={0x58, 0x114, 0x6, {{0x1, 0x4}, &(0x7f0000001340)=0x7f, &(0x7f0000001380)=0x6, 0x6, 0x6, 0x6, 0x2, 0x1, 0xffffffff}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f00000013c0)=""/253, 0xfd}, &(0x7f00000014c0), 0x1}}, @cswp={0x58, 0x114, 0x7, {{0x6, 0x1af}, &(0x7f0000001500)=0x9, &(0x7f0000001540)=0x10001, 0xd4, 0x4, 0x36, 0x100, 0x10, 0x5}}, @mask_cswp={0x58, 0x114, 0x9, {{0x0, 0x7f}, &(0x7f0000001580)=0x3, &(0x7f00000015c0)=0x200, 0xfffffffffffffe01, 0x7, 0x1, 0x3, 0x50, 0x1}}, @rdma_args={0x48, 0x114, 0x1, {{0x1, 0xffffffffffffffc1}, {&(0x7f0000001600)=""/249, 0xf9}, &(0x7f0000001800)=[{&(0x7f0000001700)=""/210, 0xd2}], 0x1, 0x9}}], 0x180, 0x4}, 0x10) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x62, [], 0x0, &(0x7f0000000000), &(0x7f0000000080)=""/98}, &(0x7f0000000180)=0x78) 2018/04/13 16:41:40 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xe00000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:40 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:40 executing program 2: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) r1 = gettid() r2 = getpgrp(0xffffffffffffffff) kcmp(r1, r2, 0x4, r0, r0) getsockopt(r0, 0x10d, 0x5, &(0x7f0000898ffc)=""/4, &(0x7f00007b3ffc)=0x4) 2018/04/13 16:41:40 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:40 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x1}, &(0x7f00000000c0)="fe880b351250e12e635e7521ea1450a155ad235e74ac83b80b8d66d89ad1dbc9a203a7fb953c4fe76ca8f1491862b314e43eab9f4c4e8e4976cf11eeacc0fdc7f1027d86e5f27edcaa8ac55501c45cf3155f44d2b72e974d9399497567db34c472ea55a4ce9dad15b2e0a1ef6b6d55c401b6c5dce0c5b13e91a1380c5535d55b82a1b1ea934a450da6a38f659ecf357f0d0928c96c988d1f7d4bc5cbc804f0", 0x9f, 0xfffffffffffffffa) r2 = add_key(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000740)="688dbc50d3401ed9414b0952a9c5b2ee66a273a065c9183fedb70ad25bdc572ebe55e41c47b33db79b8643c6d146a37d5c69df1e194a6fc2f4de2efed51ef5a778e8f41200e46a8a299ea8923849b659e69fcb97acf97f28c12c2c6ef9b2e6ffa5a1e189a01f90e4faa743e85316b1203826a4ec382cc4bae68e5b141e42ee1a33cdb41157cc5af202ec4d0e18e4e2471d59ca7689124c3f520adb899f3015be104367967334817e9fd2dcd1391ca32e400cdcfc82f9978b3b1be2aa53c02600327c560a09563f8051caa6540aac20c6f4eb1968d716576ecd4be47b38a4027b4cf122feed516cf2ea0e146043efdf678875581a5e505d7aee74d37519baf4ac132726fdfe7ebbbf1c25c57abc343fd115c16355f0e3c23d45ab8f263fc35bc32c0b5af9d9bb2a24287ef238d91dde06158b9072f0850f3b87e82f485a8d13b04dfee6c5a0b6e31f3265f097022085d3478dfb0065bd1afcdaf4b8d885babec98a5331c0e921d0681b19e85d7e280b8ab1233d73311eb92f5b5c5005f425866bee2f33ce3a77874883660f2022ce2905446b26873bf829e02df5a825f0e8a11d29fa71291cfdff04df5093e6bfb181f6ec73a1ddb75d48d11ff480ff30adc926e74b9942d51dca7255dd1e8aa6e9fc76e89f24485321b9f395350952f356faaf106bbb2a5783d65535bf4e61011d978057f77ce754ef16c8e5ff6d5933fa1d77b41b0ea190c62b923f605f291ae757a1c1c607c8ed6aeb10831edc8b569df9f10fa6639b6245189898c74d4010d20ea0d1d2aee95e778b5fa436871a0145b56b2693d7553db889fff3918a6dbd2469a304933fb7ba4be7544614b02015f57aed6104dece4183975c47e347619d38a8256bfef3968a0260be1f26ec4339d657cadf953f84276ed654b59e23214b97a2e3d4ce4d4c19aa397b26b265e53f1875a2ed397d276ca682537fd688e16ea74287bcf5911d229b25c1310bbf8d98a5b12698cdfc42fc4742437863ddd316e1ce014d8c38d16f99d7b001b1f13dcc940330439db07b15ae13bbdfe3432136d69e1808dae1453da4c3285f1049ed9217dca7c3bf8def1bd56db59ac2d0a776d6295d849018919b285266ad210bb2e941e88a1e18d0111f2ceb3ddb2a73e6377763eedd280e3ab2bab4e6e47d4286e5134d5b92f4d19c3bca6a756eb997ca0ae1ad3ee17eae35a59b337873c707a327b1d07dca2a913e36750a04790c8f6d5455c690aec459ceb203c0dd07d70a8625f8fcd430c6f7cc51b426893d115ec56018dc6d5670082f0a36aa5d3ce5e77eae5f47f0e1bb94ee02fdca6be116496805c4ecbd2fe939e2e486a25c4837ae0d9b2c71cddaedb57b3ff30440da19693db6a42f624ad6412e60b5779d9fc968d1f89c4dbd30805a7348f6e15b1710d1140bf59a489c6924eb733f8f41b08808340ad7f3c7127903fe423ca9a278f3f7089f130ec81b659c454d64a78daa1ac201553ffd10a91ed3eeaf659aa744ccabb19be6b7d12942612432d8208072e47c663c31277359985366be880feaa633de44a37c94a5520edc258b51935075dc12cac428596259ef203efcd02d72d9d2f1218a7e539243d2f27ea922858e225697e60a4e46d5361260bc14ca9c59a455171b583399cea7dfaf5544dc14cbc0c52c600b168302002dc545e893369eefc652a4a218034b8321724e39ea51118092375f5d80b14dc10eb87a667ce2ea408f984c464352dccbcd833f7e9fb22367c65ca3130d6e0ff88a5b699c37092d3cc3eab4689b80218c7ecd741d8272080d7cf5112c8197888119919092f5920e18386976db4d5eb0bca497269a68fedaae38808fad5139a69617a7988c8fa820f087eed8e324414a9de1f0428787159b58360978459e17fa6ed9be76d246930063b606b33ddb4a2f4e3bde900a81b16ffbef20715c7f245764dffef8fbf9062d12458388a1ee85ddf27281bb664e37db94e485da63730972aa14e312ab945f60b8953ccf5d6e3d23fe454c1277c9b181d6e7dbfc2ea68e2bc2787beb20ae528284578f3742b8546481ae636be11c0caa66f66a7a567295cd76145fa8c343eecb1d0fff8cb4231060121bdd6a7e2659eac14a15be45421882a3c299d5f3a429ef34c58cbdbbf07ac47f00b965a04795461223419914b08b61dc206cd071e7ee531f56e4fad5183fc771bbfc76173452da45c74605a24c1a389e7220d61a9ea9d9f317753633ddb3847cd845084e042d48ea5958e67530e171cbf754393969e32dac2a4a156ee0e6b36492c532b5618844886cea118a31a25da9523920cdb3232a62f2f7c0846a483fbd01244c5ca387b148d547d9c79efe2ffcc660302001f67ca7409520c01a4432b50b3816eacb15d24535fc790184e297bc52ab0b9b86b357b4b52c7f79c24ce13a9e9e063cb3ffc75f9621545f9b1aae54a1ed5f3b0f8fe57d5718f5f9aa05d9a0699309ca49d21121b5f50adbfaf8467272d7f2351b80fe40d8666ef1de10bf625218ddb10870e9b4612697d43ff27bf24546a2f9d6e6840c65c8e3b217fb0f834f6ea5bbc2f86ee656b6427b876600d6293562f2fa1e926ade138d49f529e50622b19e76ccc1109f50bb8944a2edab0ed741e23f58316a0bd50ec182f5526df0996c72bcac72f0aaa13c7697066868ccf5235828486fa17df2e2c65ee9e25f014179d488cc8ed262e382a511be10df566499b1db05c4773836ad2afd08e99b11ec08e8b8369d4fb2b1b9dbbfd715b20c73820a5d7ecb79884ce83a544bb430d29ae3b68d4cf6ae46d52688ff9e1ab1c138969a0043e1120de21fc342e5790d21d55d53ae73ea24c902317c68021cafed837b3e9d29aa8aa65d845379181df78bbf844fbbe69c57e51bd59515800ad237dd3d398c048af4404498685029a4742955b027bf05804c7b77df1f5647e57223e3f832e9a98d167ee5e36a658be7781bb393b4894be5e0dd809c59cf6177cca8a0f7a5439fbbf6d62c0e7779bf676dacc73de229d59e438d4c6e22710d572f8d5d6add5aaa0091478f9c118fd6ced923c96b3a8c7a23b568c4f78513782280d12218937232a581e9d71ab583c5428db79c6ce8b5094daed1911d225ade7ab593662642529b63497afcc727bba68b7a45d2a5376ce5c254e5735d726cf7a85e830cbbb16ab07758a13e95aaf347ddd7b2e584f33d87f42ae754bbe762411476d382067d55a4ef92645e23f296ac35d1bb2599650ab3fcefbfa3d785d85bb0d94937ca1fd56f3e500c129a4f5762614471d6e47aec8ccbe98b6299f7046bd8f81616b4ec374eebfda3936cd9c95b2085dbb7ecc27bbcbbaecb73f0bf645ed25aeaf3a6c8cf094a25b943ee8e38df20da1fc17ea9adb3897057fcc3e2b66c3a59b2f26a36b81059aba95530213a6c1cda7efc0325a05319e6e8fdd11898f5d6a402592b5e34ab0d8d947c51407a3c5e28a383c08e5f344245d2a5615e5870705065f97eac40e7735883e053a018ac4c6b4effd8e2efc48c0debb6735e2e230f5870682acd80db874046c73abb5c4e57aa9ffce0437df882d93c23e4a6690427343c4c9760f802ff2d61957eb9f04bdd2562dc6bbfb4f2f4a2441e39e3caac5f42453d30f6e4d62c843ca8dd2cd18d8c82742ded576ccb1d8526329b99ed7213237d0770e4bdce9ed8ccaa26dcdc7e78f9ce736a62602172b400d510d4dbe60b0e0856f58aec2647610c50c769d881555e1a6e4361af6c6030408ed8040f42b258b75dfa0bad38a7cab4f064140c5ae064ae631a2a3c395cd422897487681fde40bd762fedcf2d6997cccc6736a4806df258960eb4aa198beb0d31d520a2f20907c99a28042e1b2a1871e01cda1dbfde1d18a3dba881df2a01a4f203c4ad70dbdac8b9dd338cef56d39d88c70234fcfd3221dca2b748a391ef043e4c4d347ecf29ccb78f5375227a6cb156d8686bab91ded1a9344d6a45b0d0bf7fb8d8976a00718c891fbd5a183c6e9e0b46f5895526a515ea759cdca62a11f8991a492379eb0f8f2fde5808e324bfc3bbdd8ee1cb4ac50902faae6bb2f8852c8891881df1f44c7bd5f1bf074fb4d71323c7a68111b8c734a2bc003de8160705e3d59fc5885b9f95e48e18d1edbd6d42dbde30667186232e9cd7e6977822322d4de8697fe453f67b625051782736ff688e623ee289a4baf8aa39aba98adc350bbc8bcc9576da57e6ff5fddbef43e442efcbf0d00c2cc28c84744d6b7b78b821434c3d2465818911083d994b8db8ad457d5133d31ca4a5ad6cbde7d86a6d53ed16ea060f80ba1008c4c3ad7625530266b567fc78a92a772ac8d46ef87b8674c1212b431d8dcfcf7d84f567534de9d34b1121fd085e4d64f70656b0e82e62528251269741898ad970d3fb8f57863e771d9325477987b238a0c70725b508bbc60e2a862479208008612a062f3b06ae0591aab4181d3fa175729e794a5b2fbf1f8f54d069253e153fd056598a0d6696d52afe20fa62d510bcfcc833cfae4ef72e3a0dd74cba37a94042a9e8095b53551eedd5329c4e7f8dd2269e5c5b073ebdc37d578633e25ee98ad11ed3426d1f0ece985d326634eebd4f4c629600e4a1f247fd30700ce50b21a8485c252f20e5f8240737949cf2d26bcc6f52aad16cd15b0ad5dcb5c7c5c100b08d106b8adabf03ea10a39a544e066fefa969a01e5f0ee413e57417621b9939a700dd592740bb2d0d82d2eecd2f0b7fa149ab4f8d8555fdf4226b4d6cd4061be9e084e98f8fdd9bac3b0ed159e7115cbce73b0f701990a53ebaf268088f567a4f0429cc3e87dcbf86eb6ba10cef323e7d13047eecd38603ba0d9d384d9ecd46ca3e048a5efbdee6a90033c4290e7798668e87a017547007b65ebc92c332018619afeabdb45de08ae369e7d6b5697ed409d06254dec48adbb7e776edb47b6db4459f75aa5cc0028c3ef5a9c1fe44fddb5cc4fcdee710ee7f7f1cc5a73ebeba98b69d9554231fc078c665ab138673fd6d649205da9e96b3192af8e5be2c8b3801d3729457c253d0414183cbf0a3f0501ca03b30ab161388725495e96053abbbbbee5f9f678c0d92f336f3a164f77e485bb62b752ac4a2c9635e50df001332a08480a987448b1b3e03336173af108978bbb9569e7cb1e9ed3178b31514e0da91316571bae875a57c930bf412fed0a1b9dda517e888b4ba1e5180a806bece9abef1bbf2086bd22abd694edb2f8a309bdc223dc084c5727d5e31790a36db05b29951193a8a1707ad92e7154983f40c4ae44a36d0a71062cd19b6990de01c5fd5e9774523d6818fd572807d629b8f0af42cd326e408cff58c8f220b83d612e72c5a3dabb31e86ec4db7c39a6d4dc01a03cf67958ed165027206fea2c44cf7ddbe1d4db01e8a0f25e1fbc1f6f02b720cac090a3861deef6ef111a3be9919ffe2f2d9daedbf1e73082512470aa1d84f953268fb0840f5a05c2e0fdae06773be59f2afe0941250a44bba9aed7a85e56bf2e59e7cf3d34458a15c6638d910274b64e18a3948d9b2195760fdc7522c4d7962f73a80dacf21d93774898078701b850a69db50de72610fd97fd71be45396d3edca0a504b573195e12818a19bba189c5e46b7b612c2ba044540090a6c77db80b2271f4648444a0a209842c1a217b18c8362c5334e509cd5a84f7ca09204befd0b8214568a4992b36515d93c8e0a9ad91dd83ae7012b6e57bbd47338324f47ff216ec4b0cc336335eb5c556e22470001021b89d917703c85c2e30cfa589aab02514c82171e126358d3b0cda3a97dedeffd6a505ea9a", 0x1000, 0xfffffffffffffffc) keyctl$reject(0x13, r1, 0x3, 0x200, r2) syz_open_dev$usbmon(&(0x7f0000000280)='/dev/usbmon#\x00', 0x7, 0x185200) sendmsg$nl_route(r0, &(0x7f0000000700)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f00000006c0)={&(0x7f0000000500)=@getlink={0x5c, 0x12, 0x331, 0x0, 0x0, {}, [@IFLA_NUM_TX_QUEUES={0x8, 0x1f}, @IFLA_IF_NETNSID={0x8, 0x2e}, @IFLA_LINK_NETNSID={0x8, 0x25}, @IFLA_PROMISCUITY={0x8, 0x1e}, @IFLA_WEIGHT={0x8, 0xf}, @IFLA_VF_PORTS={0x14, 0x18, [{0x10, 0x1, [@typed={0x8, 0x0, @u32=0xfffff000}, @generic=' ']}]}]}, 0x5c}, 0x1}, 0x0) r3 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x3a, 0x20000) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000240)={r0, r3, 0x3, 0x1}, 0x10) 2018/04/13 16:41:40 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1038.161776] binder: 7423:7427 got transaction with invalid offsets ptr [ 1038.194617] binder: 7423:7427 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:41 executing program 2: r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[]}, 0x1}, 0x4000000) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x80, 0x10000) getsockopt$sock_int(r0, 0x1, 0x82a5ffe3ae63f536, &(0x7f0000000100), &(0x7f0000000340)=0x4) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in=@local}}, &(0x7f0000000080)=0xe8) bind(r0, &(0x7f0000000180)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @multicast2=0xe0000002}, 0x1, 0x1, 0x3}}, 0x80) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000380), 0x4) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f00000000c0)=r2) 2018/04/13 16:41:41 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x2000000802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000f68000)={@loopback={0x0, 0x1}, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x21, &(0x7f000089b000)=0xffffffffffffffff, 0x4) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000380)={@mcast1={0xff, 0x1, [], 0x1}, 0x0, 0x0, 0xff, 0x3}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000140)={@local={0xfe, 0x80, [], 0xaa}, 0x0, 0x0, 0xff, 0x1}, 0x20) connect$inet6(r1, &(0x7f000000cfe4)={0xa, 0x4e20, 0x807}, 0x1c) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@mcast2={0xff, 0x2, [], 0x1}}, &(0x7f0000000040)=0x20) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000080)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, &(0x7f0000007000)={0xffffffffc0000001}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000cda000)) getsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f00000002c0), &(0x7f00000003c0)=0x320) poll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x2}, {r2, 0x211}, {0xffffffffffffffff, 0x8}, {r0, 0x100}, {0xffffffffffffffff, 0x8000}], 0x5, 0x53) r3 = socket(0x1b, 0x5, 0x9) getsockname$packet(r3, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000000c0)=0x14) epoll_wait(r2, &(0x7f000029bfdc)=[{}], 0x1, 0x0) epoll_wait(r2, &(0x7f0000cd8ff4)=[{}], 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000100)={{0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}, {0x1, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x6, {0x2, 0x4e21, @multicast1=0xe0000001}, 'teql0\x00'}) poll(&(0x7f0000000380)=[{r0, 0xfffffffffffffffc}], 0x3ce, 0x8) poll(&(0x7f0000000340)=[{r0, 0x8}, {r2, 0x4}, {r3, 0x1100}, {r2, 0x8028}], 0x1ffffffffffffcc9, 0x800) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000180)=@req3={0x0, 0x40, 0x6, 0x6, 0x2, 0x9, 0xffffffffffffffcf}, 0x1c) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f0000000240)={&(0x7f0000000200)=[0x3, 0x1, 0x101, 0x2, 0xde8, 0x478, 0x1, 0x3ff, 0x2035001300000000], 0x9, 0x800, 0x1f, 0x8, 0x2, 0x0, {0xf590, 0x5, 0x2, 0x6, 0x9, 0x80, 0x5, 0x1, 0x7, 0x9, 0x80, 0xffffffff, 0x2, 0x6, "4d8d20a00e68ed59eb7e97b08524f8b4d17ec60e2671ef2ea932486f1d545fb9"}}) 2018/04/13 16:41:41 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x1100, @loopback={0x0, 0x1}}, 0x1c) [ 1038.243816] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:41 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4000000) r1 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x1, 0x8000) ioctl$KVM_GET_XCRS(r1, 0x8188aea6, &(0x7f00000001c0)=ANY=[@ANYBLOB="06000000040000000900000000000000710a00000000001300000080000000003f000000000000002e00000000000000000059a4b2c3ce79bd4113a6024200000100000015000000000000003a07000000000000ffffffff00000000ffffffffffffffff06000000"]) r2 = openat(r1, &(0x7f0000000140)='./file0\x00', 0x8000, 0x4) sendmsg$nl_route(r0, &(0x7f000001bfc8)={&(0x7f0000db4000)={0x10}, 0xc, &(0x7f00006bcff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000001800010300000000000000000a00000000000000000000000800150006000000080016000400020069a3fe6d43e1e2e348f78f661858cf6a546fa6ff0f22062c4e57ea6785757dcefc7f0091db296aae3f35017f8f03003ed6720af2f38ffd25fe67b30d5377f149b79473e479633c184c0e6f0e5bef6b5517cee35ab95849f05b6db6f08b79c5f12d63f685297b63dc9934fea36297c338"], 0x2c}, 0x1}, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r1, &(0x7f0000000240)="2375d79112b5759fae23fd680898f96563c660702d0113d0bed125b38d3f52d93fad36b626543031565fad5290677c53fd2db7ef266e44abf19c4213f95a51bf5c32ff5f060f95383721fcbc6f20a75d4a390ddb86481281c41e588a9bf1d8e65602b2cbe05e409f5ca9fa65a1f5e8cd338388f669ede0f51cb5b859a98117ad08918b5fec7703d641070aee9d7469605021eebd2e9ac3f5f7c09c666116b7e41fb2374c281fbe66eab82bfb4e86", &(0x7f0000000300)=""/168}, 0x18) socket$alg(0x26, 0x5, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r2, 0x50, &(0x7f00000003c0)}, 0x10) iopl(0xa41) [ 1038.287782] binder: 7423:7427 ioctl 40046207 0 returned -16 2018/04/13 16:41:41 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000001000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:41 executing program 6: add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xffffffffffffffff) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000002c0)="2f70657405007076342f76732f616d656d746872657368000000000000000000002c5818c53ad25a422d3256cb353a", 0x2, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000001300)=@int=0x7, 0x4) bind$nfc_llcp(r0, &(0x7f0000001440)={0x27, 0x0, 0x2, 0x4, 0x1, 0x401, "b85f088ca59ed43fa9df8985568190c572bb84ef858a78327baee138d81b37686d646bd35a6080009475f743212aa2ba2eda7ed318ab49a8659031105c26a6", 0x16}, 0x60) r1 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000001c0), 0x0, 0xfffffffffffffffe) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f00000001c0)) r2 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000001200)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, r1) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000000)="120000004e001f0014f9f400000000000300", 0x12) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f00000011c0)={0x1, r3, 0x1}) keyctl$restrict_keyring(0x1d, r2, 0x0, 0x0) r4 = socket$vsock_dgram(0x28, 0x2, 0x0) close(r4) r5 = getuid() setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000001340)={{{@in6=@local={0xfe, 0x80, [], 0xaa}, @in=@rand_addr=0x8, 0x4e20, 0xffffffff80000000, 0x4e21, 0x7, 0xa, 0x0, 0x80, 0x6c, 0x0, r5}, {0x5, 0x1, 0x7f, 0x80, 0xfe98, 0x5, 0x6, 0xf3b3}, {0x5, 0x8, 0x5, 0x38}, 0x8, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in=@remote={0xac, 0x14, 0x14, 0xbb}, 0x4d3}, 0x0, @in6=@mcast1={0xff, 0x1, [], 0x1}, 0x3507, 0x1, 0x3, 0xf6, 0x9, 0x12f, 0x20}}, 0xe8) 2018/04/13 16:41:41 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f000053b000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x2000000005452, &(0x7f0000008ff8)=0x3f) fcntl$setown(r2, 0x8, r1) fcntl$setsig(r2, 0xa, 0x12) poll(&(0x7f0000027ff8)=[{r3}], 0x1, 0x8000) dup3(r0, r2, 0x0) tkill(r1, 0x16) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r4, &(0x7f00000003c0)=@set_option={0xe, 0x18, 0xfa00, @ib_path={&(0x7f0000000300), 0xffffffff, 0x1, 0x1}}, 0x20) [ 1038.365642] binder: undelivered TRANSACTION_ERROR: 29201 [ 1038.381397] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:41 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x7800, @loopback={0x0, 0x1}}, 0x1c) [ 1038.415444] binder: 7460:7461 got transaction with invalid offsets ptr 2018/04/13 16:41:41 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1038.470872] binder: 7460:7461 transaction failed 29201/-14, size 40-8 line 2991 [ 1038.488249] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1038.505341] binder: BINDER_SET_CONTEXT_MGR already set [ 1038.535196] binder: 7460:7461 ioctl 40046207 0 returned -16 [ 1038.650556] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:42 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000ff0)=[{0x28, 0x0, 0x0, 0xfffffffffffff020}, {0x80000006}]}, 0x10) 2018/04/13 16:41:42 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x10000120, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:42 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x30800, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000180)={'ipvs\x00'}, &(0x7f00000001c0)=0x1e) getpeername(r0, &(0x7f00000000c0)=@in, &(0x7f0000000140)=0x80) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x1bf}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x5, &(0x7f0000002000)=@framed={{0x18}, [@jmp={0x5}], {0x95}}, &(0x7f0000003ff6)='syzkaller\x00', 0xea49, 0x404, &(0x7f00001dcf3d)=""/195}, 0x48) 2018/04/13 16:41:42 executing program 6: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x400, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f0000000080)) getuid() r1 = getpid() r2 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0xfffffffffffffffd, 0x0, 0x0, 0x5}, r1, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x70, 0x100, 0xbee6, 0x816, 0xfab, 0x0, 0x0, 0x0, 0x2, 0x3c7, 0x7, 0x558, 0x8a, 0x8001, 0x19e, 0x1, 0x3ff, 0xff, 0x9, 0xfa9, 0xee, 0x5, 0xff, 0x3, 0x8, 0x865f, 0xfffffffffffffffb, 0x100000001, 0x7ff, 0x1, 0x2, 0x400000000000, 0x7, 0x30, 0x1, 0xffffffff, 0x2, 0x0, 0x7, 0x2, @perf_bp={&(0x7f0000000180), 0x2}, 0x8, 0x3, 0x5, 0x4, 0x3, 0x7, 0xf6ce}, r1, 0x6, r2, 0x9) read(r3, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000140)={0x0, 0xfffffffffffff000}, 0x270) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f000019ffe9)={0xc1}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000004c0)={r0, &(0x7f00000002c0)="0ddb809090782cf45a10e1ac11f014ea2a10a29e63b66c5d82c6eacc0f96fcaad4cf44cd698a9dc85fea2b29e84a6dee0caffd59a97c163e4458fd4954a56b33276558cc39eda6a389401cf9b1e5ededdfffa270b850eceb4bbeee9c49c4c4fd67788708381e08ade4d3c8971ae9db2591eeeeaaf72bce5d3a3020a9675a7c60390bc32e7a40376adef7416718726eada9954c7deb6bf14b98cf5868328ca74c4bf970756c03e672f4abc102e56cea4ad7a97c34eabe9a1dda3d45d63c19b1a7299d1e955a48c4f38a489933f962d1471d356c9b5c852d71a3b596fca148dccce7", &(0x7f00000003c0)=""/218}, 0x18) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000280)=0x100000000, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000500)='/dev/sequencer2\x00', 0x0, 0x0) openat$cgroup_subtree(r0, &(0x7f0000000240)='cgroup.subtree_control\x00', 0x2, 0x0) 2018/04/13 16:41:42 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:42 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:42 executing program 2: socket$alg(0x26, 0x5, 0x0) socketpair$inet6(0xa, 0x807, 0xfb, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x7f, 0x5, 0x4, 0x0, 0x2}, 0x14) socket$inet_tcp(0x2, 0x1, 0x0) delete_module(&(0x7f0000000280)='eth1$\'GPLowlan1/GPLcpuset.nodevlo}\x00', 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000b3dfc8)={&(0x7f0000001580)={0x10}, 0xc, &(0x7f00000015c0)={&(0x7f0000abf000)={0x14, 0x22, 0x109, 0x0, 0x0, {0x4}}, 0x14}, 0x1}, 0x0) 2018/04/13 16:41:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1039.803244] binder: 7495:7499 got transaction with invalid offsets ptr [ 1039.836192] binder: 7495:7499 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:42 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1039.861480] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:42 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xffffffc0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:42 executing program 4: r0 = socket(0x5, 0x0, 0xffffffffff000003) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={0x0, @in6={{0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, [], 0xa}}}, 0x3f, 0x2, 0x0, 0x6, 0x12}, &(0x7f00000003c0)=0x98) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000600)=r1, 0xfffffffffffffda9) r2 = open(&(0x7f0000d93ff8)='./file0\x00', 0x80040, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000000)={0x0, 0x0, 0x7}) add_key$keyring(&(0x7f0000000880)='keyring\x00', &(0x7f00000008c0)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffff8) mkdir(&(0x7f0000000940)='./file1\x00', 0x28) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000040)={r3, r4}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f0000000640)=""/101) r5 = open(&(0x7f0000000240)='./file0\x00', 0x14104a, 0x0) setsockopt$inet_mreqsrc(r5, 0x0, 0x2f, &(0x7f0000000280)={@loopback=0x7f000001, @remote={0xac, 0x14, 0x14, 0xbb}, @multicast2=0xe0000002}, 0xc) write$evdev(r5, &(0x7f0000037fe8)=[{{}, 0x0, 0x100}], 0x18) sendfile(r5, r2, &(0x7f00009bcffe), 0x4c35) ioctl$DRM_IOCTL_GEM_FLINK(r2, 0xc008640a, &(0x7f0000000480)={r4, r3}) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="136a9296e5e59cda77e5f7d313fdefac0730c0fc366b02e1"], 0x1}, 0x1, 0x0, 0x0, 0x40}, 0x80) lseek(r2, 0x0, 0x3) r6 = socket$inet6(0xa, 0x80001, 0x0) write(r0, &(0x7f0000000300)="4942a8f521acee925407453e90c273", 0xf) ioctl$void(r5, 0x5450) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) ptrace(0x8, r9) nanosleep(&(0x7f00000000c0)={r7, r8+30000000}, &(0x7f0000000100)) setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x2a, &(0x7f0000003f00)={0x0, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x45c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000140)={@mcast2={0xff, 0x2, [], 0x1}, 0x5, 0x1, 0x0, 0x8, 0x9, 0xffffffff00000000, 0xfff}, 0x20) syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x0, 0x0) getsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f0000000000), &(0x7f0000000040)=0x4) [ 1039.884124] binder: 7495:7499 ioctl 40046207 0 returned -16 2018/04/13 16:41:42 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1039.988296] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1040.010801] binder: undelivered TRANSACTION_ERROR: 29201 [ 1040.023308] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000200000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:43 executing program 0: syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="8da4363a00000000000000000000000000000000000000000000000000000000ecf6f2a3299748aeb81e1b00920efd9a000001000000000001000000000000005f42485266535f4d", 0x48, 0x10000}], 0x0, &(0x7f0000000900)=ANY=[]) socketpair(0x3, 0x7, 0x6, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000180)={'ipddp0\x00', 0xca}) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000340)={{{@in=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}}}, &(0x7f00000000c0)=0xe8) r3 = getgid() fchownat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', r2, r3, 0x1000) 2018/04/13 16:41:43 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x3, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:43 executing program 4: r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) write$binfmt_script(r0, &(0x7f0000000140)={'#! ', './file0', [{0x20, ']'}, {0x20, "7b267070703129f32d"}, {0x20, '{$'}], 0xa, "10c69c8de344225c3bfa679bbf0fd5dd6cf8e55186d480c51e910b1cf9fd41be"}, 0x3a) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000100)={@multicast2=0xe0000002, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, 0x1, [@loopback=0x7f000001]}, 0x14) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000200)={@multicast2=0xe0000002, @local={0xac, 0x14, 0x14, 0xaa}}, 0xc) 2018/04/13 16:41:43 executing program 2: r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x9, 0x400140) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000080)={0xff, 0x1, 0x0, 0x7fffffff, 0x5f2, 0xffffffffffff745d, 0x9}, 0xc) r1 = socket$can_bcm(0x1d, 0x2, 0x2) r2 = socket$can_raw(0x1d, 0x3, 0x1) close(r2) ioctl$sock_SIOCGSKNS(r1, 0x894c, &(0x7f0000004000)) preadv(r2, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/15, 0xf}, {&(0x7f0000000100)=""/156, 0x3be}, {&(0x7f00000001c0)=""/37, 0x25}, {&(0x7f0000000200)=""/210, 0xd2}], 0x10000155, 0x0) fcntl$dupfd(r0, 0x0, r2) setsockopt$sock_void(r2, 0x1, 0x3f, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000fc8)={&(0x7f0000008ff4)=@proc={0x10}, 0xc, &(0x7f0000008000)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="6c5e929d2cd11da4ff0400000000383cba"], 0x1}], 0x1, &(0x7f0000008f90)}, 0x0) ioctl$sock_SIOCINQ(r2, 0xc0189436, &(0x7f0000000000)) 2018/04/13 16:41:43 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:43 executing program 6: bpf$MAP_CREATE(0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x3, 0x17, 0xffffffffffffffff, 0x2}, 0x2c) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x8000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000040)={0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000080)=0x2c) 2018/04/13 16:41:43 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffea], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1041.064640] binder: 7548:7553 got transaction with invalid offsets ptr 2018/04/13 16:41:43 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:43 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f000075bff7)='/dev/rtc\x00', 0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4008700c) pipe2(&(0x7f0000000000), 0x4000) [ 1041.108226] binder: 7548:7553 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:43 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x800000000000000, @loopback={0x0, 0x1}}, 0x1c) [ 1041.155337] binder: BINDER_SET_CONTEXT_MGR already set [ 1041.166957] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1041.183810] binder: 7548:7553 ioctl 40046207 0 returned -16 2018/04/13 16:41:44 executing program 6: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(&(0x7f0000000180)='./file0/bus\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='sysfs\x00', 0x0, &(0x7f00000001c0)) r0 = open(&(0x7f00000004c0)='./file0\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x8000002a) rename(&(0x7f00000001c0)='./file0/bus\x00', &(0x7f0000000240)='./file0/bus\x00') openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) 2018/04/13 16:41:44 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:44 executing program 2: r0 = socket(0x40000000015, 0x5, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f0000000080)=0xffffffffffffffff, 0x4) close(r0) 2018/04/13 16:41:44 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000080)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x2000000000}) fgetxattr(r0, &(0x7f0000000040)=@random={'os2.', 'em0wlan0\x00'}, &(0x7f00000000c0)=""/107, 0x6b) [ 1041.238464] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:44 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x1100000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Pp\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:44 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:44 executing program 0: r0 = perf_event_open(&(0x7f0000220000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x3, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000700)={0x0, 0x0}, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f0000000080)=r2) socketpair(0x5, 0x2, 0x80000000, &(0x7f0000000040)) splice(r1, &(0x7f0000000280), r0, &(0x7f00000002c0), 0x7b, 0x0) 2018/04/13 16:41:44 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00\x00@\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1041.343462] binder: undelivered TRANSACTION_ERROR: 29201 [ 1041.404169] binder: 7595:7598 got transaction with invalid offsets ptr [ 1041.455317] binder: 7595:7598 transaction failed 29201/-14, size 40-8 line 2991 [ 1041.492610] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1041.493414] binder: BINDER_SET_CONTEXT_MGR already set [ 1041.545664] binder: 7595:7598 ioctl 40046207 0 returned -16 [ 1041.549926] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:44 executing program 6: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x1, &(0x7f0000001fe8)=ANY=[@ANYBLOB="b04bca436248580467"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000001fd8)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x25}, [@ldst={0x7}], {0x95}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x437, &(0x7f000000cf3d)=""/195}, 0x48) r1 = socket(0x10, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) write(r1, &(0x7f00000005c0)="260000005e0009000000eaf83a0000000000000001000000ffffff000008db1ee9ff4435eade", 0x26) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x8, 0x200) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) 2018/04/13 16:41:44 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:44 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000000), &(0x7f0000000040)=0x1) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x6, 0x4) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x8}, 0x10) sendto$inet6(r0, &(0x7f0000000240)="0401000000e3cd682c46090000b24066514d670600c0e180283db150877eac3587ca92a0cc14ab6650782299e6234d243eb9576f4ddb90797d34c3946570ccf83c46", 0x42, 0x0, &(0x7f0000000200)={0xa, 0x800, 0x2, @remote={0xfe, 0x80, [], 0xbb}}, 0x1c) 2018/04/13 16:41:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_buf(r0, 0x0, 0x482, &(0x7f0000000000)=""/24, &(0x7f0000f08ffc)=0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'teql0\x00'}) 2018/04/13 16:41:44 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x3f00000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:44 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000100", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:44 executing program 0: syz_mount_image$btrfs(&(0x7f0000000040)='btrfs\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f0000001380), 0x0, &(0x7f0000000100)={[{@subvol={'subvol', 0x3d, [0x34]}, 0x2c}, {@subvol={'subvol', 0x3d, [0x38]}, 0x2c}]}) 2018/04/13 16:41:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000600000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1041.602769] binder: undelivered TRANSACTION_ERROR: 29201 [ 1041.656146] binder: 7624:7633 got transaction with invalid offsets ptr 2018/04/13 16:41:44 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:44 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x78000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:44 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@generic, &(0x7f0000000180)=0x80, 0x80000) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000001c0)={0x9, 0x208, 0x90, 0x6, 0x0}, &(0x7f0000000200)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000240)={r1, @in6={{0xa, 0x4e22, 0x6, @dev={0xfe, 0x80, [], 0xb}, 0xffffffff}}, [0x1, 0x8, 0x1, 0x7, 0x2, 0x3, 0x8000, 0x8, 0x3, 0x40, 0xbd1, 0x0, 0x80, 0x3, 0x80000000]}, &(0x7f0000000340)=0x100) pipe2(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) io_setup(0x7, &(0x7f0000a8aff8)=0x0) write$selinux_load(r2, &(0x7f0000000440)=ANY=[], 0x94) io_submit(r4, 0x1, &(0x7f0000b52fd8)=[&(0x7f0000587000)={0x0, 0x0, 0x0, 0x8, 0x0, r3, &(0x7f000096f000)="06000000000000009d", 0x9}]) r5 = add_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000000c0)="6c45b6f759c87556f32a74a1cd34a0b969b798aa8c94c2fea97a9c0d56a1ab8c887b", 0x22, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r5, 0xffffffffffffffcf) [ 1041.697714] binder: 7624:7633 transaction failed 29201/-14, size 40-8 line 2991 [ 1041.730223] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:44 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r0, 0x4) r1 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000140)={0x3ff, {{0xa, 0x4e23, 0x3, @mcast2={0xff, 0x2, [], 0x1}, 0x3ff}}, {{0xa, 0x4e22, 0xfffffffffffff000, @remote={0xfe, 0x80, [], 0xbb}, 0x1}}}, 0x108) sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00009b2ff0)={0x1, &(0x7f0000a7dff8)=[{0x6, 0x0, 0x0, 0x400000000000003}]}, 0x10) sendmsg(r1, &(0x7f0000ff1000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)='q', 0x1}], 0x1}, 0x2000c000) close(r1) 2018/04/13 16:41:44 executing program 4: capset(&(0x7f0000fb2000)={0x19980330}, &(0x7f00000001c0)) r0 = socket$netlink(0x10, 0x3, 0xf) writev(r0, &(0x7f0000312ff0)=[{&(0x7f0000000080)="480000001400190d090043eafd068c560affffffffe006004543984fb2bff49a3326a6ffffffff00000000bc5603ca00000fff890000000309ff5bff87c3e4cb6b716c0123b261a2", 0x48}], 0x1) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x505000, 0x0) ioctl$KVM_TRANSLATE(r1, 0xc018ae85, &(0x7f0000000040)={0x1000, 0xd000, 0x7, 0x4c26b3a9, 0x3e}) [ 1041.752721] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:44 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1041.803423] binder: 7624:7633 ioctl 40046207 0 returned -16 [ 1041.814432] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:44 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x11, @loopback={0x0, 0x1}}, 0x1c) [ 1041.904323] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000012000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:45 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:45 executing program 2: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000440)=0x0) r1 = getuid() ioprio_get$uid(0x3, r1) r2 = syz_open_procfs(r0, &(0x7f00000004c0)="3f00736e0078360076939120183a35f31f60d096939f8a4092932050a3cfd650adca09ff36e1bfad5137feb18277a4ccfc9248b2a52b188277f499c9fb6da8b70ba5911320ab71cc30eb6fd31efec47ca4d1499187bac036cfe95f82dbea73e05682688004c116d87bf6ea00000000") getdents64(r2, &(0x7f0000000040)=""/1024, 0x400) setsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000000)={0x1beac00000000000, 0x8, 0x1d, 0x9}, 0x8) fsetxattr(r2, &(0x7f00000008c0)=@random={'os2.', '\x00'}, &(0x7f0000000900)='msdos\x00', 0x6, 0x1) syz_mount_image$msdos(&(0x7f0000000580)='msdos\x00', &(0x7f00000005c0)='./file0\x00', 0xa0e7, 0x3, &(0x7f0000000800)=[{&(0x7f0000000600)="476716f441bb49976fa7c59873807be38e238d091539fc16bd597845bc1d8522dfe200e2a4c2138b86aba1efa188d1067d7ce941ce409b93acea3117d817b05f066727eb5609a0982a49acfa99e42750b87c55eb3dd85cee0a7a87003935eb29de05badf55cc456cc3197fcc6dd8f7a04403dd2d7c85e1b84a5040670acb2336b4a57a808f14a077630067b815080fdd0c8d18fe66cd0177e77a1985c877ff1ca0927ce9c4f3dc9fe6da54958fdabb45c82aa9f52c60e78e260eb28808ab08cf", 0xc0, 0xffff}, {&(0x7f00000006c0)="5b9f1a9decf9149588b5cf90d864710e072b6d53e9fefd1c48aefc24b8b670986176a78cd8b4d0118721116f2a6c8ea6d452d83d96fa044ac24a321a21ce8472853cc8b238713582509ce2aef9938297d71c558bd6a1313948610769b72966b4de6e9ab88e8871df2a8211b52df5bf0bcee41a85f269a1545f1021a616edfeb13900b7987e82a2fe63162df1aeb452f61ea57ec84bf4bb1cd9b6284928eda712b853c033a8fb1161bd7026d3198bbf", 0xaf, 0x6}, {&(0x7f0000000780)="f8198934645381fd52d68e82a81555eef2ca5a187453ccb78dc523ee08cd644a5ebab508240f8ff3ff97fce58f32242b5a8b20c8125fadd433c7fa9eaa56f966d96b42ff896179de8be3c3799aee080a712c0d91f213b7673b378a196a3b869f7364f720ffa076d4c6a705", 0x6b, 0x5}], 0x10, &(0x7f0000000880)={[{@allow_utime={'allow_utime', 0x3d, [0x33, 0x34, 0x37]}, 0x2c}, {@showexec='showexec', 0x2c}]}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000540)={{&(0x7f0000ffb000/0x4000)=nil, 0x4000}, 0x3}) getdents(r2, &(0x7f0000000480)=""/24, 0x1d5) prctl$setfpexc(0xc, 0x80000) 2018/04/13 16:41:45 executing program 6: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00007de000)={0x0, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x3bb) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000becf78)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000380)={0x8, {{0xa, 0x4e23, 0x80000001, @mcast1={0xff, 0x1, [], 0x1}, 0x3a}}}, 0x88) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000480)={0x0, @in6={{0xa, 0x4e22, 0x5, @remote={0xfe, 0x80, [], 0xbb}, 0x800}}, 0x38c4, 0x8001, 0xe120, 0x80000000, 0x61}, &(0x7f0000000440)=0x80) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYBLOB="e1000000f13b9b390fe77d2c5f942ac2d55d389eb73dbd6d93b533ff56bb278bce2adcd57a341b2378444ac9b48f612b73139319eb4dc1a183beeff464897d91a06a0203c4c47e8177629e1f77967e13415dc680c41976524836da03f37b48f0a0d8647a2c6038d190554595f5ca4b8f2b7bd62319b56bc3b4a5e0067c0d22d14b552f8e65ccb5cae5bc1c021cf4dc7e4e6bed39e66f78cf7bff7e35130f44e08c04604f76c425253ef4146de517917e62dbd7dfab1e9e4fe20282f11b189ffa48bece10114b31dc7d70f9e6518f49fabd4eb2c29c319da272282ec789f92e2c5799d645c3"], &(0x7f0000000340)=0xe9) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x450) 2018/04/13 16:41:45 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000f75fc8)={0x0, 0x0, &(0x7f0000805000), 0x0, &(0x7f00002e7000)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) io_setup(0x1, &(0x7f0000f7e000)=0x0) io_submit(r2, 0x1, &(0x7f0000738000)=[&(0x7f0000f73fc0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f000079a000)="16", 0x1}]) getsockopt(r1, 0x10001, 0x14965bbb, &(0x7f0000000080)=""/171, &(0x7f0000000140)=0xab) 2018/04/13 16:41:45 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:45 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net\x00', 0x200002, 0x0) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x1023c) ioctl$DRM_IOCTL_INFO_BUFS(r0, 0xc0106418, &(0x7f0000000140)={0x148d, 0x8, 0x7fff, 0x10000, 0xa, 0x6}) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000000580)=ANY=[@ANYBLOB="6d616e676c65000020000000e640cf840b0000001aaa8bcbc7f9472dfac074f36c3f235a61c734b901b257d30be5c02ac45e002f9006f1bcb69d77015a2ada0d4cc2e1a803e62be12d1bb51945e5e5fa09acf790730963cd472470f5a3155da649bfef4016306914849b162a86c979590845aa29d79a4bae23571f4f1396732f9515821c1233342866317a8dc26ba808b31b9996515d8237ee0bb62dc893dcb04adeb7b8"], &(0x7f0000000380)=0x1) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000000)) fallocate(r0, 0x0, 0x0, 0x0) inotify_init1(0x0) r1 = open(&(0x7f0000fa3000)='./file0\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000400)=0xaa) r2 = dup2(0xffffffffffffffff, r1) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000280)=""/192) setsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000040), 0x4) epoll_wait(0xffffffffffffffff, &(0x7f00000003c0), 0x0, 0x0) unshare(0x20000000) r3 = getegid() r4 = dup(0xffffffffffffffff) ioctl$EVIOCSABS0(r4, 0x401845c0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xf4, 0x93, 0x4}) setfsgid(r3) clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) r5 = getpid() ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f00000003c0)=r5) wait4(0x0, 0x0, 0x40000000, &(0x7f0000781f70)) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x60010, r1, 0x0) ioprio_set$pid(0x2, 0x0, 0x4001) pipe(&(0x7f0000000340)={0xffffffffffffffff}) ioctl$DRM_IOCTL_SG_ALLOC(r6, 0xc0106438, &(0x7f0000000240)={0x6}) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f00000001c0)={0x0, 0x6, 0x30, 0x100000000, 0x3f}, &(0x7f0000000440)=0x18) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000480)={r7, @in={{0x2, 0x4e20, @rand_addr=0x9}}, 0x7, 0x200, 0x8000, 0x6}, &(0x7f0000000540)=0x98) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000180)=@assoc_value={0x0, 0x9}, 0x8) clone(0x0, &(0x7f000052cf69), &(0x7f0000850ffc), &(0x7f0000e9b000), &(0x7f0000ce4000)) 2018/04/13 16:41:45 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xffffffff00000000, @loopback={0x0, 0x1}}, 0x1c) [ 1042.913967] binder: 7681:7687 got transaction with invalid offsets ptr 2018/04/13 16:41:45 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:45 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xfe800000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:45 executing program 2: r0 = socket$inet6(0xa, 0x2100000000000002, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in=@multicast2=0xe0000002, 0x4e20, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x80}, {}, 0x0, 0x0, 0xfffffffffffffffe}, {{@in=@dev={0xac, 0x14, 0x14}, 0x0, 0x33}, 0x0, @in6=@remote={0xfe, 0x80, [], 0xbb}, 0x0, 0x3}}, 0xe8) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x4}, 0x1c) [ 1042.967783] binder: 7681:7687 transaction failed 29201/-14, size 40-8 line 2991 [ 1043.033447] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1043.035981] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:45 executing program 6: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x282, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e21, 0x200000, @empty, 0xf1a}, @in={0x2, 0x4e21, @broadcast=0xffffffff}, @in={0x2, 0x4e24, @multicast2=0xe0000002}, @in6={0xa, 0x4e23, 0x3ff, @local={0xfe, 0x80, [], 0xaa}}], 0x58) r1 = socket$inet(0x10, 0x0, 0x4) sendmsg(r1, &(0x7f0000014000)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa2830007a6008040010000000000683540150024001d0004c41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d4c1cbc882b079881", 0x4c}], 0x1}, 0x0) [ 1043.097837] binder: 7681:7687 ioctl 40046207 0 returned -16 [ 1043.111240] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1043.199331] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:46 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:46 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={&(0x7f0000000080)={0x10, 0x2, 0x0, 0x8020820}, 0xc, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001d001305000000000000000002000000", @ANYRES32=0x0, @ANYBLOB="00ffe1070001000000000000"], 0x24}, 0x1}, 0x0) 2018/04/13 16:41:46 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xff000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:46 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x5}, 0x1c) sendmmsg(r0, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f00000003c0)}}, {{&(0x7f00000004c0)=@in={0x2, 0x4e20, @broadcast=0xffffffff}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000000)="4c58896126d56626b8007763ad7753cd29df77fc4bec3c24d0fc388e9e0cdab50ab056df38a7d143b07080a432a4d2af03805e571fca59cd1ce900e32d258232a4abc11c735afaa9914d44b495dfdb07036bb4c6fd0f795703dde7cb8a68efae578727c30c52ea3443a9ce6434cef17ec577e32a33a708802e9aab4e0fe0896747c9fbb8e7710e189bdd5609372d38e3bad240b9522315ddde106c3ffe023191a3349d8a7a60f9b456e56dbfbb2c0068a925c3584f349b1bb0", 0xb9}, {&(0x7f00000000c0)="f402803248a789c1d18f633cfec2b801e03a670a9fe254610affcb724fe18406a6b3953c0565fcb5ae3b2b528e8c4d39e1cdac26449e51cb24c8fcf175e5a723f87f24e846669471f78a35d81399bbb93a55a456d44783d39dd2c735d8a16a5c7f37ce3bc1c26a408476f5c13a33193ee083bfb9c847", 0x76}, {&(0x7f0000000140)}], 0x1d9, &(0x7f0000002000)}}], 0x2, 0x0) 2018/04/13 16:41:46 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000000020c4900", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:46 executing program 0: r0 = socket(0x1d, 0x0, 0x1) socket$key(0xf, 0x3, 0x2) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x65, 0x5, &(0x7f0000000000)=0xaaae, 0x4) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000040)=0x54, 0x4) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'crc32-pclmul\x00'}, 0x58) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r2, &(0x7f00000000c0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x2}}, 0xfffffe84) stat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000980)={{{@in6=@mcast2, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000000640)=0xe8) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000800)='/dev/autofs\x00', 0x0, 0x0) setresuid(0x0, r3, r4) write$rdma_cm(0xffffffffffffffff, &(0x7f0000000680)=ANY=[@ANYBLOB="02000000280000fa00000000000000000a000000000000000000000000000000000002000000000000000000b12ff492cb84d446f789b74df3b1801b601c11fa80689d9538ca1d9ae67fddc17f1882bbe3bfb0c5cba994753409616c666706b57b435af0ef5be7cdb86083afbe70aa5dbe1bfc13ee5207378152921283e3fb34f70a83533d47ac9882d15a91816f0d743242c1782b9618f73040edefd97063ac9d3af291c7d9e5ff3124c1c2120a9064be2d0a47925cbf33ec045eea175de2af1c6571fdd9a9396459678760e8987331b54b1a44758109232870d89116d921ed06bd0aa0151d3bf1a97130542ebc4b848eac6b3dee69cddee7c882937ee04c9381abb09d119f1bdb01d8da41701c2b"], 0x10f) pwrite64(r2, &(0x7f0000002040)="f3a69787b6fb5a1a24c86f0ec36e44470cc21b283daa3f2b69d9d6db3a7bff781713c03ac82c69423d41439af2eb656399f016d5100a5a31ca65eca30648f413d3df66d19f6d2defad14a35619202e9a759b21b1ec386ab9e27ddb764efa73386a0795977516", 0x66, 0x0) write$rdma_cm(r2, &(0x7f00000007c0)=ANY=[@ANYBLOB="1c75b4bef463133d54140dd40064213c10a300b1d4a9221ab4796857c0558e064cce2dbe74e15ca529a084bc5a7a914c1e68fc2abef0cc321fa7aefc3b6e5358"], 0x40) close(r2) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r5, 0x84, 0x8, &(0x7f0000000180)=0x8, 0x4) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_group_source_req(r6, 0x29, 0x0, &(0x7f00000002c0)={0xffffffffffffe55c, {{0xa, 0x4e23, 0x0, @dev={0xfe, 0x80, [], 0x19}, 0x6c}}, {{0xa, 0x4e20, 0x3f, @remote={0xfe, 0x80, [], 0xbb}, 0x2}}}, 0x108) setsockopt$RDS_GET_MR(r7, 0x114, 0x2, &(0x7f0000000500)={{&(0x7f0000000400)=""/221, 0xdd}, &(0x7f0000000200), 0x10}, 0x20) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000040)={0x7, 0x0, 0x2, 0x49}) r8 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc\x00', 0x0, 0x0) pread64(r8, &(0x7f0000000000)=""/59, 0x3b, 0x0) gettid() socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000029000)={0xffffffffffffffff}) readv(0xffffffffffffffff, &(0x7f0000001ec0)=[{&(0x7f00000001c0)=""/62, 0x3e}, {&(0x7f0000000a80)=""/4096, 0x1000}, {&(0x7f0000000540)=""/146, 0x92}, {&(0x7f0000000240)=""/43, 0x2b}, {&(0x7f0000000840)=""/70, 0x46}, {&(0x7f0000001f80)=""/154, 0x9a}, {&(0x7f0000001b40)=""/175, 0xaf}, {&(0x7f0000001c00)=""/136, 0x88}, {&(0x7f0000001cc0)=""/212, 0xd4}, {&(0x7f0000001dc0)=""/254, 0x3ae}], 0xa) ioctl$int_in(r9, 0x0, &(0x7f0000b28000)) fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) fcntl$setown(r9, 0x8, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r8, 0x4028700f, &(0x7f0000000040)) 2018/04/13 16:41:46 executing program 6: set_thread_area(&(0x7f0000000040)={0xfffffffffffffff8, 0xffffffff, 0xffffffff, 0x3ab, 0x40a, 0x8, 0x3, 0x100000001, 0x0, 0x400}) perf_event_open(&(0x7f0000d2af88)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0xa, 0x5, 0x84) getsockopt$bt_hci(r0, 0x84, 0xd, &(0x7f0000000080)=""/4096, &(0x7f0000000000)=0x13cf) 2018/04/13 16:41:46 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1043.358297] binder: 7731:7739 got transaction with invalid offsets ptr [ 1043.394517] binder: 7731:7739 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:46 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) close(r0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000100)="ad56b6c5820faeb995298992ea54c7beef9f5d56534c90c2", 0x18) r2 = dup(r1) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000080)='htcp\x00', 0x5) r3 = accept$alg(r0, 0x0, 0x0) io_setup(0x1, &(0x7f0000e4b000)=0x0) io_submit(r4, 0x1, &(0x7f0000bd9fe0)=[&(0x7f0000617fc0)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f000007d000)="b3", 0x1}]) ioctl$sock_inet_SIOCSIFNETMASK(r3, 0x891c, &(0x7f00000000c0)={'bridge_slave_1\x00', {0x2, 0x4e22, @rand_addr}}) [ 1043.423675] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1043.434826] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:46 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x4, @loopback={0x0, 0x1}}, 0x1c) [ 1043.473451] binder: 7731:7739 ioctl 40046207 0 returned -16 [ 1043.476917] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:46 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:46 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000309000)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = pkey_alloc(0x0, 0x1) pkey_mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000000, r1) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0xc0045520, &(0x7f0000000000)=""/235) 2018/04/13 16:41:46 executing program 6: r0 = accept4$ax25(0xffffffffffffff9c, 0x0, &(0x7f0000000340), 0x800) fcntl$getownex(r0, 0x10, &(0x7f0000000140)={0x0, 0x0}) waitid(0x0, r1, &(0x7f0000000180), 0x2000000e, 0x0) r2 = socket(0x11, 0x4000000000080003, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000240)={0x0, 0x80000, 0xffffffffffffff9c}) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x80000, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f00000002c0)={r4, 0x80000, r5}) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f00000001c0)=0x82, 0x4) ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f0000000380)) accept4$vsock_stream(r3, &(0x7f0000000280)={0x28, 0x0, 0x0, @any=0xffffffff}, 0x10, 0x80000) sendmmsg(r2, &(0x7f0000003e80)=[{{&(0x7f0000000040)=@in6={0xa, 0x0, 0x3, @mcast1={0xff, 0x1, [], 0x1}}, 0x80, &(0x7f0000000300), 0x0, &(0x7f0000000280)}}], 0x1, 0x0) accept4(r2, &(0x7f00000000c0)=@rc, &(0x7f0000000000)=0x80, 0x80000) 2018/04/13 16:41:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:46 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000007fffffe00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1043.590461] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:46 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'sit0\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', 0x402}) r1 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x1, 0x200) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000100)={&(0x7f0000000080)=[0x0, 0x31e, 0x4, 0x7cb], 0x4, 0x0, 0x7, 0xc17f, 0x1, 0x9092, {0x0, 0xfff, 0x100000000, 0xfff, 0x9, 0x6, 0x3, 0x800000000000, 0x3b93, 0x0, 0x5, 0x2a, 0x31, 0x8, "39ac5b590bf36cef8e52cf45789386472804022f8f23dff36e1593790020ab46"}}) r2 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000180)={0x0, &(0x7f0000000380)}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) rt_sigreturn() 2018/04/13 16:41:46 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:46 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x5, @loopback={0x0, 0x1}}, 0x1c) [ 1043.641312] binder: 7770:7771 got transaction with invalid offsets ptr [ 1043.702172] binder: 7770:7771 transaction failed 29201/-14, size 40-8 line 2991 [ 1043.749850] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1043.761836] binder: BINDER_SET_CONTEXT_MGR already set [ 1043.768221] binder: 7770:7771 ioctl 40046207 0 returned -16 [ 1043.822842] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1043.828099] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:47 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x40) connect$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, {0x7, 0x7, 0x2, 0x3, 0x1, 0x2}, 0x7}, 0xa) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000200)=@ethtool_rxnfc={0x32, 0x0, 0x0, {0x0, @ether_spec={@link_local={0x1, 0x80, 0xc2}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, {"8e7c", @link_local={0x1, 0x80, 0xc2}}, @usr_ip6_spec={@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, @dev={0xfe, 0x80}}, {"6fd1", @link_local={0x1, 0x80, 0xc2}}}}}) 2018/04/13 16:41:47 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000acc000)={@multicast2=0xe0000002, @multicast1=0xe0000001, 0x2}, 0xc) setsockopt$inet_mreqsrc(r0, 0x0, 0x24, &(0x7f0000000000)={@multicast2=0xe0000002, @multicast1=0xe0000001}, 0xc) pkey_alloc(0x0, 0x3) 2018/04/13 16:41:47 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00003f1fa8)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00006a9fef)="e5fcb5bf", 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, &(0x7f0000000040)="ba2000ed66b9800000c00f326635000400000f3066b9200000400f32f0f7950020baf80c66b8740cf28666efbafc0cec66b8050000000f23c00f21f8663500000e000f23f8b81e0b8ec00fc79f0d00f20f7dc966b97e0b000066b84a00000066ba000000000f30", 0x67}], 0x1, 0x0, &(0x7f0000000140), 0x0) r1 = accept$alg(r0, 0x0, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000140)={0x0, 0x0}) fcntl$lock(r0, 0x7, &(0x7f0000000200)={0x2, 0x4, 0xffffffffffff6e17, 0x0, r2}) sendmmsg(r1, &(0x7f0000003500)=[{{&(0x7f0000000180)=@pptp={0x18, 0x2, {0x0, @loopback=0x7f000001}}, 0x20}}, {{0x0, 0x0, &(0x7f00000004c0), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="100000fbff0000ea852bcb68968bc800"], 0x344}}], 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_buf(r3, 0x0, 0x2f, &(0x7f0000000000)=""/30, &(0x7f00000000c0)=0x1e) 2018/04/13 16:41:47 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:47 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x300000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:47 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des3_ede)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) sendmsg(r1, &(0x7f0000000340)={&(0x7f0000000000)=@nl=@kern={0x10}, 0x80, &(0x7f0000000300), 0x0, &(0x7f00000004c0)}, 0x0) 2018/04/13 16:41:47 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:47 executing program 2: mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000000) get_mempolicy(&(0x7f0000000080), &(0x7f0000000000), 0x7ffd, &(0x7f0000004000/0x4000)=nil, 0x0) 2018/04/13 16:41:47 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1044.316905] binder: 7798:7808 got transaction with invalid offsets ptr [ 1044.337246] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1044.347107] binder: 7798:7808 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:47 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000e40fa8)={0x26, 'hash\x00', 0x0, 0x0, 'crc32c\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./file0/file0\x00', 0x28042, 0x0) ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0x0) fallocate(r2, 0x0, 0x4, 0x4) sendfile(r1, r2, &(0x7f0000e64ff8), 0x8) 2018/04/13 16:41:47 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)=ANY=[@ANYBLOB="0102000000000000870100ff00dd7000000000feff000000"]) 2018/04/13 16:41:47 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xfe80, @loopback={0x0, 0x1}}, 0x1c) [ 1044.395993] binder: BINDER_SET_CONTEXT_MGR already set [ 1044.412000] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:47 executing program 0: r0 = socket$inet(0x2, 0x3, 0x5) sendto$inet(r0, &(0x7f0000ef9000), 0x0, 0x0, &(0x7f000015a000)={0x2}, 0x10) socketpair$ax25(0x3, 0x3, 0x0, &(0x7f0000000080)) recvmsg(r0, &(0x7f000050d000)={0x0, 0x0, &(0x7f000095dff0), 0x0, &(0x7f0000765faf)}, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000000000)={0x6, r0}) ioctl$DRM_IOCTL_ADD_BUFS(r1, 0xc0206416, &(0x7f0000000040)={0x2, 0x6, 0x7ff8000000000000, 0x74d, 0x12, 0x75}) [ 1044.456138] binder: 7798:7808 ioctl 40046207 0 returned -16 2018/04/13 16:41:47 executing program 2: r0 = getpid() perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) getpeername$llc(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000180)=0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000080)={[{0x1, 0x7, 0x3, 0x2, 0xfff, 0x7, 0x1, 0x2, 0xffffffffffff0001, 0x81, 0x0, 0x9, 0x1ff}, {0x8, 0x7f, 0x4, 0x0, 0x7fffffff, 0x55, 0xffffffffffffffff, 0x200, 0x80, 0x5, 0x2, 0x100, 0x101}, {0x1000000005fc, 0x8, 0x0, 0x9f, 0x6, 0x10001, 0x400, 0xadc3, 0x2, 0x6, 0x9, 0x3800000000000000, 0x3bffd713}], 0xfffffffffffffffd}) mbind(&(0x7f0000024000/0xc00000)=nil, 0xc00000, 0x8003, &(0x7f0000a1a000)=0x40000000003, 0x7, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000801feb)='/proc/self/net/pfkey\x00', 0x0, 0x0) [ 1044.566967] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:48 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000cd06000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:48 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:48 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xff00, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:48 executing program 2: r0 = inotify_init1(0x0) r1 = getpgid(0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KDENABIO(r2, 0x4b36) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f0000001000)={0x0, 0x0}) ptrace$setopts(0x4206, r3, 0x0, 0x3fffffffe) 2018/04/13 16:41:48 executing program 6: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x0, 0x400000100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x8202900) 2018/04/13 16:41:48 executing program 0: setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000000)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}, 0x20000020) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x43f27346548f6b0, 0x120) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100), &(0x7f0000000140)=0x4) mlock2(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x40000, 0x0) r2 = shmget$private(0x0, 0x4000, 0x80, &(0x7f0000ff9000/0x4000)=nil) shmat(r2, &(0x7f0000ff9000/0x4000)=nil, 0x6000) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f0000000080)=0x4) 2018/04/13 16:41:48 executing program 4: unshare(0x8000000) r0 = mq_open(&(0x7f0000000000)='-$\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000664fc0)={0x800, 0x7, 0x2, 0x0, 0x3, 0x3c, 0x0, 0x1}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000280)={0x0}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={r2, @in={{0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x8b, 0x9a4e426, 0x3, 0xc03, 0xa2}, &(0x7f0000000200)=0x98) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000300)=ANY=[@ANYRES32=r3, @ANYBLOB="08000800ff01002100000000ffff0000ffff09001f44ff60e19c4fb89e101222596487f388dc8a594a0700000047cda9"], 0x18) poll(&(0x7f0000023fb0)=[{r0, 0x0, 0x4}], 0x1, 0xce8) r4 = dup2(r0, r0) mq_timedreceive(r4, &(0x7f00006b0f7d)=""/131, 0x83, 0x0, &(0x7f0000ccf000)) clock_gettime(0x0, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) futex(&(0x7f0000000040), 0xfffffffffffffffc, 0x42, &(0x7f0000000380)={r5, r6+30000000}, &(0x7f0000000240)=0x1, 0x0) [ 1045.562894] binder: 7859:7861 got transaction with invalid offsets ptr [ 1045.599865] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:48 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @random="7c2e1626459d"}, 0x10) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000980)='bcsf0\x00') ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000000)='bcsf0\x00') accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080), 0x10) r2 = socket$inet_sctp(0x2, 0x4000000000001, 0x84) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000140), &(0x7f00000005c0)=0x4) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f00000009c0)=ANY=[@ANYRES32=0x0, @ANYRES16=r3], &(0x7f0000000840)=0x2) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000880)=@sack_info={r4, 0x9, 0x1}, 0xc) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0xac, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000440)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000001c0)={'lo\x00', 0x0}) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3, 0x31, 0xffffffffffffffff, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x27, &(0x7f0000de2ff4)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0xc) setsockopt$inet_msfilter(r7, 0x0, 0x29, &(0x7f0000614fec)=ANY=[@ANYBLOB="e00000027f000001000000000300000f7f000001"], 0x1) sendmsg$nl_route(r5, &(0x7f0000000280)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000900)=@setlink={0x28, 0x13, 0x301, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_MASTER={0x8, 0xa}]}, 0x28}, 0x1}, 0x0) getsockopt$bt_BT_SECURITY(r7, 0x112, 0x4, &(0x7f0000002100), 0x8c) syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') socketpair$inet(0x2, 0x0, 0x1f, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f00000000c0)={0x0, 'eql\x00'}, 0x18) getsockopt$IP_VS_SO_GET_INFO(r8, 0x0, 0x481, &(0x7f0000000740), &(0x7f0000000780)=0xc) r9 = socket(0x4, 0x6, 0x0) bind$bt_l2cap(r9, &(0x7f00000007c0)={0x1f, 0x101, {0x8, 0xee5, 0x5, 0x7fff, 0x8, 0x100000000}, 0x442, 0x401}, 0xe) socket$inet_icmp_raw(0x2, 0x3, 0x1) 2018/04/13 16:41:48 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1045.610208] binder: 7859:7861 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:48 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x6, @loopback={0x0, 0x1}}, 0x1c) [ 1045.644345] binder: BINDER_SET_CONTEXT_MGR already set [ 1045.669915] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1045.681487] binder: 7859:7861 ioctl 40046207 0 returned -16 2018/04/13 16:41:48 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x81, 0x600001) fstat(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000280)={{{@in=@local={0xac, 0x14, 0x14, 0xaa}, @in=@rand_addr=0x8059, 0x4e21, 0x1, 0x4e23, 0xfffffffffffffffb, 0xa, 0x20, 0xa0, 0x6f, 0x0, r2}, {0x40, 0x0, 0x872, 0x2, 0x9, 0x9, 0x0, 0x6}, {0x5, 0xfffffffffffff000, 0x23}, 0x0, 0x6e6bb5, 0x2, 0x1, 0x1, 0x1}, {{@in=@multicast1=0xe0000001, 0x4d4, 0x32}, 0x2, @in6=@ipv4={[], [0xff, 0xff], @rand_addr=0xfffffffffffffe00}, 0x3502, 0x6, 0x2, 0x385, 0x6, 0xffffffffffff0001, 0x6}}, 0xe8) r3 = syz_open_dev$sndseq(&(0x7f000082a000)='/dev/snd/seq\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000380)={{{@in=@local, @in6=@loopback}}, {{@in6}, 0x0, @in=@broadcast}}, &(0x7f0000000480)=0xe8) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a85320, &(0x7f0000000040)={{0x80}, "00800000009a000000f9010000ef9b3fd4cec307e8033d13eb790ec9c65abaf90d229db692542e5b78f8549e0a27800f00000000000000090042f376589701a4"}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000140)={0x80000000, 0x1, 0x1, 'queue1\x00', 0x1f}) 2018/04/13 16:41:48 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(0xffffffffffffff9c, &(0x7f0000000040)={0xa, 0x4e23, 0x5, @dev={0xfe, 0x80, [], 0x19}, 0x40}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x4000000000000008, &(0x7f0000000000)=0xffffffffffffffff, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22, 0x6a}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0x0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x4e22}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000164000)={0x3ff, 0x5}, 0x8) close(r0) 2018/04/13 16:41:48 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000000000000001ce1c000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1045.784363] binder: undelivered TRANSACTION_ERROR: 29201 [ 1045.840695] binder: 7894:7896 got transaction with invalid offsets ptr [ 1045.873734] binder: 7894:7896 transaction failed 29201/-14, size 40-8 line 2991 [ 1045.893116] binder: BINDER_SET_CONTEXT_MGR already set [ 1045.909650] binder: 7894:7896 ioctl 40046207 0 returned -16 [ 1045.959146] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:49 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xb80b000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:49 executing program 6: r0 = socket$inet(0x2, 0x80003, 0x5) r1 = syz_open_dev$adsp(&(0x7f0000000380)='/dev/adsp#\x00', 0xffffffffffffffff, 0x1) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000100)=0x7, 0x2) ioctl$KVM_ASSIGN_SET_MSIX_NR(r1, 0x4008ae73, &(0x7f0000000400)={0x63599c65, 0x7}) ioctl$DRM_IOCTL_IRQ_BUSID(r1, 0xc0106403, &(0x7f00000000c0)={0x935, 0x1, 0x80, 0x27fcd0f3}) ioctl$KVM_ASSIGN_SET_MSIX_NR(r1, 0x4008ae73, &(0x7f0000000080)={0x7fff, 0x3ff}) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0xb1, 0x8040) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @dev={0xac, 0x14, 0x14}, 0x0, 0x3, 'ovf\x00'}, 0x2c) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r1, 0x800442d4, &(0x7f0000000300)=0x2) rt_sigaction(0x13, &(0x7f0000000240)={0x10000, {0x7}, 0x8000000, 0x1bb6}, &(0x7f0000000280), 0x8, &(0x7f00000002c0)) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r1, 0xc0505510, &(0x7f00000001c0)={0x496, 0x2, 0x9, 0x567d, &(0x7f0000000140)=[{}, {}]}) 2018/04/13 16:41:49 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) add_key(&(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000140)="e6ae1c160c74e653d4aba751a585b5cd369f696219eac1e921df5ec779abd5f557412184b402b6c6a60996d8e026f8dad788d505c61cef58e5a31c940f743074b8f2b4cb9086e62979cb010800df1806cf0fd3b10d4f47c5a591fdcaa8f6ffb1ef8790345af97514c74aaceb6a0b63eb061f4377166c63231dc1d59e36cae3c9845005e793bfefa699ea5948e1a1fc2fd2c35735eabea51f889def80e6a5775900a18e801b21234d48d788872e9c8775d393", 0xb2, 0xfffffffffffffff8) r0 = add_key(&(0x7f0000000200)='rxrpc_s\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000280)="6d2ec2daa8a51cc2b1944f3a041947d0708575a18848eed5747e6e32123596ea71b4f0cb877bcd4d59cb41a2dd570e2a768e4346b7bb20e24c7f4777e0389a5b03006c9920acf1", 0x47, 0xfffffffffffffff9) r1 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0) keyctl$get_persistent(0x16, 0x0, r1) r2 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x4, 0x10003) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffff9c, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) 2018/04/13 16:41:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000003000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:49 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000000000001ab7300", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fcbff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x44040, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0xc028ae92, &(0x7f0000000040)={0x4f, 0x6}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000180)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7}) ioctl$KVM_HAS_DEVICE_ATTR(r1, 0x4018aee3, &(0x7f00000000c0)={0x0, 0x7, 0x4, &(0x7f0000000080)}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2018/04/13 16:41:49 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) bind$inet6(r0, &(0x7f00001c1000)={0xa, 0x4e20}, 0x1c) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x2}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080)={r1, 0xffff}, 0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000dacff8)=@assoc_value={0x0, 0x200}, 0x8) sendto$inet6(r0, &(0x7f00009f1000)="cf", 0x1, 0x0, &(0x7f0000108fe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f000098effc), 0x4) writev(r0, &(0x7f00007f2000)=[{&(0x7f00002bc000)="b6b23ebe2094b6c296b7f43c2ff9cec9a414ac8ab00820fbde9a0f4a1bd2773a23ca881cb2b8f6f7676ec3e23411c9a7b90c0d98413505ae48a6f9680b3b1c7d9d2083981adb57cc49d7c44eb888269d5ddad8a8ece4937a8c1bd5f6d54eb2fee4344a60a71f21a02b71241caa5bfb30ef20735987815557dd0712275e1cab0562f6e71d00f07d832fff291844ad8c73a6b27652f46020e42eebd5fd185751187d8455017d6e42c6492f282d3fcea50ef7e26862684165a175a262d5fdb1562a9dd53028ed11564d449b40c3dc6e1500aff5eb7c7ac29b27bcac0249c746425160e164ce64e5180f5b19b180bfa5a14ff6d6bac621a1723ffe9dbd05f91bed6ffd9ba2ca0ea7f3eca738786c6cf9be08976ab48f5ce579d5053ef537ba15f9ca286ef7299567bf2b50512cba39ca22e4eafa46593dfb19b29e524a5e0b527f23c3fd666357e9b397f2e720146853c8a4e590b620fd4f0c83a6a0d626fbc2d018596b5bd8b2b9496d3a83f8760b1fb0a6ec9de29b146334717e8cab34996e8474bbde59447f2cc876096f80b10134ed5d69027a9cdd109de0d161003880d10536725ab38afdff82208b8ca05f7661bc482b841d815c35660d7f7b036d0426f3cbfcd1448782af41483936f20b09e239d53be9df805d1a4dced5167eb9b8c8c681451329adcea047a3a00461916692c523647ed2b81b39080417072cf26db77335331fd9d49b1bea2ba448e3e7822109d5a115c5da661c65193ae60923e37b8751d7f6eb2511fc9b55963fca553c0c6d065240b94c889af1781a8671ce4ec91744820d8c3905b2eafb38d909b45175801885e1a1059a9b3db85a95f2172947697e56244fd7b4b412a33b9adc061fca8c742d05f50ce0d2b4280749ce13488259d37074ba94540a5b9cdf426fdf4563163e81c9769b7a84db101c03d88cec1eb18b7ded9b957734dde7b896b0b9c1a76e63104a02a06e917a0e3b608276ad2860a17c76e5c5a07dd6917fa497adc8ff56e2ec6f2bcc09d8061f504c5d5128b4e89bcb2207df70db9d7cceff2fc266443b6d34bb651d0def84768f750279e8b8ab42a8ba7f4f265e0051333f346bc113c56b179b81421601bd60cd071ee198d84ca6abd13eb3ecbc6aaab47aaae592f97c3747c37266e8ad2358029989919b7f5dcee8b60e1d32a0a94d91cc073174ef180d1b3cd4aedb77f1e898f6df02cf3fe57db328abb0ac8d88e5f0d3015f10e74f00e90ab3acbd2e8917e130d2961b1895b5e3252e8a74a0fe0579330407de6a6644cdb7cef78f6ebdf9ef2aa07b32c587d93be72cce852d1ccdf83d1740e0b5c2971b340d98e584b883878ebcac7c91c0c7ce6c23b459b8feb49133d78e965ece4c3f5e11f929d5ef541e2ad8311c4c7412c045b4abf9d14e0f8fd1fd5f851511519e45bee4f00ebb6fddcf38b0936c7aaec7e846631d8f0f0f032fd578dba501d6c7c63bdc858c6c80cc37ac3992b4dec23d5c2304f15849f696bf1327c3d2ad87908a529bcd398b40c1323462ae597ac24b707041063050c35c632af02461a3c14cbb6f2a573aa4c154bebe75e8e8254c2df4106fcac6a295317cde6123d9148693790211cc12a7c3cbfaf7e5da983827f7d430c4a858842057ac860fa3891fe7f59c71b7256618198ceb0253d0f6afe9515af1d3a97a69f5d3f8def2f0b2dd0cbaddedc76ac3e57763ea544187493419bb6b0cc14df727f31e6395db760806edcdc37804870ee006fe60471f10f0313fc1f9f365038472cf978d091e94338af5dc37e12e30d4e16b13675eea7d36a18f3e39db3619cdf573058e89f95702cf8bf8ca88b4f4989e4a7086a682a13b477d4cac8bdb595c1eeb2463e57538e896ca3168292cdcf7779a43f4113bdbab6d78aa986ac2766bb55a40f0f59aa7eac6af7db18e7e308ba6df385fdd13a8cfa44b7bcc0b9688588bd80089298088ae533de7af3627718726709d4f5d773a6f80c058d22ceece37bd5b3e76e089de57cf80ea6a3b1972cbb086b9e03d228f0057089e04baa357cfb3a9e5941c7643e903ca252509cc4b9a6202ecb3faae31d6309135668d9a55f3a8d64b65496429d74a1d236f17c9f0d60f0924f1fab0f40bbde913fc4eeda486145a39026725897734fff68ff083d3c07e61f937093be31b0cc6dc", 0x601}], 0x1) recvmsg(r0, &(0x7f0000001740)={&(0x7f0000000080)=ANY=[], 0x0, &(0x7f00000016c0)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}, 0x0) writev(r0, &(0x7f0000848000)=[{&(0x7f0000001480)="23884051f454d47608e4b1090f80d95221b6e30fcf1d452c9b7e024e9d7fde15af6700990fc5a9fed357c9f0e64e737d6120298b435477abc3051d2a0cf1635a19e6483dddbf0ab7c74c430052eb5d6462237cb7f46bef3b32c52de05d58ce84e3db9633fdcba5790fa2f6cac36aa0d4193cd4378d53f0a4b0cbb4d69bc09739549630f8824d66a6a76b08de68af3568e1e617a9c00c95b77724c9c4ff2d6e0b7adeed4707c6207f5294f1f2f6dfa79d3f76085850ac27eb5c746393f08e39c3e45b83a5837183d4fdad17ab1932d95795b0a355250d16b2568fc7ae93d93adb0a3a829897d5bd21092bde88e239316216523c38ae6d2c480a57657d03d0ad5817cc03335c1ba5fcdc0526b654db60fd50b16354926904b552a00eed470990bdbfb6b765f6c80b29159c1ebbd32f4dea95de8877b96e08f5ad2f977956f3b8c5a03fbd96df247ffe8a05d55905774f98b860c9d2b25872ad7f00000000000000d4a95a048c578048066862676b1159e5ed30acab882e5a3ffc848dcb359935fac9ae756bd9f79f2981063ce72ad83d90c50419912acf3c79421a0b900b053404b22347eeeeb57b48d32f05eedbe38546cfb8600eac7e472db3610925dd6d3fae4adaafc0bee4a6e91d7a60260ee02a961d4b40e57175bbc6b64f146ca88916bfb3930d88debc5a2c713781b678a1b8499cdfcb7c7312ce46c32f134a7af9e5b4527a95", 0xfffffffffffffce8}], 0xa72f4ecc0c736489) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}}}}, &(0x7f0000000340)=0xb0) 2018/04/13 16:41:49 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1046.565597] binder: 7923:7927 got transaction with invalid offsets ptr 2018/04/13 16:41:49 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x9004000000000000, @loopback={0x0, 0x1}}, 0x1c) [ 1046.606403] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1046.615677] binder: 7923:7927 transaction failed 29201/-14, size 40-8 line 2991 [ 1046.645950] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:49 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:49 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000400)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c00000022000100d5200f549c3517090400000008000c00ac141400"], 0x1c}, 0x1}, 0x0) [ 1046.655101] binder: 7923:7927 ioctl 40046207 0 returned -16 [ 1046.675580] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:49 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1046.748338] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:49 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000feffff0700", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:49 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539(chacha20-generic,poly1305)\x00'}, 0xfffffc60) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="979a548a9702a068c814046d59b423895aa0ad3463199f432b9b52115a8c7c0a13555af018034c0c", 0x28) r1 = dup2(r0, r0) connect$netlink(r1, &(0x7f0000000280)=@kern={0x10, 0x0, 0x0, 0x40001}, 0xc) fcntl$getflags(r0, 0x1) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000100)=@ioapic) signalfd4(r0, &(0x7f00000000c0)={0xffffffff}, 0x8, 0x80000) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000200)=""/105) socket$alg(0x26, 0x5, 0x0) 2018/04/13 16:41:49 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x8000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:49 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0}, &(0x7f0000000100)=0xc) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/qat_adf_ctl\x00', 0x200000, 0x0) pwritev(r3, &(0x7f0000001780)=[{&(0x7f0000000340)}, {&(0x7f0000000380)="865049b2e69823724337b330577ae04b93aa9b629a193a7f5a054281e03f45c6f0c793f4d3f23286ed51786435b505a518abbb3ada458350a5d6b155c217f4ff2881ab8dc64725e77158fd6214c080d022a60228cc9e717a4bd3deee5457f93b356a96152497d48ce94bbdf80b94d5663d50b2203046f88ff2b4c45c075b82449e89b9f7e3cb614078114231b1abefdc30510c1378e2fc0c84d7e9eb0e3a020abd4527b6ae54f374d737d78db8e6320c626873979756b800216f7ad2baf09a984a49bce701df924285982912af97f6e6f4", 0xd1}, {&(0x7f0000000480)="b99dde691f7ec854cb4fd8e5aa624f60ead567981690f5b4bbc0c289972ccd8e44ec9651d05831058593e135d24491195e93173dc6927b252c0ffb4bf523201c8971a3dfcf12838d0d70de17b69293efd74d4dc7df7e8081bd525fcc226921dc7c4be90722c041454417f38dba54bb0fe4a4c6ee45196439fe7290bef69766e31bfad80c80d3534f7e7491625ce1a908ea3aff72305a2946403f055901edaa3e188395740cd36377a2caf69b36138ba6e51fe97a0b001e0203ad0acffc97d30055e6374ea0f1adaa440efd7898572b6af281d52d6c7ae86541510b8c8ae12bb548ee1070d8c433c820a6168e8737afacbe5451a2091fb47565fd17c51e5fe7fa3bd3f2643b838ee41493d3fe7a4d152f388da3db95dace7f053e67a8de388e1d7032982380c0a1b02138ac4b62ae7e53c5cd3c85dfd91610d230e83d56c569757b44a67155f43a56eddf8b7518f5c2481a701cfb535038aa9eda3c55a3a36222cd194d2e26642e9f59e47ed7fdfd37d95cd8bfa4ac36f091bf1fef8c3bb90cd09a020ba9bfbd4064956662624547e119c9b41e4b50b88683a7f854dcf5077d0ca203747fcd369daa267f85cb4ac9819e120ab51c625d4bc8ac58d09bb4e1cec6812ba33920e2b274c41ba209f87d4261c79d0b1ec0f8ee0fbe058fcd9b3e59543690f34f793f58d6b9994a47c2f57841dadfc39d5a24812bd3b47c7ccbd7eacfdc054de094bee4107cc1805b64a719dede073432dc4dc5bf96c082b02fcb5929a71b89af5f6cc3b98d40417265246045ccc5250cfbb7982e68076ab8adcb2116ea1b863ca64f54e9cbc2cb8088a08151775ad6e9f6ee1d4d0685d5716918cd7be5f8da3b7a1ba403f977c0e7b7f3034cf835b264bf1b18ea601b6e1603ca8c7cc6f3298ffcde3c7525a055c1d1cdd26b64b140d13b3be26d7390b1588566636a8a6c94ee5dd34694f4850f0b6f88f6545af0cb54fe4eb75bfd864ca7356ba6fdeafb12d8dca3a290dfa0e58aef6ff0b36a4719e953841bb0e655da99a15f615d5c9fa98cf213486c834f67ecaf4447448e350324aaa2869916bff34c356d3390c47054cf70bd9b23f6c950b290577ed0efc58058e0b3c0e7be87917cf338a86fc51555d42389f70ace93381b085b354caa7d48f62a48d2050b98cdcc5391daa934dc35fed12e7fb9d57f95f1f05d77e06a3bbe905b5ac4bae7e287e9e0709bbd2469bf126c84d332e0d9844fbf7e48060889d36f16499aaa4160209e1f4510747f9058322560cb39220c66d0c4821e51490278086913ee0ea60ddeab873b434eaf0b2296c67691d04dff06ca4e47ae7ddba768e73e957de56e30dab3aed1abc46ea71ef1b82cee103f7c5d49a56c4502d6aa9fbf0fcd3562afcf2d2143fc408ab575f0d9a694e8b01649b71fe083782a127bebf9457997ef65d82c5df32c51e94803b5d15a484dac189c8b3d16b60c459b7a8cb62cbc86487cc76505935e1efffb92ffa03a92278503609189fa35996f0cd03415cc1299b6105e61d45a61af6cdd9ecdc135831f8c9e56e090c1ccd2b489f77a8f22525a536e52fc61c9da2c53e6b71c534e3f6b417b683eec91f94e79c4589c9b5f324469f2638ab41b19a7ef21923933dcda0327ea83d285c2808adc39a49d53eabd8f34418cc5149ce698086cd03f1e58befdb9d1718e674c098cbaa985f41984e3c3975622716fe31cc39476b6e3e203e298775c2e1791a6b21ea3f9200cdd0dd0174e2cae92601431e80bf5003a9c9e4b435a030491feee1667a43cf6472c1589015c41c8a23c8644ed0397a66948cc8c0d8b7575e39be5e980abda1357b31f12a34a326443c1a9bcb4f741ae53695acf4c65e86251557584118847157c532456420edaddfa33e85b93f60eb55d2729157f1c05774a1119a1a63ea2e0c27764bb1c364c91a315fdf55d9724ddc6ea4dbd76511dbe048cb948ab1c196610fc060e2729c80ce431243968138e1a2dc025573c12fd2b7e920f5065526d6988647cafe00ec0b84f26169c29beb96fa36e82697664b4d77eb67113c603442a609b791c78e59c595a6fd7e7c6b1236897619e5715a371da7230ee2b22cc1d4a25f92c9e8cdad87ccd37d7b6269d335252313dd90a395b927f57e33282320e6e09a4b08c5ae968e1b01839316416af5f8c0da2a75a4f5c4892f08334c2c9aaff8ea7de4a717cbb4f28916d90adef53f80510e00e22e3c78faee92deebf8aa1e16d62378f32fb3415839551b50fc7fe38ee22e80c07595791fddab66186a572f9afa3a0c004e5f432d43d3d6a8bee4157b11dbfb16835d2d7ceb9cc093af811b194f3a6d305f21882c498ebd747a6af19064a8f2d932b8a5a95df67bda874e4c330fad2be0d4c715effd8f4bebd42f13a2bbee79c3b7e64a04810f3e951b2b633fec5c1ddbde4b6b03948919d67acbb607daedbe45df34ddb45eb6826608b0ac004f793e3c10806fc8e8d49961a435e577d02d32fc5775eab028fb762935f42d1a63cefcc0d4cc621a61b3d7c3bee024e8c6162ad462c5af649fc21c6ec0d9ca47910f0663fb071cdb7750c46c8387f8de2928a77c2ceaad2e1ce438b33a70f5fd612e0f75c4e915af0c21a16fab58bdc7d0bae7aea35ffc51471acb95a4bbd456404ace9694921f9cd831fa4641d4cdb427c2fad4b7a5ad8ceba26be166501990ad12f63fb9b9a1698777680017ca6641befc3f239ee556ad7391cfc608fbb2b6d2aa0d23b6e09848d7e3afab4b72a42ea590f52db13c4bb6f18799afc5f22b4b28f7a03d2871008b64505508076907c1e4c82372edaa3bb3df2903cba8112cb5d84bc030e2600320c6924d139efa53780294ed0f6be34848f9edeafe988ade7bbfab1b33e862fadd2192ce0214ccfe54029a66631c22345d7172e04807f1962e9067eda93e385b46520e3e8770f76340617680609b18ae4fea6a02f12e683a5870e3016519a4b7709b9856a2867fa629114eceb31b8e110b1d4f59c49092394802d9809635216b0de4ea311d00aab4a5207ab0638c591b4ea51b8e16d0f1cda8320c7a02907c9836a3b4bd4ad695d07a9eadf5146c22b48ffc666350ba35d14c7537ef5ee6e04d8ff29ee2bc45ec7aa4e5537a82c93ff065f43dfc1a026b0d9e58b191437d04599f8ad8304893eb6d4d17140e339a55fdfc1824f404992282470c420882a465c675328cad8e2699a1915edb1502e998196117327cc461eb2d53152e75b1d671c345d835c9bf1dac2d8a6a296ed32a22778bec5027e93d780cdaa0106634ae8725c8d69b595b13bdf9711c5eadbcee0becb9fce46437381d07a2b99fa290f10ad1972483dbb72713e00a85b3ef68eaf454d07c11b18ca6a39a19f80e0fa37f7da872bef51308b4b57b0f6e3dbdf35bd485fac00148f1f6cae245b436deab6aa93482af798811aed9dff6c0d97896ed4daab52aec67f7cbdc9331a8ae23ca0d71c1c0b1add61eb967fda1f75cd682aee34184aabe2497782a32caefa3fa0f14d8dcd8a7ee844deec02f3561438658e92a814541f6b99698bd8c1a600d53c7ed3bcf757380350bcf0f6431333b759777fb134a16f252a679d940744b6bfedbe371e0e144c6edb8371609d2f41a5c36fe2228c4dd61e59fb148f756821a6687443abddbdc31683f423549e1a2d39343deea3af4e1ea56f16c4063d1bcec8f902ce12cb34c49f803218b950a37a6af0e743953cb751f726432059f9fb590f7c7cbe5d186634a23d65994f7aca46e612bc5a3db19f5af4d1afa5ae41b674bd6ec2ba72ae8090e88c9f95a1b43bc34a779b418f91efca26ab689d92240d9d24e923b94ce464d718eee7761f5b48067613f581e8cef001b7266a0e2b0008b77e30bb419e1266edbcb25322ccf634590178658202771f43605553fbc785131db4626c5816124f9ff41903c79282ac85521bffaa1cbbbebd6d0ef31a04be969229a5c77b58b05d909be9882f48e35c7b5eeb81be3e7d52f40d0e02344a45284856dd93b47c1b3ad0dba898b2e960e6a805e00ed3226c600d045f151c48c4633ab6647b9a56f7d818f688d9b1dd1c2acd1ef7928364243f5c91e69ee5eeeaa28bd688580477f2c014ece90106f8009c9147421fa3361bdd69b23515e566fa7cd0a931fb2eb7ca1b55efa50c8f3dc007a1508b4f8185127cc6d45b0e6f0fcd4e36ed5988495b01da2c86991da69e3a7f4c93b299690754a580f0e2592018bedc2800ad0bcf0913be41314372c2bf22e3e496b3ee03a14b127b7cdb1e01462739a244b822f8cb2c6eb7c47a42f1fa3492aba62337460368c1161e70d6cdfbac0c8fc1f2f31cc628d69b1f59a573f5233364fb5493fb94a25c3fd9126c2c5cf6dd9c1c50390e8cc9fc3b38ecfb0427a15961aee4703bc8d03aa56a453370748f61bbe584b3cacb7aa5635ec14f0c605cf81a932de42ccef766fd435e266db921d3eabbdd2fb0927870ad381457fe821d2c484e456a7a91c5c9df6de8fd907b602243fabb85ca81f4dff3eca75969838127b604e7209ede06e8c0c5066a13cd588ed09b525a624cbad61c460674c7bfb347b927d49d1d861352d253cab976a099948fc80f70f6816e8847be557ba99ae204c33bbc084881a86db212e1e821047596a152596e60b121dbfa071c70c0b682eb8319dffab28abaf795622c18d51508d1b794cadc832a6840d90505e7f52843b282a2b674dbebb6298ec28967d173fddbb294b695320efa8f18f12c3539229050df1482d23b85ab0c5c908ce7c2893bbe0dc31a3d864e186f2ebf6e0cc5f22014b3d7e42ed0868a38137152db53caf7ef22c05ba93ddd2c8802e7cb8e6e50169d32d53c9c6d2ee56c7ebc3a49a243aa668225e1fae695cb96a487069ae7f162092723088fa837e101e35301c3a22ee7bbdd1a80827695b61edf499eb74830f726adc72dd6be868b166702e5ec63b2623f1d417fd9151046273fbb55d1b1773d2adbd1e7b3a7125fd73b7dd33ae2a316b2aef536ebbf139cfe5d581f7126e10b17e72ca2daf4722ee8af56158b808d05b9d8dda22955b464e77e2e7fd2b60f955464692e33e4d7d0e930bb5e26ffb4056cb330ad857defa9f85bd1344b26f357e1726683ba377d21750cf4102e7b615b339497377b9d68f462d0d7d37de1f61ce66531fa6141ef0f2e8e9f953c0772ffafd6a6ca00f4f85c25576c17c5d077fe5bea7653573ddf396b611453f7ea642eb2b9820f4a28372a20a56ab73e71439d0c1467951dc3b7d07100eaba760e76521eeeabd7d35b22dc4460a4a20e24ff27014f0bffad516efcb4623d6f0c706904e1e18bf6de6937f7384e7c5ae36f81dfaa8e63acfa6bdad9269527b9e64d129981259756b2359bf153c4e2d73dbe63cbccb79615d5cac5fc5cc363c3323e7f70dbb23a860426af484a2fb6cadd4a34d4bee0ad7abfaf6806373a48e7f67350a4251c74da25b5526017a7853608c0e1b9c8a77039f607265d5c0b3cba554f9c8af834cbd5e36b59591c7d2865d1e5fe4cdf4d7492e905585f8ac5fdf0a893e9c8d37b2f0e7e8ca92fe83394878b654b2482528d1aa5ebab21eae7e1d3e839cd52b0f0a00c8566376f525d8d4a8d197bb40ec63b554bd0d34387b1315179c8ac02abcf2fa41c6cdb27ff306ff680692f8b05f6d2d9a759e55befb6b27ff6d81cee49c1aab43d8a7df6ff9b2dcbdd5d860736b71d27640c4ea475f489c5fc271ae761d06f5d939036707eae9bc2a0d7af1bc1a52e26ffe9169cd4a6c6a67a6ca51ea8e737198c6b81e4dba5621b0b63", 0x1000}, {&(0x7f0000001480)}, {&(0x7f00000014c0)="e010458ab2c5b04d14a32d90ad73f20060878fd0f69046f2901a996eb07b7ff604278137152a9b957bc019abd79468bddd5cf90aa324bab52aaee0375bb47125d6a6c9559a42087293b4e65eeab724bcef9de79d6a3fddb845d0a6b8293e2c3daa63f2565c935fa492ba863f6ab7d8b20013989595a37cbc1c2cfadc90afc417735a430387ad7c466ebbc5ee75af49a6fdb7f2b3c436145f84af3370e49367dcca91", 0xa2}, {&(0x7f0000001580)="7b0ab59fc5abfef268df61", 0xb}, {&(0x7f00000015c0)="d3ce9fb60bb25bce77506dd677d9c01501f11cc4e95814ef25b6428c38c1b9c7674f9b376f49dfacc8373fc426fcc8668d214a60a871686911d01729ce0a6c7c018122c65bfc7949d4ca7993a76db3e7e56afb68354619156e8b75671786a999be797c81ea142ca7f812af6f580156ad5af26aa91c256eab7667ac0731a0164db65c1c2868ee7e6cb87f7c76a44bffd2b326bf0600e71e785dec5fa73667acacdbcd789ee571bf3c70fe1a33a998d236af4c50a4a17a26a03c43f75c4e5aa017", 0xc0}, {&(0x7f0000001680)="44b6743be5db9a7b68f9325e48ebf71abef2f2aeb976727c97", 0x19}, {&(0x7f00000016c0)="e490ec57c69c5ca32aa5ac3fa1c43b54fcbd38e6bc4b124ffc124f2d431d39b80f96ea491e8f3a643d492651104917ea31eec666bf79c1a1f3932fb7b11ec0876879cc9b68298c1647e55e7c3e32f69afefd0e123823dfbe207b312690e34270f52c6c82f9fc7160d8e05fe97b00a22fc4dc46245a677db512aff940ace667dd691868246fe8f167", 0x88}], 0x9, 0x0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f0000000000)={0x4}, 0x4) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000001c0)={0x0, 0xc7b1}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000240)={r4, @in={{0x2, 0x4e23}}, 0xfffffffffffff001, 0xdaf}, &(0x7f0000000300)=0x90) getgroups(0x3, &(0x7f0000000140)=[0xffffffffffffffff, 0x0, 0x0]) fchown(r1, r2, r5) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000080)={0x8f, 0x0, [0xffff8000]}) [ 1046.797193] binder: 7948:7949 got transaction with invalid offsets ptr [ 1046.834736] binder: 7948:7949 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:49 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1046.896773] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x1f) sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000db4000)={0x10}, 0xc, &(0x7f00006bcff0)={&(0x7f000075b000)=@ipv6_newroute={0x30, 0x18, 0x301, 0x0, 0x0, {0xa}, [@RTA_ENCAP_TYPE={0x8, 0x15, 0x7}, @RTA_ENCAP={0xc, 0x16, @nested={0x8, 0x1, [@generic="d8"]}}]}, 0x30}, 0x1}, 0x0) 2018/04/13 16:41:49 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x7, @loopback={0x0, 0x1}}, 0x1c) [ 1046.928925] binder: 7948:7949 ioctl 40046207 0 returned -16 [ 1046.939140] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:49 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1046.999099] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:49 executing program 0: r0 = memfd_create(&(0x7f0000000040)='coredump_filter\x00', 0x3) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') writev(r1, &(0x7f0000001140)=[{&(0x7f0000000140)='|', 0x1}], 0x1) ioctl$LOOP_SET_FD(r0, 0x4c00, r0) [ 1047.048407] binder: undelivered TRANSACTION_ERROR: 29201 [ 1047.241268] Buffer I/O error on dev loop0, logical block 0, async page read 2018/04/13 16:41:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000fffffdfd00000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:50 executing program 6: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000556ff0)='/dev/sequencer2\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000fff)='\x00', 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x2011, r1, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000080)={'vcan0\x00', 0x6}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc08c5114, &(0x7f0000000000)) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f00000000c0)={{0x2, 0x4e20}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x4, {0x2, 0x4e21, @rand_addr}, 'gre0\x00'}) 2018/04/13 16:41:50 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000490c0200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:50 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xbb8, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:50 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x200000, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x8000000010000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x8000000000000, 0x0, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000040)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x48) r1 = dup3(r0, r0, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={0x0, 0x9b}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000200)={r2, 0x1ff}, &(0x7f0000000240)=0x8) r3 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x8, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r3, 0xc02c5341, &(0x7f0000000100)) 2018/04/13 16:41:50 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:50 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000001fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000013000)) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000040)) pipe(&(0x7f0000000100)={0xffffffffffffffff}) ioctl$DRM_IOCTL_GET_UNIQUE(r2, 0xc0106401, &(0x7f00000001c0)={0x62, &(0x7f0000000140)=""/98}) close(r1) syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x0, 0x0) close(r0) 2018/04/13 16:41:50 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000000)={0x79}, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(0xffffffffffffffff, 0xc10c5541, &(0x7f00000001c0)={0x0, 0x0, 0x200}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) readv(r1, &(0x7f00000000c0)=[{&(0x7f0000000080)=""/9, 0x9}], 0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='pids.current\x00', 0x0, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r3, 0x6, 0x3, &(0x7f0000000180), &(0x7f0000000300)=0x4) ioctl$KVM_GET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYBLOB="7bc0b1ba00000000000000"]) [ 1047.413799] binder: 7999:8001 got transaction with invalid offsets ptr [ 1047.439186] binder: 7999:8001 transaction failed 29201/-14, size 40-8 line 2991 [ 1047.493656] binder: BINDER_SET_CONTEXT_MGR already set [ 1047.524296] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1047.540227] binder: 7999:8001 ioctl 40046207 0 returned -16 [ 1047.559293] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1047.603171] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:51 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:51 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x2, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:51 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000000)=@ioapic={0x2, 0x0, 0x0, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x3ff}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000140), &(0x7f0000000180)=0x4) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) 2018/04/13 16:41:51 executing program 6: r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f0000fc4000)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) r1 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000080)='systemposix_acl_accessppp0em0]loselfcpusetwlan0wlan1\x00', 0x0) keyctl$setperm(0x5, r1, 0x10000) sendmmsg(r0, &(0x7f0000573000)=[{{&(0x7f0000db5ff0)=@in={0x2, 0x4e20, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10, &(0x7f0000542000), 0x0, &(0x7f000000d000)=[{0x10, 0x114, 0xffffffff00000001}], 0x10}}], 0x1, 0x0) 2018/04/13 16:41:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000000000000000006cb000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:51 executing program 0: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x2, 0x5, 0x0) memfd_create(&(0x7f00000003c0)='vmnet1-\x00', 0x3) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000040)=@security={'security\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x2a8, 0x2a8, 0x2a8, 0xffffffff, 0x4, &(0x7f0000000000), {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00'}}, {{@ip={@local={0xac, 0x14, 0x14, 0xaa}, @loopback=0x7f000001, 0x0, 0x0, 'ip6_vti0\x00', 'vcan0\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00'}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x2f8) 2018/04/13 16:41:51 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x2d3e, 0x0) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000080)) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f00000000c0)={0x8, 0x2, 0x0, 0xdd7, 0x100000000, 0x68}) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000100)=0xffffffffffffffc1, 0x2) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) 2018/04/13 16:41:51 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000000000000000100", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1048.420996] binder: 8029:8036 got transaction with invalid offsets ptr 2018/04/13 16:41:51 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1048.470380] binder: 8029:8036 transaction failed 29201/-14, size 40-8 line 2991 [ 1048.523188] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:51 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x1000000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:51 executing program 2: pipe2(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x53c936544816b8fe) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000300)=""/103) r1 = socket$inet6(0xa, 0xfffffffffffffffe, 0xffffffff) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r1, 0xffffffffffffff7f) r2 = socket$inet6_sctp(0xa, 0x6, 0x84) sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x400100, 0x0) setsockopt$RDS_RECVERR(r3, 0x114, 0x5, &(0x7f0000000100), 0xe1) syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x9, 0x20000) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x400000000000003}]}, 0x10) sendmsg(r2, &(0x7f0000ff1000)={0x0, 0x2c0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x40840}, 0x2000c000) r4 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffd000/0x3000)=nil) shmat(r4, &(0x7f0000ffc000/0x2000)=nil, 0x7000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000180)={0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x2c) fcntl$setstatus(r1, 0x4, 0x42800) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$inet_sctp(0x2, 0x5, 0x84) r5 = semget$private(0x0, 0x1, 0x400) semctl$SEM_STAT(r5, 0x3, 0x12, &(0x7f0000000200)=""/192) shutdown(r2, 0x1) [ 1048.550307] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1048.566396] binder: 8029:8036 ioctl 40046207 0 returned -16 2018/04/13 16:41:51 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1048.597898] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000100000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:51 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(ccm(serpent-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6", 0x3) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$can_raw(r1, &(0x7f0000477000)={&(0x7f0000000080)={0x1d}, 0x10, &(0x7f0000000240)={&(0x7f0000000000)=@canfd={{}, 0x0, 0x0, 0x0, 0x0, "b5a419fb5df128c83ad9430362a22a5abf1e4123efccc641602c2da3630b58d04766c58b254ff2a965ccb226c8c7355c33306c99adaa0aa59006f8dc9b01b737"}, 0x333}, 0x1}, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha512\x00'}, 0x58) recvmmsg(r1, &(0x7f0000003340)=[{{&(0x7f00000000c0)=@sco, 0x48, &(0x7f0000000100), 0x0, &(0x7f0000000540)=""/94, 0x5e}}, {{&(0x7f00000003c0)=@pptp={0x0, 0x0, {0x0, @dev}}, 0x20, &(0x7f0000003200)=[{&(0x7f0000003100)=""/226, 0xffffff4a}], 0x1, &(0x7f0000000440)=""/239, 0xef}}], 0x2, 0x0, 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000200)={0x0, @remote={0xac, 0x14, 0x14, 0xbb}, 0x4e23, 0x2, 'none\x00', 0x20, 0x2, 0x13}, 0x2c) 2018/04/13 16:41:51 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet6_buf(r1, 0x29, 0xea, &(0x7f0000000000)=""/9, &(0x7f0000000040)=0x9) getsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000af9000), &(0x7f0000632000)=0x4) [ 1048.662358] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:51 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x40030000000000, @loopback={0x0, 0x1}}, 0x1c) [ 1048.729894] binder: 8069:8072 got transaction with invalid offsets ptr 2018/04/13 16:41:51 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000000000000000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:51 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0xffe, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x2000, &(0x7f00001cf000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x110000, 0x2000, &(0x7f00001cf000/0x2000)=nil}) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0xd000) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) fcntl$addseals(r2, 0x409, 0x5) 2018/04/13 16:41:51 executing program 4: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vga_arbiter\x00', 0x22001, 0x0) r1 = socket(0x1, 0x80000, 0xffffffff) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x80000, 0x0) ioctl$EVIOCGABS0(r2, 0x80184540, &(0x7f00000001c0)=""/193) pipe2(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0f85403, &(0x7f00000000c0)={{0x2, 0x1, 0x8, 0x3, 0x9}, 0x8828, 0xff, 'id1\x00', 'timer1\x00', 0x0, 0x7, 0x5, 0x0, 0x2}) write(r1, &(0x7f0000000000)="00002e001d2300004059be735db308757793545b01950310", 0x18) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f00000004c0)={0xffffffffffffffff, 0xfffffffffffffffb, 0xdf1e}) syz_genetlink_get_family_id$ipvs(&(0x7f00000005c0)='IPVS\x00') syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') setsockopt$inet6_tcp_int(r1, 0x6, 0x1f, &(0x7f0000000040)=0x55, 0x4) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000400)={r0, &(0x7f0000000340)="a52883f2194452983fb29e817accb0d9f9e477a1cb5c53a14316c274e5eb78a6bbab9ffdd84f4882e042de93b02f21c0918e2c437ac4f3668743d9ca804266c5d85ba6de4c877131d3434916fd015df90855040cf7cf42409b1438ecfe22b33b11d0adba6c2c9a16cbd7f2dfc4dc88f1a9be4350bad4b6afa9cb3f813d447e2ee54bd4614c5ed631ab3d2910c2b5352abd73dddf44c7da2d03319debbc3c8f31036964989f606d45124ef6322cd8b9fb9596ac1642d68d7642bb", &(0x7f0000000600)=""/214}, 0x18) 2018/04/13 16:41:51 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1048.803675] binder: 8069:8072 transaction failed 29201/-14, size 40-8 line 2991 [ 1048.851653] binder: BINDER_SET_CONTEXT_MGR already set [ 1048.890370] binder: 8069:8072 ioctl 40046207 0 returned -16 [ 1048.973398] QAT: Invalid ioctl [ 1048.979645] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1048.998890] QAT: Invalid ioctl [ 1049.002622] binder: undelivered TRANSACTION_ERROR: 29201 [ 1049.014514] QAT: Invalid ioctl 2018/04/13 16:41:51 executing program 0: r0 = open(&(0x7f0000000040)='./file0\x00', 0x100, 0x47) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000080)=0x1) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) recvmsg(r2, &(0x7f00000001c0)={&(0x7f0000000140)=@nfc_llcp, 0x80, &(0x7f0000000200)=[{&(0x7f0000000300)=""/88, 0x58}], 0x1, &(0x7f00009f2000)=""/190, 0xbe}, 0x0) 2018/04/13 16:41:51 executing program 2: r0 = socket$inet6(0xa, 0x8000080000, 0x40a8) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mixer\x00', 0xa040, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x745}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000080)={0x3, 0x6d, 0x4, 0x2, 0x1f, 0x1, 0x93, 0xe03, r2}, &(0x7f00000000c0)=0x20) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e23, 0x4000000, @mcast1={0xff, 0x1, [], 0x1}, 0x4000000000000dd1}, 0x1000002eb) r3 = add_key$user(&(0x7f0000000440)='user\x00', &(0x7f0000000480)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000004c0)="5430562e931fbb620ff7b81f4b19b9299f4a88c47d0a9f4ee7cb65c121c78db08baa951ea5107b5e7970c61ab861ab2c4b03ee71c37c6a6b5ecd11268b418ea5abb0231fb6b3f89a4320af43ead2cae9fe7be8595835930b7ec96bb9f139eae699d2d36a669b40b22fa3256cac069f15f349440cecf36b77d39834482dec3376fd5252e57cbbf971a8a9e8017ea3fa7c1aa76962ef591d972c389dcfc8670f9c5a1561d2a7726c8a2eed235116eee0eb04e41d1038152b48ae9bfb7f624c7f34176e659acbdf93abbe3a2d70059ad15c662e151d57821ea91bbef768654fe6603cd81df0416835c9f75f6ea2ddbab7499b0ee09209536027b414f4c037250df022263a5c73993fc733dbc5c9ca3c38269d95f8cd36645e8b2466fbdb5004266fcca1f8c9602a404eaba97a6375e03bee00f17589685fb0589bbe90ef53bc5d434120e61936a92872629f086329fcae0e95441867da043bf4282fdb6dde2ceb36d1b0d004e2589803c070041ad7df6bda35b79a1c783c6336de3574cdb53e86d4ece52e4b7e37daca2fdf68c7c587e9dbf6a0101f72440a1a16b1a9df01ab1a6c494dab34d80b2a50a4105ff453cbbe3cc59d9aa77f910dba3e5eff7f61ff7d1ba39986742ada2c45256516165682eb73ebe07d62a7e90df1e55988ebfd32779ca8986240cc3146738135005800886a00a2adfb00be71bf517b25d1e535348914cc36c8f7771c4f0c4e739c64c4da90c4c668a5613751fe1a827d4de19b043f7ce01845311b2c6f19a923cb7a42809c916dad75f642c4017cc4f4053b46c41ded6e1f5ccb7388a248e9c26e4b26b97a1364c1b45810ad0a0d7044c22d771027033fec72ac8795674bece04e278697558b815a754d0f81a680cf253225e16590f684cbd63f2cf39bdda7a44f2d2e616bd1d8db57f2c8e8a338974105f408542d958c19c0c6d26ade4e3ac6f593b1cb9519e831a6046a6c16a81a0fca502d3eb1580f98080043c0443c5e63cbac8600157165e7a57368965100de59ae44038af8e9c63dc6fa1ea05bb59bce5b078ef7ae914411fb529ae9c973ab1e04c8c01024c515037fa3732afced3e9e76e7d415208df9ea46010ca264fea749f2feb0430fa8322c037140cafcbc55b0ed527b6d60a5aaf5359db439d58bd7a18b31ca28e0d96a8a9eb65f778df9db3397e3f6fd0eb8fc4fb1651fd3b0575cde83a67133a99c399f1d28f150753ee9350e8c69af37c59838b9a910e6218bb1e8bb9e2bad07222d7923d6784fd051294a88a7051c5390e8f9543e9edd4b369b3794a3ea8ca4acf2bef48d9bf05b05d8a0a42ef1b763c2d9a4819bcb0e5f067d1633d3c09d0266c9b836885c0370d7191e2aa1309918e610a9b5803ca7f62271d23080ea0dd50256933324ab426081df472073cbec65ef8ad65d383e29ba716644ad5cb2a964f7deef46d45ec4396e830a1358947e4cea63afabfe3580e53a4b3e1ed8e65131c3277f5f71db38e88963bd6049819cb7fa89af8faa5a4dbce216dd9bea85f209093e0d3601cefaad56c0d8fa8bb935298286668b5d281ec9091eac19cc177f11dbefc54628826fe0ffcaf942478101f76f05df015479f06af8bb3617a990a82c17dede69d4d580ffcaae7c62fe1fc73e75cfa270669a79cb94462f85cf6c220ac2af44c5c8c7412535f90a83ba5c649f086da717043aa6fecb4a9acd1b3f18baa2af4b510831325a4ce7cc3dba6a152984c13f06450a038340fc4b440b06c08f9db1e6e8e173d7849dc7c1005ee156deadddad85fb0d4e7bf8c3e43b29c7f981f2084a9c2fa31c77f5385bd75f2747c24c2885f3b141756d547d4e5b419745d75b836bafeebf79bc439d16eaa5d8fcc296abcdf2c7082d39c6e3110164d37a857d384fa9ad4bb50357b071e42ae233844d1b3a5fd0eb986d5975c5a1ba9bddfa3e850509fe88240b08a89494ede2380d0bc535c652cbe66d8749bdf7f38b90aa299c0850411f76acbfa8a9899216f14ed70d147b1d0eaa0cd76c3aad2c27ffa1a9ff6e59cfde2772a7c8dd127bcc7adb061160aae49c789882147cb0f4ee0500d8a88acf0955afe4e701582636cb76de53da68f461ef52bd0b34a36a6967713756fde4157f95da54ad8a85f3492859507897062587bebf0e20d55b65eaea8502d16cd13b21ec6854549868132ce02abb5a968ae6673e0323f50c6c2f98fc2aae8c055e0e50b4b14c8773a8ef8bdab02ce70438ecec96b59c2e16ce97d5b2adfe192adef19d0969af180e0485cd5039690f549588e7d605276a9b5dcd97d3462a623d620ebd952406f164881e3538e8c85eee30043e7f6d5f5746c66c7b3e13fc348a24a6a28bb370d045a906798f438b33d92bb3aa8fdc58c29d43940e8520fb8de443164918bc01ccb066c667615082280f8bcb82eda7309054e1aa2afbde56cacb58892c537c77637b56c332f6e67506b8a9df49f9bfa7a01d1801b7dff88ebc31433dc9e2ee1d6c8797a18931a6e707f96d4baff8616f9bdd0f545f6c331c00bd5cceedc8e4f5072b5916c14e8a8e6f7883d675c7ea349eee658452459bcc6ba6e792179a984f0ac14a2799ad25ae6fcb0ca4185338f148d3b7b3f64b6a4edeceed1a60c41b5363f0162d782b915adbc6b0d9ffec856172fd492d4cc6d22b725af1c52b044efb5fc573bcf5df969353e831134f320379833fbfcab57b0f434bca9e1fc3b83cb1fd6e316c457701aaa7017debafcfc47a53e2460edaf315c1c48282d8fe6093330834826e7641096e16c7441401e185157792522062445c8f072e188a53a7f8afd825e8ce8c6208e91b0092ab5413c103c020734a4fc3a010110e08ebffbfa57f4f49a7ab18a82dcf9bd1ac614c74eec589a735c3c889d24fe676533c29d66b083778ef8b20da47392d6068416a6561660983dc4d04c74f6336fa478c2c25acd136f7159c4fc924eea7d39b49816958a484ae2cb38e0be57cab54e08b39f2a8e57bcdc601dc509ce2e5e4f474d91fd23b29bf550118fe2d62c6ad02d2c56840d9f9da11760e77822dc2fc4059042f274307ccf40bb91f8d2299b2f681c7017f8bec2b2f4aa466a7f74884b68ab579546bc7cb05071ff3751ad585f31bf5187edd885867145e135d2415590a6aae0387fdcf65011a42bd6c6cab79d602aa26e7777a00b088594a0dbb7e38325709c10650f69f92640d9f5e3c7440a73436078492496a27ecd9924ed4e93cc1b37bdb17681c93ddb53138a3bbb3dfe7f6790876bb76f06d9c25190bfb5f7241d62ad007fc5c18221a86ff30120586ea9595e7ddc4e160470e44ea3c561be0da9185ebcd4cef4ff8cc7b4758e11feb10652c7087c52c1b4fb6e435f2ed76199f8f849b6143c28b21266d0f6c9ca042b3e13dbd15da6682d5174fa28d9dda4a84789aaf9cdfc75f5e63bba944edd4a98f57f39d7e320551f38eb9dfcefdeea5570fd5fff3c75ea4df25960eb486c5369e164ed0cdb85bdef87e32b14d51e1865ef2077b79f1dbd285b4da313ecf7f061f366efdffe7c34322f6f9d951bf55dd8c2535ae9f6bb739ca6603698e58851c58f60f467203be270cd8db0f4a063ef12c5603fb82d775907801dfef5312576c14c0130e0e209c9f0254f73ba6ba82f8f3e8d8ff1eed4ec810d0e182a8132978fc957d237fe02245e6af7c8ee94c1297313ea856eb9de554ab96d1e5fa4e6424cbd9502b6b1d9696fb1174a917f3b2cc4c5dd91b36116c61de183fb785d963c956c866efa398bbb2164201b5499afd08831e479f241f5e43d0d9de9f05c49822d6b09d4781d3d6ddfcae2ddf97ebc16ff311c14b4102e03205829a9f5b7a51ce3090017de56e9525a5bc7633f1996ab9aa7836210cf677b1df117d601314ffe458245a485473ccec49932b5d5e00ccbf5f2366964106b3b84edb1687fcea724b5e5426b4398c97e6846eccab60d7dd3ca60d6f64b139cfc32e2bcb51291f8b310d226e82d90b30dca4d7143d14686c62d6c3c39b0bde869db9451163a7523358fb9d0ec07698edfe50691aee3d264c5bcf06568473767fb5a9f44edbca5d8cbacc68462ce934080c41852920b9e48a26d746b4689488b1734b2c491864cbd299c3c56650d6ac01dafe04314bb2e44ba59f80986dec00b1decc9c4131c74f20e79d18052463067fa65114c41bf521a473b45c9c6b937023cfa977f685c0b7d6d1d41f8149106d1e30e8e9b78c8cd193f05eb42b63c0a8fab64b12cce2d092db1e9ae8364bfc73784dc82fb30afeee5f835cf2d4f7271cd22b50053d704b32aa5b1753c0e4c94658a74608bae484ea8fc95a3454197c9730770c1b7d8031250d7c53f5de3c1c0c17c84161dd19a20ba5ea23149de774b4deb5917f08530c936f8b9845c0c383ce21a894b31e6223fc2fc07e304bae2c2dd2b76453d3a947c343a452de4cc887319d8b8d850399e1084fb910d064c8045ec4800d21747c3311509fe6eb54c3893027b3c74267f0d2e7c3c6829bc5843d257412aae087da5fdb5c483a1da4184d0f46978e492b2a7ddae75226466ff1c2485b2b3c22f9bf695a456f4c048808882a061ee01e210d797383232fae3ab85a7dcffc4828a03d66f09beab8c5a4cffc7c5b10f94dc7157ccd9a5f3de2875a6a5bb64927a7cfb9ce97113634fa3955cafdf9ceda7de5d45b0ca29e6dd99e01e7a9785d29e1a8155ed5b9c05a5cb13a8811bdd534824e6f199cdeb7f48a17eb3394bef7d9bfc2f12da1effd0e7e5cf25a40a02749bddc6754d852cfaffedc01ca37877084aa3a1a4d95488e14a5e5853ac414572630ff33802400eab2c142fe0157f5ccb758d62db86d3a5cdb7f523dd4343b6858225e88e59f732763aa8760a20fcee1f9d9a60f42053fbe63905c3b1d2a23c57cc5cec501ab372c4f90a1178ecdc4f08cdc25f6880a95b3ba6c735825ca559cb06543b3a3f4811db6016d1c90399e524b2a3686d84b0c46e995fe11645c57cd017a745322b2953b6b513391d0ad5b27ad3b7e8f659db538784206eb61ea01085debc3c4da720ac593d065cdc6eecca346d002a68b32de76beef22af6f05d96147e16d35e7f2c6187486bf71e282c809e700651e01f5ba79a02ad6145eace187268cc9c0df8d254cf0e375830e2d6cf02c872d289afe346a226fe3a54822dece793e8fbe05dd5ea3c268bf611c6a3b2072a3b130588da154df90fe5f0b191f372e957179395e575e717966c7f1b2eacce860756a1b542b0c6d246d0a2fc3b86394173cca0c72c5bdefaf3f8869f0e288194f6e1688444f890b9c5829492c5951758f7506ffd7c4a5831e3577b6ea4a62be24e276c4f39468090bc5f64db8ed6595b31b086d9c118ee2ae1a3b36d96e01ad8854d32f7ffbcf580f6a81a01645e971d866fc6a4cefdb7fe734c834bc153e2b57aa2d1f1fe257ca1bd9edf7cd0cadc168de7c190f550d25f8a77c2c3e02228ae81ed42583dd7fdd1955bcee3d93c156af16e2ec9c54f75c2785416f15f5082ef6469758f1c359462a39408108fc466e115b89343c9da143c171cb4fc18008af2154ee94be9db9ff73a24772da3f6fa3c112cbcd374595def77c32f3c911f8f6f0869f1b295b65dcce6bc10892d9348ac5c7c9436e24da0b49263742b6333c0ece32895f5400da62d435794c7d4708b91882ee3b892e014b4d9a5a803ef911a94cbc2e7339349f24d65c09acf153a2851cacc715381bf812906b67061c99e73f3cc25d0eac5b751f3eea37665a9eeac67c4e557e66ab4a60fa26f84e6407d1c696ceee07ff00", 0x1000, 0xfffffffffffffff9) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r1, 0x28, 0x6, &(0x7f00000015c0)={0x77359400}, 0x10) keyctl$update(0x2, r3, &(0x7f00000014c0)="a46e0b4e21a03d985937386927951f58d8f7eeb7c726563fa2230a0cd8830c049cfe3b4186babf48d010aa266a496540fdd43f7b80a2d4cc3a6213e62c701d52f3f2ba200a62b7562aabf8ff2e4eab421771b7e7bb12b25b916570e0d12822c7e91d563ce15ad6123fbfe585ca3ae3277009df14c088b1e5c0b40bdbded4503785bfb1652c40754c4951527aef748306bbb7ed61c878d8464aeeef6e5a2084ac7a9d8d3766bef7c243213552e3889db9ac6a49da7bdcdd0e924aada5749f7527a61ac6f58cca", 0xc6) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev_mcast\x00') io_setup(0x5, &(0x7f0000000240)=0x0) io_cancel(r5, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x3, 0x595, r4, &(0x7f0000000280)="ab08f6413b5103716d7ff0986744bb4e88fc8debbbbd9a41196ce8b1541c8800626fb5f23aaf1dee32ef4e1dc7490dd6c7f52b06d0a848927f35d6f1e407724be65eb80bd0927c5afda77fa3bdcc8cc74f21a408fff6ff2d7771cc3304cb761cd0330ce426578403572c29438446adea9a4db430125c0fe98f3bb794a1561aa2171adcb77b1bd61f9ff4b6c80ffd0d1d2e5d399b4dbe8c2cdccb4c32342baedac355d719426097221b19417023e3cd30561cb22d72779257ce5d829bb916e412fcab27be876f03a36ab6d6467f27dbdd65dabb49711bd13a0343b97ab0384ef50bba1dff65", 0xe5, 0x3, 0x0, 0x1, r4}, &(0x7f00000003c0)) write$binfmt_misc(r0, &(0x7f0000001600)={'syz1', "cfd46a4a255fc7532849e3b8393593d799cdf0b6e7b8236f25a8b57c613c9dcdc6cba583c87d69f744ddec16ea86e4d042b60846a31e2e852115fbb50bf3005b53d9b439edbc5f41e64785ba8df0d16ac0818a18573a914a3daf32d61963d1aac86f7d53b46e2b47a342ae49aa9e1fda40ecba81710399efcc3bfb6daaf5edd1f7111fd75438e29c1fd44aacaf08f17bbfbed9b42b947bd3c35efc39d686ebccb0157f0d0d46f67af0d3dc7f2dcb560957ef9abb778292d383ebbaf1181740219e66191b08bbba3e30da2833cecf"}, 0xd2) r6 = socket(0xf, 0x1, 0x2) setsockopt$inet_MCAST_JOIN_GROUP(r6, 0x0, 0x2a, &(0x7f0000001700)={0x751, {{0x2, 0x4e20, @multicast2=0xe0000002}}}, 0x88) ioctl$RNDGETENTCNT(r4, 0x80045200, &(0x7f0000000140)) lookup_dcookie(0x3, &(0x7f0000000180)=""/118, 0xfffffffffffffdb4) 2018/04/13 16:41:51 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:51 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xf5ffffff00000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:51 executing program 6: socketpair$unix(0x1, 0x9, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close(r0) socket$inet6_sctp(0xa, 0x3, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r1, &(0x7f0000000580)="97", 0x1, 0x0, &(0x7f0000aaa000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) recvmmsg(r0, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000003bc0), 0x0, &(0x7f0000003c00)=""/69, 0x45}}, {{&(0x7f0000003c80)=@nfc, 0x80, &(0x7f0000000280), 0x0, &(0x7f0000003e00)=""/158, 0x9e}}], 0x2, 0x0, 0x0) 2018/04/13 16:41:51 executing program 4: r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x1, 0x40) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x31, 0xffffffffffffffff, 0x0) iopl(0x9) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000911000)={{&(0x7f0000004000/0x1000)=nil, 0x1000}}) clone(0x0, &(0x7f0000001f37), &(0x7f0000001ffc), &(0x7f0000001000), &(0x7f0000001000)) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) madvise(&(0x7f00003eb000/0xc00000)=nil, 0xc00000, 0x9) 2018/04/13 16:41:51 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000000ffffffff00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1049.017948] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1049.026367] QAT: Invalid ioctl [ 1049.075427] binder: 8113:8115 got transaction with invalid offsets ptr [ 1049.094165] binder: 8113:8115 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:51 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffea], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:51 executing program 2: mkdir(&(0x7f0000000040)='./file0/', 0x0) syz_mount_image$bfs(&(0x7f0000000100)='bfs\x00', &(0x7f0000000140)='./file1\x00', 0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0) mount(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)="52d9aac819c646f5c8bed0fc0852b7b5ed417b7d8413b9a96dc185ec93d36498adb4f74e50c2fb5f45ba1f2bd8e7abeb4977367e06aac4d6bbe51c089ff90e16026b6e85e2ba0b252d22eb0e9d6e29fd071a969fab3ed66186b126d071e8eb616b0e46d6676f81c060798f13222e2dd245d0fffc3350c1aa81789c8c6653a21250240b6d7ccd16b6b61b6c34e30f4ac0bd1d2ac992e522943579c5c6eba4d8cd9c87", 0x214c001, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x3, 0x80000) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000080)={{0x401, 0xd3f}, {0x229}, 0x5, 0x1, 0xd16e}) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000fb6000)='./file0\x00', &(0x7f0000d78000)='.', &(0x7f0000fdb000)='ubifs\x00', 0x1003, 0x0) mount(&(0x7f00000005c0)='./file0/\x00', &(0x7f0000cbeff8)='./file0\x00', &(0x7f00005f7ffa)='ubifs\x00', 0x80000, &(0x7f0000000580)) mount(&(0x7f0000377ff8)='.', &(0x7f0000187ff8)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000e7000)) mount(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file1\x00', &(0x7f0000000200)='anon_inodefs\x00', 0x2000, &(0x7f0000000240)) mount(&(0x7f0000adcff8)='./file0\x00', &(0x7f0000e08fff)='.', &(0x7f00005e9000)='cifs\x00', 0x2000, &(0x7f0000000440)) 2018/04/13 16:41:51 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x10000000000000, @loopback={0x0, 0x1}}, 0x1c) [ 1049.138203] binder: BINDER_SET_CONTEXT_MGR already set [ 1049.171309] binder: 8113:8115 ioctl 40046207 0 returned -16 2018/04/13 16:41:52 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000006000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1049.310942] binder: undelivered TRANSACTION_ERROR: 29201 [ 1049.310962] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:52 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x3000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:52 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x1b, &(0x7f0000000080)={@loopback={0x0, 0x1}}, 0x14) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) close(r1) close(r0) 2018/04/13 16:41:52 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1049.370965] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1049.396883] binder: 8150:8151 got transaction with invalid offsets ptr [ 1049.467447] binder: 8150:8151 transaction failed 29201/-14, size 40-8 line 2991 [ 1049.488454] binder: BINDER_SET_CONTEXT_MGR already set [ 1049.496726] binder: 8150:8151 ioctl 40046207 0 returned -16 [ 1049.545869] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:53 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xfc000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:53 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:53 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000039800", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:53 executing program 4: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000000200), &(0x7f00000002c0)) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x8}, 0x30100}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000140)) setsockopt$inet_tcp_int(r2, 0x6, 0x1, &(0x7f0000000040), 0x4) r3 = socket$inet(0x2, 0x200000000003, 0x7) recvfrom$inet(r2, &(0x7f0000000080)=""/22, 0x16, 0x40, &(0x7f0000000100)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) accept$inet(r3, &(0x7f0000000280)={0x0, 0x0, @remote}, &(0x7f0000000240)=0x10) setsockopt$inet_int(r3, 0x0, 0x1008000000d1, &(0x7f0000000180), 0x4) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="1215060af77bb89a0799f786c348647f"], 0x1) 2018/04/13 16:41:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000006000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:53 executing program 0: io_setup(0x1, &(0x7f0000000000)=0x0) io_getevents(r0, 0x7ff, 0x1, &(0x7f0000000040)=[{}], &(0x7f0000000080)) socketpair(0x0, 0x80000, 0xffffffff80000000, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000100)={0x0, 0x6, 0x30, 0x1, 0xa4}, &(0x7f0000000140)=0x18) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000180)=@assoc_value={r3, 0xfffffffffffffffc}, 0x8) getsockopt$inet_dccp_int(r2, 0x21, 0xb, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000700)=0x0) fstat(r2, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = getgid() r8 = getpgrp(0x0) r9 = geteuid() r10 = getegid() ioctl$TIOCGSID(r1, 0x5429, &(0x7f00000007c0)=0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000800)={{{@in6=@ipv4={[], [], @broadcast}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}}}, &(0x7f0000000900)=0xe8) r13 = getgid() sendmsg$netlink(r2, &(0x7f0000000a00)={&(0x7f0000000240)=@proc={0x10, 0x0, 0x25dfdbfb, 0x40130}, 0xc, &(0x7f0000000680)=[{&(0x7f0000000280)={0x58, 0x1e, 0x200, 0x70bd28, 0x25dfdbfd, "", [@typed={0xc, 0x93, @u64=0x400}, @nested={0x10, 0x90, [@typed={0xc, 0x23, @u64=0x1}]}, @generic="5c46124c0bf3ec72dedf6ea1832e62d60b671dee779b8e5b94918a776e1b2b7799448dae7b9742c1970aa2"]}, 0x58}, {&(0x7f0000000300)={0x1c, 0x31, 0x302, 0x70bd25, 0x25dfdbfb, "", [@typed={0xc, 0x7f, @u64=0x2}]}, 0x1c}, {&(0x7f0000000340)={0x308, 0x1d, 0x520, 0x70bd27, 0x25dfdbfd, "", [@generic="13f987f6f12387ab7b7f6127403bcfbb82b06472cc8c2ab98ea92791d1061ebbff3dd1df9f6c594a661ab822307948158f7f109223a9e75c8e8d83b8e6fc07f1ade04df4b4905523394c9236d0182ee126d03ef8870d0effb52b70ab192d20bd76b9c3ad175ca191243185023a5eb19868bfda127ec86754ce1cb18123b19ab8bc405ab63080feb8d92a6d8ae37183f5f1db91e8bb3d7cbec7418c31115b6a5ce3c2e26a27361230e4148a32a60adb80692457228c0ed9844c200a39c554690544720f1e7f005990d3f9a232c822474f1bc17121f0c6b278fb424cbcb586ca75a219547e1135758a05f68eeacc848ec6", @generic="587688adafbb5e0931874b5df01aba327606a987a550f8632015fc78beb86aa9656b19982529833bb8b8ef90872c481a7acdf8d0a3c886a38e91b1448c9c7c3463a87f2d596ab54e6ef764c28b799a17253087d390a514d3fa037bc4b38535ca3f55f7717b50ec", @nested={0xd8, 0x8, [@typed={0xc, 0x3b, @str='trusted\x00'}, @generic="3c2c342eb3facca488d38711ee5d20e8d0adf1d3ad84456f64ae72188a234306ce14a8a723943ad4ffc179ca99999376192e6f72293c512b5e9aedba65d235edf5380df38535293df21c9170e4a8e4aa0e54ae48453812c7974f86fdc20e34f6b713d62fb7cc4b8ab4904da3962e0d7d15dd3890576ae4cfea185cd6ddc007cc1aa091091b8f6efd05f8fb280bfa1ce3f0b94a45b95eec99ac1e9b69c692e84ec4061e83ea98fbfb74e619f1923f2321c35f47e6231aef8abaf1100c7569587165d9c9a9b4b1"]}, @nested={0xc8, 0x7d, [@typed={0x78, 0x35, @binary="b749468dabf3ab37b5e7dbcffecf1c936bd7ac0c2cbc62dca2edfbb213e088ba0e210a5c368d18ba7ef1578e73d798c28f4fa0fe3fda3396779b486b1dfd1dd1e91691ffef4392b70a8061303c2b6c6ca020f8d818f7962337e2f4b5ca0aed2ea29f9bd8921b84272d259d9ae76b587f58647429"}, @generic="97c931240a37639ba3b4f930bebb627276a97d65f7ba36793108433e1cc56577b5ccaf5925562ffc37853f7f2717c9ba929cffd2e49bf62b54754099bf2a2e032cd0751da6c21408e178"]}]}, 0x308}], 0x3, &(0x7f0000000940)=[@rights={0x30, 0x1, 0x1, [r1, r2, r4, r2, r2, r2, r2]}, @rights={0x18, 0x1, 0x1, [r2, r1]}, @cred={0x20, 0x1, 0x2, r5, r6, r7}, @cred={0x20, 0x1, 0x2, r8, r9, r10}, @cred={0x20, 0x1, 0x2, r11, r12, r13}], 0xa8, 0x40}, 0xc000) time(&(0x7f0000000a40)) ioctl$TUNSETOWNER(r2, 0x400454cc, r12) getpgrp(r11) getsockopt$inet_dccp_int(r1, 0x21, 0x5, &(0x7f0000000a80), &(0x7f0000000ac0)=0x4) connect$pptp(r1, &(0x7f0000000b00)={0x18, 0x2, {0x2, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x1e) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000b40)) fcntl$setlease(r1, 0x400, 0x2) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000b80)=@assoc_value={r3, 0x8}, 0x8) getsockopt$inet_int(r1, 0x0, 0x0, &(0x7f0000000bc0), &(0x7f0000000c00)=0x4) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x3b) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) syz_open_dev$vcsn(&(0x7f0000000c40)='/dev/vcs#\x00', 0x4, 0x41) open(&(0x7f0000000c80)='./file0\x00', 0x381001, 0x20) 2018/04/13 16:41:53 executing program 2: r0 = socket$inet(0x2, 0x2, 0x2000000088) recvmsg(r0, &(0x7f0000001200)={&(0x7f0000000000)=@nfc_llcp, 0x80, &(0x7f00000001c0), 0x0, &(0x7f00000011c0)}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000080)={{{@in6=@mcast2, @in6=@loopback}}, {{@in=@rand_addr}, 0x0, @in=@rand_addr}}, &(0x7f0000000180)=0xe8) getsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f00000001c0)={@multicast1, @dev, 0x0}, &(0x7f0000000200)=0xc) bind(r0, &(0x7f0000000400)=@hci={0x1f, r1, 0x1}, 0xa9) sendto$inet(r0, &(0x7f0000000280)="a77d90cecea9a1580dd9330747fcc704d7ac140afceaa150f5a3636a36439517bf6f952fe0abfd18822d2c783fbd863827c897e456003cb6bc53889946ba68629bec186af3", 0x45, 0x0, &(0x7f0000e81ff0)={0x2, 0x4e20}, 0x10) accept4$inet(r0, 0x0, &(0x7f0000000240), 0x80800) 2018/04/13 16:41:53 executing program 6: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000180)={{}, {0x0, 0x989680}}, &(0x7f0000000080)) r1 = syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0x0, 0x400002) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f00000002c0)=0xe8) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000300)={@mcast1={0xff, 0x1, [], 0x1}, @mcast1={0xff, 0x1, [], 0x1}, @local={0xfe, 0x80, [], 0xaa}, 0x1, 0x9, 0x7, 0x500, 0x7f, 0x4800002, r2}) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000540)) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x882, 0x0) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000380)={0x0, 0x2, 0x8000, 0x5, 0xffffffff, 0x8, 0x4, 0x100000001, {0x0, @in={{0x2, 0x4e20, @local={0xac, 0x14, 0x14, 0xaa}}}, 0xa9, 0x3d4b5107, 0x800, 0x6, 0xc4}}, &(0x7f0000000440)=0xb0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000480)={r4, @in6={{0xa, 0x4e22, 0xf9d4, @remote={0xfe, 0x80, [], 0xbb}, 0x2}}, 0x60c, 0x601da33c, 0xff8, 0x9, 0x20}, 0x98) sendto$inet6(r3, &(0x7f00000000c0)="8d750727ff9e8c5ddce3df03dc85b014c411723011e02649ad835e419d7e1a594133d1497bc0999b34574a3d57960c209902376ad68b6529e4e55293998effd58a4bd14c9134d2016377e5d13553cfbf6f66", 0x52, 0x1, 0x0, 0x0) read(r3, &(0x7f0000000680)=""/35, 0xfffffe59) [ 1050.292306] binder: 8185:8188 got transaction with invalid offsets ptr 2018/04/13 16:41:53 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:53 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xe000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:53 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe2(&(0x7f0000e3eff8)={0x0, 0x0}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000040)=ANY=[@ANYBLOB="001b4a6c"], &(0x7f0000000440)=0x1) r4 = dup3(r3, r2, 0xfffffffffffffffd) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x10005, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SMI(r3, 0xaeb7) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, &(0x7f0000000240)="0f0097fd050000c4c2fd38407cb8010000000f01d9b9800000c00f3235000800000f3066ba420066b8c00066eff326f4b9800000c00f3235004000000f30660f3881a7621c96dd66baf80cb8385d3080ef66bafc0cedb9800000c00f3235004000000f30", 0x64}], 0x1, 0x1c, &(0x7f0000000200), 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 1050.332437] binder: 8185:8188 transaction failed 29201/-14, size 40-8 line 2991 [ 1050.349219] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1050.372444] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:53 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:53 executing program 4: syz_emit_ethernet(0x5a, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @link_local={0x1, 0x80, 0xc2}, [{[], {0x8100, 0x2, 0x3ff, 0x2}}], {@canfd={0xd, {{0x1, 0x0, 0x1, 0x5}, 0x25, 0x1, 0x0, 0x0, "4881856ff9dd1587908001524b57697b069ab3a7d564856a6ded5bc1e71a43a4037e32b1000771fc3742832d254317200d3a9d0c2a9345ec1e044c0fbeef753b"}}}}, 0x0) [ 1050.418463] binder: 8185:8188 ioctl 40046207 0 returned -16 [ 1050.428414] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1050.551913] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:54 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x600, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:54 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000009fc8)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f000000d379)={&(0x7f0000012e30)={0x14, 0x16, 0x401, 0xffffffffffffffff, 0xffffffffffffffff, {0x4000a}}, 0x14}, 0x1}, 0x0) r1 = dup2(r0, r0) getpeername$ax25(r1, &(0x7f0000000040), &(0x7f0000000080)=0x10) 2018/04/13 16:41:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:54 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:54 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000fcdfe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f000086c000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r0, &(0x7f0000465f8e)=""/114, 0x72) ioctl$sock_SIOCGIFINDEX(r0, 0x2401, &(0x7f0000003780)={'bcsf0\x00'}) read(r0, &(0x7f00000010c0)=""/4096, 0x1000) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000c22ff0)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 2018/04/13 16:41:54 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:54 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)=ANY=[@ANYBLOB="cb"], &(0x7f0000000240)=0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000de9000)=[@text32={0x20, &(0x7f0000f59fc6)="0fc75fedc4c3c968fb6c0f9cfbb9040100c00f3266b842008ee80f230064672ec015dec4e245bea5d41e6082f9440f20c03506000000440f22c0", 0x3a}], 0x1, 0x0, &(0x7f0000000180), 0x1ba) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000040)="c4c2790e560ec74424000c000000c744240237bdcb3ec7442406000000000f011424b805000000b9b0c858080f01d90f20e035002000000f22e00f20e035000200000f22e0c74424000a080000c7442402f2080000c7442406000000000f011c2466440f3a0c541cfb160f32470f009d09000000660f30", 0x77}], 0x1, 0x8, &(0x7f0000000100)=[@cr0={0x0, 0x40008}, @cr4={0x1, 0x20}], 0x2) 2018/04/13 16:41:54 executing program 6: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_ifreq(r0, 0x89b1, &(0x7f0000000000)={'gre0\x00', @ifru_flags}) r1 = syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x3ff, 0x800) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000180)={0x6, 0x8, 0x7, 0x4, 0x8, 0x3}, 0xc) accept4(r0, &(0x7f0000000040)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff}}, &(0x7f00000000c0)=0x80, 0x0) ioctl$sock_ipx_SIOCAIPXPRISLT(r2, 0x89e1, &(0x7f0000000100)=0xad) [ 1051.344396] binder: 8232:8234 got transaction with invalid offsets ptr [ 1051.380837] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:54 executing program 0: r0 = socket$inet6_sctp(0xa, 0x6, 0x84) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000e6e000)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @loopback={0xfffffff5, 0x1}}}}, 0x108) [ 1051.381775] binder: 8232:8234 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:54 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:54 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x4000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:54 executing program 6: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x200000, 0x0) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f00000002c0)) io_setup(0x4, &(0x7f0000000100)) r1 = socket(0x11, 0x100000802, 0x0) r2 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x2) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x1411}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201}) io_setup(0x469, &(0x7f0000000180)=0x0) ioctl$TUNSETVNETLE(r2, 0x400454dc, &(0x7f00000000c0)=0x1) io_submit(r3, 0x1, &(0x7f00000016c0)=[&(0x7f0000001380)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000080)}]) [ 1051.438758] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1051.474896] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:54 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:54 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x600000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:54 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000073ab0100", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:54 executing program 4: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000fa8fe4)={0xa, 0x4e23}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @dev={0xfe, 0x80, [], 0x21}, 0x80000000}, 0xfffffe35) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000040)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_AGP_RELEASE(r1, 0x6431) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}}}, &(0x7f0000000740)=0x98) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f00000000c0)={0x0}) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCFLSH(r3, 0x540b, 0xff) ioctl$DRM_IOCTL_SET_SAREA_CTX(r1, 0x4010641c, &(0x7f0000000140)={r2, &(0x7f0000000100)=""/28}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') [ 1051.541638] binder: 8232:8234 ioctl 40046207 0 returned -16 2018/04/13 16:41:54 executing program 2: r0 = socket$inet6(0xa, 0x8000000000000005, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000000)={{0xa92, 0x9}, 'port0\x00', 0x1, 0x20000, 0xb28, 0x3, 0x5, 0x7, 0x5, 0x0, 0x6, 0x1}) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000380)=0x3, 0x4) epoll_create1(0x80000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x1) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') getpeername$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000300)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000400)={{{@in=@broadcast, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast2}}, &(0x7f0000000500)=0xe8) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000580)=0x14) getpeername$packet(0xffffffffffffff9c, &(0x7f0000003cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000003d00)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000007000)={{{@in6=@ipv4={[], [], @remote}, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000007100)=0xe8) accept4$packet(0xffffffffffffffff, &(0x7f00000073c0)={0x0, 0x0, 0x0}, &(0x7f0000007400)=0x14, 0x800) getpeername(r0, &(0x7f0000008a80)=@hci={0x0, 0x0}, &(0x7f0000008b00)=0x80) accept4$packet(0xffffffffffffffff, &(0x7f0000008b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000008b80)=0x14, 0x80800) getpeername$packet(0xffffffffffffff9c, &(0x7f000000a100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f000000a140)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f000000a380)={0x0, 0x0, 0x0}, &(0x7f000000a3c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f000000a400)={{{@in=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast2}}, &(0x7f000000a500)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f000000a540)={{{@in=@broadcast, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f000000a640)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f000000ab80)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f000000ab40)={&(0x7f000000a680)={0x4c0, r2, 0x303, 0x70bd27, 0x25dfdbfd, {0x1}, [{{0x8, 0x1, r3}, {0x78, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x2}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0xc, 0x4, 'random\x00'}}}]}}, {{0x8, 0x1, r4}, {0xb4, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8, 0x3, 0xe}, {0x8, 0x4, 0x101}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xc37e}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x10001}}}]}}, {{0x8, 0x1, r6}, {0xec, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xffffffff}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0xd8, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x2c, 0x4, [{0x7, 0x40, 0x3, 0x8}, {0x8, 0x1, 0x4, 0x4}, {0xdd1, 0x3, 0x5, 0x7}, {0x1000, 0x4, 0x5, 0xffa64fd}, {0x1f, 0x17, 0x7, 0x3}]}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x14}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7f}}}]}}, {{0x8, 0x1, r11}, {0x104, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x6}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8, 0x3, 0xe}, {0x8, 0x4, 0xd0c}}, {0x8, 0x6, r12}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r13}}}]}}, {{0x8, 0x1, r14}, {0x4, 0x2}}, {{0x8, 0x1, r15}, {0x7c, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x2000000}}, {0x8, 0x7}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xfffffffffffffffc}}}]}}]}, 0x4c0}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000140)={'filter\x00', 0x33, "d06c06506ced595dc757caf8b8281f1892c61486d7dc08deb7b87500f1c27dbdc8a331bdd979c16850d11c63da71962683dc83"}, &(0x7f00000001c0)=0x57) 2018/04/13 16:41:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1051.690460] binder: undelivered TRANSACTION_ERROR: 29201 [ 1051.751391] binder: 8287:8289 got transaction with invalid offsets ptr [ 1051.779327] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1051.780185] binder: 8287:8289 transaction failed 29201/-14, size 40-8 line 2991 [ 1051.809182] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1051.829103] binder: BINDER_SET_CONTEXT_MGR already set [ 1051.849267] binder: 8287:8289 ioctl 40046207 0 returned -16 [ 1051.876793] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:55 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:55 executing program 2: r0 = socket$inet6(0xa, 0x80003, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in=@broadcast=0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14}, 0x4d6, 0x2b}, 0x0, @in=@broadcast=0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x90}}, 0xe8) connect$inet6(r0, &(0x7f0000000180)={0xa}, 0x1c) 2018/04/13 16:41:55 executing program 0: mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x400, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x16, &(0x7f0000000100)=""/227, &(0x7f0000000200)=0xe3) accept$ipx(r0, &(0x7f0000000080), &(0x7f00000000c0)=0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0}, &(0x7f0000000280)=0xc) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f00000002c0)=r1) syz_open_dev$urandom(&(0x7f0000000000)='/dev/urandom\x00', 0x0, 0x0) memfd_create(&(0x7f0000f9dffe)="c403", 0x1) 2018/04/13 16:41:55 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000180)={0x3, r0, 0x1}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000001c0)={0x7, 0x0, 0x1, 0x58c0}) ioctl$DRM_IOCTL_SG_ALLOC(r1, 0xc0106438, &(0x7f0000000240)={0xfffffffffffffffd, r2}) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x2}, 0x10) listen(r0, 0x43) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r3, &(0x7f000087dffe)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) fcntl$dupfd(r3, 0x0, r0) r4 = accept4(r0, 0x0, &(0x7f0000000000), 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa}}, 0x0, 0x0, 0x0, 0x0, 0x85}, 0x98) 2018/04/13 16:41:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:55 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000000ffffffff00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:55 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x500000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:55 executing program 6: 2018/04/13 16:41:55 executing program 6: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x3ff, 0x359f, 0x4, 0x4, r1, 0x101}, 0x2c) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000080)={{0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, {0x304, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x0, {0x2, 0x0, @multicast2=0xe0000002}, "0008000000759b288842f5ac1f020409"}) [ 1052.845813] binder: 8306:8307 got transaction with invalid offsets ptr [ 1052.864681] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1052.879380] binder: 8306:8307 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:55 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:55 executing program 2: r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000000000)="2400000020002553075f01650272fcf280000000001000220ee1000c08001700002b0600", 0x24) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x8000, 0x0) 2018/04/13 16:41:55 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xb80b, @loopback={0x0, 0x1}}, 0x1c) [ 1052.912335] binder: BINDER_SET_CONTEXT_MGR already set [ 1052.922798] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1052.950249] binder: 8306:8307 ioctl 40046207 0 returned -16 2018/04/13 16:41:55 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x8002) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000040)={&(0x7f000000f000/0x3000)=nil, 0x7, 0x4, 0x4, &(0x7f0000ffd000/0x3000)=nil, 0x8}) write(r0, &(0x7f0000000000)="b63db85e1e8d020000feff00003ef0011dcc606aed5ed2bc7018cebc9bc2feffffffffffffffe22c9b160096aa1fae1a31", 0x31) readv(r0, &(0x7f000085dff0)=[{&(0x7f0000e94000)=""/62, 0xffbd}], 0x1) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)) getresuid(&(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) accept4$packet(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000400)=0x14, 0x80000) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000440)={{{@in=@dev={0xac, 0x14, 0x14, 0x1f}, @in6=@remote={0xfe, 0x80, [], 0xbb}, 0x4e24, 0x1, 0x4e24, 0xfffffffffffffff9, 0xa, 0x80, 0xa0, 0x3c, r3, r1}, {0x94, 0x2, 0x2, 0x5, 0x5, 0x100000000, 0x832, 0x1}, {0xffffffff, 0x63, 0x401, 0x2}, 0x10002, 0x6e6bbc, 0x2, 0x0, 0x3, 0x1}, {{@in6=@remote={0xfe, 0x80, [], 0xbb}, 0x4d2, 0xff}, 0xa, @in6=@mcast1={0xff, 0x1, [], 0x1}, 0x3500, 0x3, 0x1, 0x5, 0x3, 0x3, 0x4}}, 0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) r5 = request_key(&(0x7f0000000540)='user\x00', &(0x7f0000000580)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000005c0)='nat\x00', 0xfffffffffffffffc) r6 = add_key$keyring(&(0x7f0000000600)='keyring\x00', &(0x7f0000000640)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$reject(0x13, r5, 0xfffffffffffffff7, 0x6, r6) sendmsg$unix(r0, &(0x7f0000001600)={&(0x7f00000012c0)=@file={0x0, './file1\x00'}, 0x6e, &(0x7f00000015c0)=[{&(0x7f0000001340)="f8023dddfff3c56a932acb676e512887ab74093b716c0223dc84234085678151041c6861149a44afc61e4e37bf01cbf72208368d546deaa92c921f140bee851a3e3d4cd5564557d46a89c7d4773226662c6317a6acc05219a06dcedcfce03b86f690e90142eb3021d4256d9357d9ee2f131d0d30f53a28e15e3e8161432ad14a48dc020dfc2f523aead0951db23f3b405d7e453fa9438b4f75455e95bc49948e113215576ce4f473825378f90bd83167f3d29e878a6e026a7a595d725c82b2e2d1995066e53218d26364803519906b12b08d19f70911e9b87829edb909", 0xdd}], 0x1, 0x0, 0x0, 0x40804}, 0x20000001) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000001240)=@nat={'nat\x00', 0x19, 0x4, 0xe81, [0x20000380, 0x0, 0x0, 0x20000788, 0x20000950], 0x0, &(0x7f0000000080), &(0x7f0000002500)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000f0000001000000000f77369743000000000000000000000000079616d3000000000000000000000000069703667726574617030000000000000736974300000000000000000000000000180c200000e000000ff00ffaaaaaaaaaaaa00ff2eff00ff0000980100000002000038020000636f6d6d656e7400000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000072656469726563740000000000000000000000000000000000000000000000000800000000000000ffffffff000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff0000000009000000080000000a01766c616e30000000000000000000000073797a5f74756e00000000000000000062637368300000000000000000000000626f6e64300000000000000000000000aaaaaaaaaa3f0000ffff0000aaaaaaaaaabbffff00ffffff0000f000000028010000a001000074696d650000000000000000000000000000000000000000000000000000000018000000000000000800000000000000c7500100a80b010009000000070100006f776e6572000000000000000000000000000000000000000000000000000000180000000000000029", @ANYRES32=r2, @ANYRES32=r4, @ANYBLOB="0401000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000ffffffff000000006e666c6f6700000000000000000000000000000000000000000000000000000050000000000000000900000004000500000000005383fcbcca523c00e3840265e27e6711c4f3bc2e9a074fc8a0f2bbf74263f07f7e160d8d14bdfa8a7bba739720feb5b7ed98a48dafbdaf90af45432b1100c7240000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff010000000000000021000000080669703667726530000000000000000000736974300000000000000000000000006970366772653000000000000000000067726574617030000000000000000000aaaaaaaaaa13000000ff00ffaaaaaaaaaabb00ffffff00ff0000e0000000600100009801000072617465657374000000000000000000000000000000000000000000000000004800000000000000626f6e64300000000000000000000000677265746170300000000000000000000400020001800000eb000000feffffff0700000000000000080000000000000001800000000000004552524f5200000000000000000000000000000000000000000000000000000020000000000000005c1f918cebbe8fe95563d4fa281e9acde75bb58e14aae3bd793ff522eed900006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000d585656a51f30000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000feffffff010000001900000021000000000073797a6b616c6c6572300000000000006263736830000000000000000000000064756d6d79300000000000000000000073697430000000000000000000000000aaaaaaaaaabbffff0000ffff000000000000ff00ffff000000005808000058080000880800007533320000000000000000000000000000000000000000000000000000000000c007000000000000ad0f0000000000008100000003000000008000000300000081ffffff02000000030000000000000005a00000010000000100000001000000060000000100000071bf0000010000000b0000000000000005000000000000000200000001040000d0ffffff330900009f040000ffffff7f05000000000000008100000073770000400000000001000004000000f1025d47010000000100000001000000070000000000000004000000e6000000070000000b000000ff7fffff0200000007000000010000000500000003000000030000000000000004000000020000000400000002000000ffff00000300000001000000020000000800000003000000740000000200000001f8ffff03000000ff7f0000080000003b00000000000000040000000400000001000000ff0f0000ff0f00000700000002000000810000000200000006000000640200000004000008000000d6fffffff008000002000000ff0000000700000003040000380000000000000000020000010000000400000001000000000000000100000009000000010000007f000000010000000800000003000000ffffffff03000000080000000000000000000080000000000000000003000000040000001f000000f11700007d2500000400000009000000c970000009000000690000005c00000007000000010100000700000005000000bb0a00000400000000000000020000000800000001000000ffff000006000000010b0000dc04000001000000010000000300000001feffff00000000070000000100000019ed000002000000090000000300000002000000000000006c8d000003000000070000000100000009000000000000000000200000000000fffeffff030000000600000005000000ff030000f7ffffff00040000020000000002000003000000f83affff0700000006000000090000000080000006000000d100000000000000030000000200000009000000020000000802000004000000010000000200000000000000020000000300000000000000010000000000ffff030000000200000000000000ff00000003000000000000000300000002000000030000000100000002000000000000000100000001000000fbffffff3b080000050000000500000000080000ffffffff3c0000000000000012f0ffff3b00000000000000090000000200000006000000fcffffff09000000fdffffff0100000006000000feffffff80000000010300000700000000000000030000000000000006000000030000007f000000030000000100000002000000030000000000000006000000000000000200000001000000fa0600000000000003000000030000000a39000003000000090000000d000000030000000400000008000000000100007f000000f8ffffff09000000ff01000000200000fcffffff01000100000000000300000009000000060000005bc400009c00000009000000760300000500000004040000080000000000000001000000030000000000000000000000040000000000000003000000030000000600000001000000020000000000000001000000010000000300000003000000090000000300000000010000000000006c0000008100000008000000b223000005000000ff000000010000000600000080000000070000000700000000100000040000000300000000000000400000001f00000080ffffff020000004e00000005000000010000800b080000010100000100000006000000000000001f00000003000000090000000200000009000000030000006f04000003000000ff0700000000000000000000010000000500000003000000a20000000300000001000000030000004f1c00001800000000000000810000005249000008000000ff000000feffffff01000000000000000300000051800000fb3ca7fffffff8ffffff0300000007000000030000000010000000000000090000004b2900008100000001060000000000800100000006000000020000000300000001000000090000000000000094010000020000008100000003000000000a0000030000000400000003000000000000000200000007000000000000003f000000020000000002000000000000c80a00000100000003000000200000000200000004000000ea00000001010000ffffff7f81000000930700000600000005000000040000000500000026db0000050000001f000000170000003f00000000040000010000000200000001000000020000000700000003000000000400000300000000000080030000006d19000002000000e10b000003000000ffffffff0300000009000000000000000600000001000000010000000000000004000000070000008100000006000000ff0f00000000000003000000020000000400000040000000090000000600000040000000080000000800000003000000010001003f000000ff07000005000000010000000100000001050000525cfc6a0000000007000000030000000100000001000000e80000000300000085848d5401000000030000000000000009000000010000006c5f000002000000ff07000001000000ff7f00000200000000000000000000000900000000000000ff010000020000008000000002000000060000000000000071040000010000000000000051000000018000000000000006000000fdffffffff03000000020000ffffffff07000000050000000500000003030000000000004e4651554555450000000000000000000000000000000000000000000000000008000000000000008100000000000000"]}, 0xefb) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000380)={&(0x7f0000ffe000/0x2000)=nil, 0x0, 0x3, 0x11, &(0x7f0000010000/0x1000)=nil, 0x6}) 2018/04/13 16:41:55 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000000000000000200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:55 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1053.047411] binder: undelivered TRANSACTION_ERROR: 29201 [ 1053.110279] binder: 8343:8344 got transaction with invalid offsets ptr [ 1053.170828] binder: 8343:8344 transaction failed 29201/-14, size 40-8 line 2991 [ 1053.187664] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1053.206250] sg_write: data in/out 167162/1 bytes for SCSI command 0xff-- guessing data in; [ 1053.206250] program syz-executor0 not setting count and/or reply_len properly [ 1053.227628] binder: BINDER_SET_CONTEXT_MGR already set [ 1053.241577] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1053.253304] binder: 8343:8344 ioctl 40046207 0 returned -16 [ 1053.289550] sg_write: data in/out 167162/1 bytes for SCSI command 0xff-- guessing data in; [ 1053.289550] program syz-executor0 not setting count and/or reply_len properly [ 1053.299005] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:56 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(blowfish)\x00'}, 0x58) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x9, 0x80000) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x1) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00004f7000)="649c47ad", 0x4) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)="a6d542d766ff62a804d491ba4ac31c41c24e68a925613d3effe52a114a59dd9e7231d35aa158b6fa6f0647e6ea30b3fe0a648490ecc7a4dea549dab678c3414a5f7ef4fbcba9f3bbc19d2a94794ab4a99bf376ab09cfb6a4", 0x58}], 0x1, &(0x7f00000001c0)}, 0x0) recvmsg$kcm(r2, &(0x7f0000e63000)={0x0, 0xfffffffffffffea8, &(0x7f0000000100)=[{&(0x7f0000588fa9)=""/87, 0x389}], 0x1, &(0x7f0000142000)=""/60, 0x3c}, 0x0) 2018/04/13 16:41:56 executing program 6: socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000180)=0x14) r2 = getuid() setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@local={0xfe, 0x80, [], 0xaa}, @in6, 0x4e23, 0x0, 0x4e22, 0x401, 0xa, 0x80, 0x20, 0x33, r1, r2}, {0x6, 0x2, 0xe09d, 0x7fff, 0x2, 0xff, 0x5, 0xfffffffffffffffe}, {0x2ff5, 0x6, 0x100000000, 0x1000}, 0xaaf, 0x6e6bbb, 0x1, 0x1, 0x2, 0x3}, {{@in, 0x4d2, 0x3b}, 0xa, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x3504, 0x3, 0x1, 0xc63, 0xffffffffffffffff, 0x200, 0x2}}, 0xe8) r3 = socket$inet6(0xa, 0x80005, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f000022a000)=0x100008001, 0x4) bind$inet6(r3, &(0x7f0000002000)={0xa, 0x4e20}, 0x1c) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e21, 0x3f00000000000, @mcast2={0xff, 0x2, [], 0x1}, 0x80000000}, 0x1c) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:56 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000007fffffe00", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:56 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:56 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xf, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:56 executing program 4: execve(&(0x7f0000002000)='./file0\x00', &(0x7f0000000000), &(0x7f0000000080)=[&(0x7f0000000000)='posix_acl_accessnodevsystem\x00', &(0x7f0000000040)='selinux\x00']) r0 = socket$inet(0x2, 0x7, 0x7) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x800, 0x10) execveat(r1, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240)=[&(0x7f0000000140)='posix_acl_access\x00', &(0x7f0000000180)='selinux\x00', &(0x7f00000001c0)='posix_acl_accessnodevsystem\x00', &(0x7f0000000200)='posix_acl_accessnodevsystem\x00'], &(0x7f0000000440)=[&(0x7f0000000280)='\x00', &(0x7f00000002c0)='posix_acl_accessnodevsystem\x00', &(0x7f0000000300)='selinux\x00', &(0x7f0000000340)='selinux\x00', &(0x7f0000000380), &(0x7f00000003c0)='posix_acl_accessnodevsystem\x00', &(0x7f0000000400)='selinux\x00'], 0xc00) ioctl$sock_proto_private(r0, 0x89ef, &(0x7f00000000c0)) setsockopt$inet_int(r0, 0x0, 0xcc, &(0x7f0000002000), 0x3c) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='cpuset.memory_pressure\x00', 0x0, 0x0) ioctl$TIOCGWINSZ(r2, 0x5413, &(0x7f0000000480)) 2018/04/13 16:41:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000000c0670100000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:56 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r0, 0x20000003) r1 = syz_open_dev$mice(&(0x7f0000001680)='/dev/input/mice\x00', 0x0, 0x10000) getsockopt$netrom_NETROM_T2(r1, 0x103, 0x2, &(0x7f00000016c0)=0x7fffffff, &(0x7f0000001700)=0x4) r2 = socket$inet6(0xa, 0x6, 0x0) setsockopt$inet6_int(r2, 0x29, 0x42, &(0x7f0000000080)=0x7, 0x4) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x1c) r3 = memfd_create(&(0x7f0000000000)='-\x00', 0x2) r4 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000007, 0x53, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)={r4}) [ 1053.413732] binder: 8365:8366 got transaction with invalid offsets ptr 2018/04/13 16:41:56 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1053.459172] binder: 8365:8366 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:41:56 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xf00000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:56 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1053.513322] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1053.522905] binder: BINDER_SET_CONTEXT_MGR already set [ 1053.548519] binder: 8365:8366 ioctl 40046207 0 returned -16 2018/04/13 16:41:56 executing program 2: r0 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000000)=0x60) fchmod(r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='schedstat\x00') sendfile(r1, r1, &(0x7f0000000400)=0x20020000, 0x9) [ 1053.601340] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000007fffffff00000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:56 executing program 4: r0 = socket(0x10000000000010, 0x3, 0x0) write(r0, &(0x7f0000000000)="240000002e00010000350000000000000000f9ffffffffffffffffff08fffff40401006115", 0x25) syz_extract_tcp_res(&(0x7f0000000080), 0x9, 0xf34) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000140)={{{@in=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000240)=0xe8) r2 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x2, 0x40) ioctl$TIOCNOTTY(r2, 0x5422) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20040000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@ipv4_newroute={0x58, 0x18, 0xf01, 0x70bd2c, 0x25dfdbfe, {0x2, 0x80, 0x10, 0x800, 0xfd, 0x0, 0xc8, 0x7, 0x2000}, [@RTA_FLOW={0x8, 0xb, 0x1f}, @RTA_OIF={0x8, 0x4, r1}, @RTA_SRC={0x8, 0x2, @local={0xac, 0x14, 0x14, 0xaa}}, @RTA_PREFSRC={0x8, 0x7, @multicast2=0xe0000002}, @RTA_ENCAP={0xc, 0x16, @typed={0x8, 0x1d, @u32=0x6}}, @RTA_PRIORITY={0x8, 0x6, 0x4}, @RTA_GATEWAY={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x13}}]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) [ 1053.645274] binder: undelivered TRANSACTION_ERROR: 29201 [ 1053.688151] binder: 8406:8407 got transaction with invalid offsets ptr [ 1053.725630] binder: 8406:8407 transaction failed 29201/-14, size 40-8 line 2991 [ 1053.752385] binder: BINDER_SET_CONTEXT_MGR already set [ 1053.771700] binder: 8406:8407 ioctl 40046207 0 returned -16 [ 1053.793225] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:57 executing program 0: 2018/04/13 16:41:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x7800000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:57 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) r1 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x1, 0x400) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0x3000, &(0x7f0000000100), 0x506954327883bf5c, r0, 0x1}) sendto$inet(r0, &(0x7f0000000140), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x4e23}, 0x10) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd) sendto$inet(r0, &(0x7f00006fd000)="c3", 0x1, 0x51, &(0x7f0000e66000)={0x2, 0x0, @rand_addr}, 0x10) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000080)=0x9) shutdown(r0, 0x2) recvmsg(r0, &(0x7f0000000200)={&(0x7f0000000240)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @local}}}, 0x80, &(0x7f00000000c0)}, 0x10101) 2018/04/13 16:41:57 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4004e20}, 0x1c) connect$inet6(r0, &(0x7f0000012000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000001280)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7c, &(0x7f0000000040), 0x8) 2018/04/13 16:41:57 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000167c00000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:57 executing program 6: 2018/04/13 16:41:57 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1054.570160] binder: 8431:8433 got transaction with invalid offsets ptr 2018/04/13 16:41:57 executing program 6: 2018/04/13 16:41:57 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1054.611390] binder: 8431:8433 transaction failed 29201/-14, size 40-8 line 2991 [ 1054.623111] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:57 executing program 2: 2018/04/13 16:41:57 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000e5b000)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000eb0fb8)={0x1, 0x3, &(0x7f00009ff000)=ANY=[@ANYBLOB="180000000300000000000000000000009500400000000000"], &(0x7f00002bf000)='syzkaller\x00', 0x4, 0xb7, &(0x7f00006ab000)=""/183}, 0x48) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x29, 0x1000000000000005, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f000031aff8)={r0, r1}) [ 1054.658458] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xa000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:57 executing program 6: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000000)=0x80000000, 0x4) listen(r1, 0x0) connect$unix(r0, &(0x7f0000932000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) r2 = accept4(r1, 0x0, &(0x7f0000000040), 0x0) sendmsg$rds(r2, &(0x7f0000003380)={0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1, &(0x7f0000003100)}, 0x0) [ 1054.701597] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1054.724825] binder: 8431:8433 ioctl 40046207 0 returned -16 2018/04/13 16:41:57 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1054.849167] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x8000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:57 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@ipv4_newroute={0x30, 0x18, 0x201, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, [@RTA_ENCAP={0xc, 0x16, @typed={0x8, 0x0, @ipv4=@loopback=0x7f000001}}, @RTA_ENCAP_TYPE={0x8, 0x15, 0x1}]}, 0x30}, 0x1}, 0x0) 2018/04/13 16:41:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:57 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000580)='./cgroup.net\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000040)='./file1\x00', 0x0) r2 = dup3(r1, r0, 0x0) pwritev(r2, &(0x7f0000000b40)=[{&(0x7f0000000100)='\'', 0x1}], 0x1, 0x100000) fcntl$setstatus(r0, 0x4, 0x4000) write$cgroup_subtree(r2, &(0x7f0000000200)=ANY=[@ANYRES16, @ANYRES32, @ANYPTR64], 0xfffffffffffffe87) ftruncate(r2, 0x1ff) write$binfmt_aout(r0, &(0x7f00000005c0), 0x20) lseek(r1, 0x0, 0x3) 2018/04/13 16:41:57 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:57 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:41:57 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:57 executing program 0: r0 = socket$inet6(0xa, 0x2000000802, 0x0) connect$inet6(r0, &(0x7f000000cfe4)={0xa}, 0x1c) sendmmsg(r0, &(0x7f0000008a00)=[{{0x0, 0x0, &(0x7f0000000480), 0x0, &(0x7f0000000500)}}], 0x1, 0x0) [ 1055.000053] netlink: 'syz-executor2': attribute type 21 has an invalid length. [ 1055.004121] binder: 8474:8480 got transaction with invalid offsets ptr 2018/04/13 16:41:57 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x1000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:57 executing program 2: r0 = signalfd(0xffffffffffffffff, &(0x7f0000a0d000), 0x8) r1 = epoll_create(0x5a) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000518ff4)) [ 1055.061374] binder: 8474:8480 transaction failed 29201/-14, size 40-8 line 2991 [ 1055.092425] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1055.116008] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:41:57 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000eb0fb8)={0x1, 0x3, &(0x7f00009ff000)=ANY=[@ANYBLOB="180000000300000000000000000000009500400000000000"], &(0x7f00002bf000)='syzkaller\x00', 0x4, 0xb7, &(0x7f00006ab000)=""/183}, 0x48) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x29, 0x1000000000000005, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f000031aff8)={r0, r1}) 2018/04/13 16:41:57 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:41:57 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:57 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4004e20}, 0x1c) connect$inet6(r0, &(0x7f0000012000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={0x0, 0x2}, 0xa525f62c6215bc33) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040), 0x8) [ 1055.154377] binder: 8474:8480 ioctl 40046207 0 returned -16 [ 1055.162860] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000e5b000)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000eb0fb8)={0x1, 0x3, &(0x7f00009ff000)=ANY=[@ANYBLOB="180000000300000000000000000000009500400000000000"], &(0x7f00002bf000)='syzkaller\x00', 0x4, 0xb7, &(0x7f00006ab000)=""/183}, 0x48) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x29, 0x1000000000000005, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f000031aff8)={r0, r1}) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000080), 0x4) 2018/04/13 16:41:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000000000000ffffffff000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:58 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000feffff0700", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1055.270010] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:58 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x400000000000000, @loopback={0x0, 0x1}}, 0x1c) [ 1055.330637] binder: 8522:8523 got transaction with invalid offsets ptr [ 1055.377760] binder: 8522:8523 transaction failed 29201/-14, size 40-8 line 2991 [ 1055.405151] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1055.417701] binder: BINDER_SET_CONTEXT_MGR already set [ 1055.430204] binder: 8522:8523 ioctl 40046207 0 returned -16 [ 1055.443060] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1055.478432] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:41:59 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:59 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:41:59 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4004e20}, 0x1c) connect$inet6(r0, &(0x7f0000012000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={0x0, 0x2}, 0xa525f62c6215bc33) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7c, &(0x7f0000000040), 0x8) 2018/04/13 16:41:59 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x3f00, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:41:59 executing program 4: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) listen(r0, 0x20000003) r2 = fcntl$dupfd(r1, 0x406, r0) r3 = socket$inet6(0xa, 0x6, 0x0) readv(r2, &(0x7f0000000280)=[{&(0x7f0000000080)=""/186, 0xba}, {&(0x7f0000000140)=""/103, 0x67}, {&(0x7f00000001c0)=""/51, 0x33}, {&(0x7f0000000200)=""/84, 0x54}], 0x4) connect$inet6(r3, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000040)) 2018/04/13 16:41:59 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsn(&(0x7f00000002c0)='/dev/vcs#\x00', 0xffffffffffffffff, 0x0) r2 = getpgid(0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) ppoll(&(0x7f0000000100)=[{r1, 0x8000}, {r0, 0x20}, {r1, 0x40}, {r0, 0xc}, {r1, 0x8000}], 0x5, &(0x7f0000000180)={r3, r4+10000000}, &(0x7f00000001c0)={0x1}, 0x8) perf_event_open(&(0x7f0000000080)={0x7, 0x70, 0x9, 0x739a, 0x3, 0x0, 0x0, 0x6de, 0x1000, 0x1, 0x2, 0x8, 0x100000001, 0x2, 0x9, 0x2, 0xfffffffffffffffd, 0x800, 0x8000, 0x6, 0x200, 0x43fa, 0x100, 0x1ff, 0x1f, 0xfffffffffffffff8, 0x80, 0x7, 0x8, 0x5, 0xd1b, 0x7f, 0x7894, 0x9, 0x80, 0x0, 0x10000, 0x8000, 0x0, 0x6e1, 0x2, @perf_bp={&(0x7f0000000040), 0xd}, 0x1000, 0x7fffffff, 0x4, 0x2, 0x1ff8000000, 0x80, 0x4}, r2, 0x7, r1, 0xb) ioctl$int_in(r1, 0x5452, &(0x7f0000000340)=0x2) close(r1) 2018/04/13 16:41:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:41:59 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000980300", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1056.363072] binder: 8544:8546 got transaction with invalid offsets ptr [ 1056.399800] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:59 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:41:59 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x500, @loopback={0x0, 0x1}}, 0x1c) [ 1056.427224] binder: 8544:8546 transaction failed 29201/-14, size 40-8 line 2991 [ 1056.446240] binder: BINDER_SET_CONTEXT_MGR already set [ 1056.454956] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:59 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1056.492730] binder: 8544:8546 ioctl 40046207 0 returned -16 2018/04/13 16:41:59 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000039800", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:41:59 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:41:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1056.618397] binder: undelivered TRANSACTION_ERROR: 29201 [ 1056.648006] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:41:59 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xc0fe, @loopback={0x0, 0x1}}, 0x1c) [ 1056.676983] binder: 8580:8581 got transaction with invalid offsets ptr [ 1056.720819] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1056.735862] binder: 8580:8581 transaction failed 29201/-14, size 40-8 line 2991 [ 1056.768776] binder: BINDER_SET_CONTEXT_MGR already set [ 1056.814386] binder: 8580:8581 ioctl 40046207 0 returned -16 [ 1056.850796] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:00 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:00 executing program 6: setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:00 executing program 4: r0 = socket$inet(0x2, 0x801, 0x0) r1 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000000c0)=0x14, 0x800) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x1f, r2, 0x1, 0x0, 0x6}, 0x14) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000000080)=0xe315, 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000001000)={0x2}, 0x10) 2018/04/13 16:42:00 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f00003cb000)='/dev/dsp\x00', 0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, &(0x7f0000000000), 0x1) ioctl$int_in(r0, 0x80000080304d65, &(0x7f00008d3ff8)) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000040)={0x4}, 0x4) 2018/04/13 16:42:00 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xe, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:00 executing program 2: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x6, r0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000900)={{0x5, 0x5, 0x7, 0x10000, "0ecb72f84886a96da0f4179fb1fb6c0f7f52d27e605f23e186dfecc8b5addaecc17605c4c0923e2ca7ffafae", 0x9}, 0x9, [0x6, 0x0, 0x7f, 0x2, 0x800, 0x7, 0xd, 0x8, 0x6, 0x7, 0xffffffff, 0x81, 0x2cfc, 0x100000000, 0x1, 0x8, 0x4, 0x7, 0x0, 0x7f, 0x81, 0x37de, 0x3, 0x7, 0x1, 0xffffffff, 0xfffffffffffffff7, 0x7, 0x1, 0x5, 0x7fff, 0x22, 0x3ff, 0x17, 0x9, 0x0, 0xdf, 0x101, 0x7fffffff, 0x14db, 0x3f, 0x0, 0x401, 0x0, 0xffffffffffff9619, 0x8, 0x7, 0x8, 0x4, 0x0, 0x0, 0x9, 0x0, 0x1f, 0x9, 0x3f, 0x5, 0x6, 0x400, 0x8, 0x0, 0x5bd03b4c, 0x2, 0x2, 0xf8, 0x6, 0x8, 0x1ae9, 0x100b03c9, 0x18, 0x7, 0xffffffffffffffc1, 0xfffffffffffff801, 0x20, 0x200, 0x0, 0x6, 0x7, 0x200, 0x6, 0x5, 0x2, 0x401, 0xfff, 0x4, 0x7, 0x3, 0x8, 0x6, 0x80, 0x1, 0x7f, 0x100000001, 0x4, 0x7f, 0x7fffffff, 0x1000, 0x2, 0x9, 0x5, 0x1f, 0x9, 0x8, 0xa45, 0x3, 0xb1, 0x400, 0x3, 0xfffffffffffffffa, 0x8, 0x65b, 0xffffffffffffffff, 0x28a, 0x4, 0x0, 0x3, 0x4, 0x10001, 0xb1, 0x9, 0x8, 0x7, 0x1ff, 0x35, 0x20, 0x13, 0x4e, 0x3ff]}) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@un=@file={0x1, './file0\x00'}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x5f}], 0x1, &(0x7f0000000140)}, 0x0) 2018/04/13 16:42:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000000006cb00000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1057.454616] binder: 8602:8603 got transaction with invalid offsets ptr 2018/04/13 16:42:00 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1057.500454] binder: 8602:8603 transaction failed 29201/-14, size 40-8 line 2991 [ 1057.530671] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:42:00 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) capset(&(0x7f0000594ff8)={0x19980330}, &(0x7f0000244000)) r0 = getpgid(0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000140)=""/233) syz_open_procfs(r0, &(0x7f00000000c0)='net/ptype\x00') sched_setaffinity(r0, 0x8, &(0x7f0000000100)) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) 2018/04/13 16:42:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xfec00000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:00 executing program 6: setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) [ 1057.560221] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:42:00 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x4000, 0x0) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000040)=0x80000003) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x2c8000, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000ae1000)=""/135) 2018/04/13 16:42:00 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1057.615096] binder: 8602:8603 ioctl 40046207 0 returned -16 [ 1057.619153] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:42:00 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(r0, 0x1, 0x2c, &(0x7f00008fc000)=0x8, 0x3) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00004acffc)={0x0, 0x6}, 0x4) r1 = socket(0xb, 0x6, 0x8000000000) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000040)={0x8}, 0x4) setsockopt$packet_buf(r0, 0x107, 0xd, &(0x7f0000000080)="f29f59c8a2dfd72b3ec15f2ba70cf313917d84f3dfd62f3730ba92e028769177164d2dfffffffffffffff94f80a5080e524efa86349cb3beba07acc11a61965c0c447c49ee75b9bf91c1c748463f8a30159ff1ad9d2273d1627d22b0e9e13b39d4b30deac0789db973ca4f9b5d9c967932e0e27dd77f90a17cf6bc8c086741ff207a5d6d3b6d24", 0xfffffffffffffefd) 2018/04/13 16:42:00 executing program 2: r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb) keyctl$unlink(0x9, r0, 0xfffffffffffffffb) pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000100)) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00'}) [ 1057.785216] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:00 executing program 6: setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:00 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000000000000039800", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000200000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:00 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xf000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:00 executing program 4: r0 = open(&(0x7f0000000040)='./file0\x00', 0x80200, 0x20) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000240)={[0x8, 0x8000, 0x145, 0x7fffffff, 0x9, 0x8, 0x8, 0x0, 0x101, 0xff, 0x9, 0x5, 0x8, 0xfffffffffffff1f8, 0x200, 0x7ff], 0x5004, 0x108000}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x2c871, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000200)={0xa, 0x4e20}, 0x18) r2 = fcntl$dupfd(r1, 0x0, r1) sendto$inet6(r2, &(0x7f000035b000)='W', 0x1, 0x8, &(0x7f0000000180)={0xa, 0x4e22, 0xffffffffffffffff, @mcast1={0xff, 0x1, [], 0x1}, 0x401}, 0x1c) ioctl$KDGKBMETA(r2, 0x4b62, &(0x7f00000000c0)) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r3, 0x1, &(0x7f0000000100)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000001200)='0', 0x1}]) 2018/04/13 16:42:00 executing program 0: openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x80, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x5}) r0 = syz_open_dev$vcsa(&(0x7f0000002ff5)='/dev/vcsa#\x00', 0x3, 0x1) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)="f7", 0x1}], 0x1, 0x0) writev(r0, &(0x7f0000000180), 0x100000000000026a) 2018/04/13 16:42:00 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x101902) r1 = memfd_create(&(0x7f0000000000)="000000008c00000000000000000000", 0x2) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, "6df1733d7a8a242fd899e0633f5fcea8fb5a550ed80ebba4d909c7a124d8ac39add13dc93a80f22ff9fd35a844f3e8b5ade4e5935137af6fe251190634435dca", "6aaba7a936009867bd21673a08478220febadc5ca0c0caf1f4833b9ff18a89a285f049691fdaee090426b5018b54096bdaacf1e7a2fb27febc2e8d7b46599493", "ecd2881042e088581e6e599a5591e6c882e32e7ea6697b93d32112b2bc83d72a"}) [ 1057.919403] binder: 8666:8667 got transaction with invalid offsets ptr 2018/04/13 16:42:00 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1057.967708] binder: 8666:8667 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:42:00 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000bfcfee)='/dev/input/event#\x00', 0x0, 0x0) r1 = dup3(r0, r0, 0x80000) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000040)=@assoc_value, &(0x7f00000000c0)=0x8) socketpair$inet_icmp(0x2, 0x2, 0x1, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000080)={r2}) openat$cgroup_ro(r1, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x6) 2018/04/13 16:42:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xa, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:00 executing program 6: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) [ 1058.014046] binder: BINDER_SET_CONTEXT_MGR already set [ 1058.014618] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1058.040787] binder: 8666:8667 ioctl 40046207 0 returned -16 2018/04/13 16:42:00 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1058.087382] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:42:00 executing program 0: socketpair$inet(0x2, 0x2, 0x7fffffff, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$inet(r0, &(0x7f0000000180)="322d05c8569f417485bfb357444cee0eb7263bed9ed22a3729e89aa1893bdbb8942cfaa4f7df8a9d1d4604ab7d3410ed8015da0893ec9092a4a4b2da2902e1eb950a49321cc12f2f097431dee42a56ebd8dd5aa9b1b9e06e35a8b0c4020379", 0x5f, 0x0, &(0x7f0000000040)={0x2, 0x4e23, @rand_addr=0x8}, 0x10) r1 = socket$inet(0x2, 0x3, 0x1) getsockopt$inet_opts(r1, 0x0, 0x483, &(0x7f0000000080)=""/188, &(0x7f0000000140)=0xbc) 2018/04/13 16:42:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x200000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:00 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000000000000000000600", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0xbd8, 0x2) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000080)={0x0, 0x20}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000100)={r2, 0x3f, 0x7}, &(0x7f0000000140)=0x8) sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000b9343a)={0x10}, 0xc, &(0x7f0000b4b000)={&(0x7f0000000e00)=@ipv6_newroute={0x24, 0x18, 0x25, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@RTA_ENCAP={0x8, 0x16, @nested={0x4}}]}, 0x24}, 0x1}, 0x0) [ 1058.161630] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:01 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1058.242133] binder: 8708:8709 got transaction with invalid offsets ptr [ 1058.289553] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1058.290254] binder: 8708:8709 transaction failed 29201/-14, size 40-8 line 2991 [ 1058.311063] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1058.382864] binder: BINDER_SET_CONTEXT_MGR already set [ 1058.394563] binder: 8708:8709 ioctl 40046207 0 returned -16 [ 1058.425570] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:01 executing program 6: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:01 executing program 0: ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000040)=0x0) ioctl$ION_IOC_HEAP_QUERY(0xffffffffffffff9c, 0xc0184908, &(0x7f0000000080)={0x7f, 0x31, 0x1, 0xffffffffffffff9c}) r3 = eventfd2(0x5, 0x80001) kcmp(r0, r1, 0x5, r2, r3) r4 = getpgrp(0x0) r5 = gettid() rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xffffffffffffff7f}, 0x0, 0x8) rt_tgsigqueueinfo(r4, r5, 0x1f, &(0x7f0000b1eff0)={0x0, 0x0, 0x1}) rt_sigtimedwait(&(0x7f00009a4000)={0xffffffffffff0001}, &(0x7f00005d8000), &(0x7f0000645000), 0x8) 2018/04/13 16:42:01 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000432fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000fe0)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r2 = socket$netlink(0x10, 0x3, 0x0) fcntl$lock(r2, 0x6, &(0x7f0000013000)) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) userfaultfd(0x80800) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000000c0)={0x3, r0}) r4 = dup2(r0, r2) ioctl$EVIOCSKEYCODE(r4, 0x40084504, &(0x7f0000000040)=[0x4]) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000002000)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/04/13 16:42:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x10000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:01 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:01 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:01 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = epoll_create1(0x0) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x1000, 0x80001) flock(r1, 0x1) flock(r0, 0x100000006) 2018/04/13 16:42:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000500000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) [ 1058.786389] binder: 8733:8736 got transaction with invalid offsets ptr 2018/04/13 16:42:01 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffea], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x4000000, @loopback={0x0, 0x1}}, 0x1c) [ 1058.836146] binder: 8733:8736 transaction failed 29201/-14, size 40-8 line 2991 [ 1058.882198] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:42:01 executing program 4: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000bbfe8), 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x5}) syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x200, 0x4000) openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x202000, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x1, 0xc0000) r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x4c97c266, 0x400c0) accept$alg(r0, 0x0, 0x0) io_setup(0x0, &(0x7f0000e4b000)) syz_open_dev$dspn(&(0x7f0000000340)='/dev/dsp#\x00', 0xb, 0x4002) getdents(0xffffffffffffffff, &(0x7f0000000380)=""/204, 0xcc) [ 1058.922863] binder: 8733:8736 ioctl 40046207 0 returned -16 [ 1058.932444] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1058.967959] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1059.044592] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:02 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:02 executing program 4: r0 = semget$private(0x0, 0x0, 0x40) semctl$SEM_INFO(r0, 0x5, 0x13, &(0x7f0000000440)=""/222) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000540)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) renameat(0xffffffffffffffff, &(0x7f0000001240)='./file0\x00', r1, &(0x7f00000013c0)='./file0\x00') clone(0x200, &(0x7f0000fbf000), &(0x7f0000744000), &(0x7f0000f8b000), &(0x7f00000d5000)) mknod(&(0x7f0000000580)='./file0\x00', 0x1040, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x100, 0x182) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000380)={0x0, @remote, @loopback}, &(0x7f00000003c0)=0xc) connect$packet(r2, &(0x7f0000000400)={0x11, 0x1b, r3, 0x1, 0x0, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x14) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000340)=[&(0x7f0000000300)='securitynodevem1\x00', &(0x7f0000000100)='\'vmnet1selinuxppp1vboxnet0#bdev\x00', &(0x7f0000000140)='stack\x00', &(0x7f0000000180)='{$\x00', &(0x7f00000001c0)='stack\x00', &(0x7f00000002c0)='stack\x00'], &(0x7f0000000080)) r4 = syz_open_procfs(0x0, &(0x7f00000e0000)='stack\x00') setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f00000000c0)=0x80000000, 0x4) getsockopt$IP_VS_SO_GET_VERSION(r4, 0x0, 0x480, &(0x7f0000000200), &(0x7f0000000240)=0x40) readv(r4, &(0x7f000066dff0)=[{&(0x7f0000001500)=""/178, 0xb2}], 0x100000000000001a) setsockopt$bt_l2cap_L2CAP_LM(r4, 0x6, 0x3, &(0x7f0000000000)=0x5, 0x4) readv(r4, &(0x7f00000012c0), 0x0) open$dir(&(0x7f00003e8ff8)='./file0\x00', 0x26102, 0x0) ioctl$KVM_GET_MSRS(r4, 0xc008ae88, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000000000000000000000000087000000000000000000000000000000000000000000000000"]) 2018/04/13 16:42:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x6000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:02 executing program 6: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000001200000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:02 executing program 0: r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x40000, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x4) syz_mount_image$btrfs(&(0x7f0000000100)='btrfs\x00', &(0x7f0000000140)='./file0\x00', 0x7, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000180)="2c090a8a91c52f5841451ccaa782203ddd72c2322fd8f21e2ef89dadb5575f78b64631202f26e2f7649debc03da5e434", 0x30, 0x80000000}], 0x1000, &(0x7f0000000200)={[{@datacow='datacow', 0x2c}, {@device={'device', 0x3d, './file0'}, 0x2c}, {@subvolrootid={'subvolrootid', 0x3d, [0x32, 0x79, 0x0, 0x32, 0x2d, 0x2d]}, 0x2c}, {@flushoncommit='flushoncommit', 0x2c}, {@ssd_spread='ssd_spread', 0x2c}, {@usebackuproot='usebackuproot', 0x2c}, {@nodiscard='nodiscard', 0x2c}, {@fragment_all='fragment=all', 0x2c}]}) syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x2, 0x7ffd) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000000), 0x8) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000280), &(0x7f00000002c0)=0xc) 2018/04/13 16:42:02 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000000000200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:02 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xffffffffffffff80, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000080)={0x33, @remote={0xac, 0x14, 0x14, 0xbb}, 0x4e24, 0x2, 'fo\x00', 0x20, 0x1, 0x3d}, 0x2c) r2 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r3, &(0x7f0000001480)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1) ioctl$TCSETS(r3, 0x40045431, &(0x7f00003b9fdc)) readv(r3, &(0x7f0000001980)=[{&(0x7f0000001540)=""/218, 0xda}, {&(0x7f0000002000)=""/4096, 0x1000}, {&(0x7f0000003000)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/122, 0x7a}, {&(0x7f0000001840)=""/88, 0x58}, {&(0x7f00000018c0)=""/182, 0xb6}], 0x6) fanotify_init(0x8, 0x8000) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x6}) r4 = syz_open_pts(r3, 0x2) r5 = dup3(r4, r3, 0x80000) write(r3, &(0x7f0000c34fff), 0xffffff0b) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000016c0)='./cgroup/syz0\x00', 0x200002, 0x0) setsockopt$inet6_udp_int(r5, 0x11, 0x1, &(0x7f00000002c0)=0x6, 0x4) preadv(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000000480)=""/21, 0x15}], 0x1, 0x0) fchdir(0xffffffffffffffff) rename(&(0x7f0000000280)='./control\x00', &(0x7f0000000400)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f") recvmsg(r5, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b40)=[{&(0x7f00000014c0)=""/104, 0x68}, {&(0x7f0000001700)=""/147, 0x93}], 0x2, &(0x7f0000000300)=""/23, 0x17}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r5, 0x2, r5) read$eventfd(r5, &(0x7f0000000180), 0x8) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000200)=""/117, 0x75}, {&(0x7f00000000c0)=""/3, 0x3}], 0x2) mkdir(&(0x7f000000e000)='./control\x00', 0x0) r6 = open(&(0x7f0000000000)='./control\x00', 0x0, 0x0) renameat2(r6, &(0x7f0000000040)='./file0\x00', r6, &(0x7f0000000080)='./control\x00', 0x2) r7 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0x40200, 0x0) mknodat(r7, &(0x7f0000001c00)='./control\x00', 0x8, 0x1) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r7, 0x84, 0x79, &(0x7f0000000340)=0xf7, 0x4) fcntl$dupfd(r2, 0x0, r0) 2018/04/13 16:42:02 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1059.675101] binder: 8776:8778 got transaction with invalid offsets ptr 2018/04/13 16:42:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x100000, @loopback={0x0, 0x1}}, 0x1c) [ 1059.725372] binder: 8776:8778 transaction failed 29201/-14, size 40-8 line 2991 [ 1059.774886] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:42:02 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:02 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x80, 0x0) syz_emit_ethernet(0x230, &(0x7f0000007000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="cf2bb43c40b8", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @multicast1=0xe0000001}, @tcp={{0x0, 0x0, 0x42424242, 0x42424242, 0x0, 0x0, 0x5}}}}}}, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x34b000, 0x0) io_setup(0x6e5, &(0x7f00000003c0)=0x0) io_submit(r2, 0x3, &(0x7f0000000380)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x7, 0x20, r1, &(0x7f0000000100)="9815a2e4b393154b8b8c89778819db7bf7771bda4bd94fa9c7e472939f7abf477bbd4c7334192139ee2a1434de134127d74bd2ce903a3b7bc2f71832989e684d708bdab9df30776b63d74194618460aa490507eadf52dcf2ebc6cb9ae2652c05956861f6ea8d78cf5ec8a90bd300acd01c3e56d45635434e99", 0x79, 0x0, 0x0, 0x1, r1}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x8, 0x3f, r0, &(0x7f00000001c0)="47763e9ac3981d4c8349232e2826755299c235a9545847226e3169a33f9aca02a5a3896400ad586d2cabbc9263fdf2556d4efd27a9defa24406ff45be1a46580fec99d0f64036cea66193fadd281d0789a010e5706a6666bfb9079d8ec3b32453695604cacb1dad467fe6afa8ddf3de92189465db255faadefab779f24a7f0", 0x7f, 0x0, 0x0, 0x1, r1}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x3, 0x1, r1, &(0x7f0000000280)="205818f625edf9906f96dad937e28c53e6317a9132a93adf3c988060d16e56a6c4167d0ea384af0fe248e2d77cfea5a88ff3964e595fa42fed68171847a8f30c47aed489c9a3d699d54058c1c7c53b46e330c7e34db795a309beb65067bc50a4f4810237789c41d5108fd77a8263a6408207c35a80c9e412904bae9fb883b78d40a06cc02695f15a554d44b7f12e46020d9f81e6e7afd460c9f1e59c07274fc1eafe52609594dfd59ecf", 0xaa, 0x20, 0x0, 0x1, r1}]) ioctl$KVM_SET_VAPIC_ADDR(r1, 0x4008ae93, &(0x7f0000000040)=0x14000) [ 1059.822775] binder: 8776:8778 ioctl 40046207 0 returned -16 [ 1059.859783] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:42:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x9000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000005000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:02 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:02 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) [ 1059.923087] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1059.953865] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xf00, @loopback={0x0, 0x1}}, 0x1c) [ 1060.006872] binder: 8816:8817 got transaction with invalid offsets ptr [ 1060.040132] binder: 8816:8817 transaction failed 29201/-14, size 40-8 line 2991 [ 1060.101219] binder: BINDER_SET_CONTEXT_MGR already set [ 1060.118805] binder: 8816:8817 ioctl 40046207 0 returned -16 [ 1060.178249] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000fdfdffff00000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:03 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/anycast6\x00') ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000000)) r1 = semget(0x0, 0x0, 0x210) semctl$GETNCNT(r1, 0x2, 0xe, &(0x7f0000000140)=""/172) 2018/04/13 16:42:03 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/autofs\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f0000000400)={0xffff, 0x3, 0x6, 0x99, 0x100000000, 0x3f}) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80000, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000000080)={0x9, 0xffff, 0x200, 0x5, 0x6, 0x1, 0x3, 0x3ff, 0x0}, &(0x7f00000000c0)=0x20) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000180)={r3, 0x7}, &(0x7f00000001c0)=0x8) setsockopt$inet6_int(r2, 0x29, 0x19, &(0x7f0000000240)=0x9, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1d, &(0x7f0000000140)={@remote={0xfe, 0x80, [], 0xbb}, r4}, 0x14) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000100)={0x0, 0x1c9c380}, &(0x7f00000000c0)) perf_event_open(&(0x7f0000536000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvfrom(0xffffffffffffffff, &(0x7f0000000280)=""/191, 0xbf, 0x0, &(0x7f0000000340)=@can={0x1d}, 0x80) r6 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x82) r7 = memfd_create(&(0x7f00000001c0)='gretap0\x00', 0x2) ioctl$LOOP_CHANGE_FD(r7, 0x4c06, r6) pwritev(r7, &(0x7f0000f50f90)=[{&(0x7f0000000040)="aa", 0x1}], 0x1, 0x81006) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/loop-control\x00', 0x800, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f0000000100)={0x8, 0x0, 0x4, 0x2}, &(0x7f0000000140)=0x10) writev(r6, &(0x7f0000000b80)=[{&(0x7f0000000580)="449cbf7e044632c42b2186cff75ef3679914503b3c8d9383463ad45aec25316b89231253d1c8750bc7a91f997dc2c0e96ece15bdca140fb888b4d039ea2922f5e2af1d734510a0c0d5d8d95d0c059a7e7d91a53506b7f2ecff1e39efbc822c38435a1824ced8edc063eed6d9f2957463a62d5dc4a800595b29f653b98154c928063cf92c234e6b427b40cdc1729900063853ee0b57aa146b66bd2f45cde1231d46c21bbfbc4f3b75ab57987aeff6ce1f7042d2bfe5a0dd", 0xb7}], 0x1) dup2(r7, r6) ioctl$int_in(r5, 0x5452, &(0x7f0000d6dff8)) 2018/04/13 16:42:03 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00@\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:03 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:03 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:03 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001580)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000300)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000000)={&(0x7f0000000240)=@ipv6_newaddr={0x40, 0x14, 0x111, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r1}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0x6e4}}, @IFA_ADDRESS={0x14, 0x1, @loopback={0x0, 0x1}}]}, 0x40}, 0x1}, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) ptrace$getregs(0xe, r2, 0x1, &(0x7f00000000c0)=""/132) 2018/04/13 16:42:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x8, @loopback={0x0, 0x1}}, 0x1c) [ 1060.697883] binder: 8848:8850 got transaction with invalid offsets ptr [ 1060.732500] binder: 8848:8850 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:42:03 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xc0ffffff00000000, @loopback={0x0, 0x1}}, 0x1c) [ 1060.790094] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:42:03 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_ifreq(r0, 0x80000089a2, &(0x7f0000000080)={"6272696467653000e7ffffff00", @ifru_names}) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xedea, 0x2000) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000040)=""/33) [ 1060.848890] binder: 8848:8850 ioctl 40046207 0 returned -16 2018/04/13 16:42:03 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:03 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000001cce010000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xb80b0000, @loopback={0x0, 0x1}}, 0x1c) [ 1060.942044] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1060.959623] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:03 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000384ff7)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f000082ef0a)=""/246) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000cf1ffc)=0x600210) pread64(r0, &(0x7f000057c000)=""/226, 0xe2, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000140)={0x8001, 0x0, 0x8, 0x4dbc1b22, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000001c0)=@assoc_id=r1, &(0x7f0000000200)=0x4) write$tun(r0, &(0x7f00000000c0)=ANY=[], 0x0) write$tun(r0, &(0x7f0000000040)={@void, @hdr={0x1, 0x3, 0x1000, 0x4, 0x8000, 0x5}, @x25={0x1, 0x2, 0xff, "66fa31a2b8d03a9c6bbf6bf057799c20aacde228a8086b1360fbb79306f06eca932208a2eaddc5c4ea7437d509ed1292b5fe581d8933579a21f04eefd00ac12fce3ae268ef08a4ad522438fee30df0458af1a3ac5dbcd0d85ce69004e4894cf5a196574d9e654f22fe5818b79dfe63406473d81c2afe6ec2f83842f1d800a7a5b847c87e1d93f0eb859f50407974488ba8fcb7505f5c43c67bfd09a52e1dbaad9dc1b16261564165688bf04fc86c037bc127e6e8f7096bc86d40604a"}}, 0xc9) 2018/04/13 16:42:03 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x47c, 0x0, 0xffffffffffffffff}]}) r3 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xffffffff7fffffff, 0x8000) accept$inet6(r3, &(0x7f0000000040)={0x0, 0x0, 0x0, @loopback}, &(0x7f0000000080)=0x1c) 2018/04/13 16:42:03 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2b, 0x1, 0x0) ppoll(&(0x7f0000000080)=[{r1}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x26) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1061.007918] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1061.018171] binder: 8885:8888 got transaction with invalid offsets ptr [ 1061.053985] binder: 8885:8888 transaction failed 29201/-14, size 40-8 line 2991 [ 1061.125584] binder: BINDER_SET_CONTEXT_MGR already set [ 1061.142485] binder: 8885:8888 ioctl 40046207 0 returned -16 [ 1061.214765] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:04 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:04 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x0, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:04 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000073ab0100", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000000000000001cdd0000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:04 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x2000, 0x40) ioctl$SNDRV_CTL_IOCTL_PVERSION(r3, 0x80045500, &(0x7f0000000280)=""/223) r4 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x8001, 0x0) read$eventfd(r4, &(0x7f0000000040), 0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000180)=ANY=[@ANYBLOB="8f84158f3b"], &(0x7f0000000240)=0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) utimensat(r4, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={{r5, r6/1000+10000}, {0x0, 0x7530}}, 0x100) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000de9000)=[@text32={0x20, &(0x7f0000f59fc6)="0fc75fedc4c3c968fb6c0f9cfbb9040100c00f3266b842008ee80f230064672ec015dec4e245bea5d41e6082f9440f20c03506000000440f22c0", 0x3a}], 0x1, 0x0, &(0x7f0000000180), 0x1ba) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2018/04/13 16:42:04 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) ioprio_set$pid(0x1, r4, 0x9) r5 = dup3(r3, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000200)="0f30f3afbaf80c66b8981d068566efbafc0c66b80d00008066ef660f320f01df650f01ca66b9800000c00f326635000100000f3066b9700900000f3266b9800000c00f326635002000000f30f30f07", 0x4f}], 0x1, 0x0, &(0x7f00000002c0), 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x48d}]}) 2018/04/13 16:42:04 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x400400, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) mmap(&(0x7f0000000000/0xda6000)=nil, 0xda6000, 0x0, 0x64031, 0xffffffffffffffff, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_DEBUGREGS(r3, 0x4080aea2, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r2, 0xc0a85320, &(0x7f00000000c0)={{0x38, 0x9}, 'port0\x00', 0x30, 0x18, 0x146, 0x2c, 0x13, 0x2, 0x4, 0x0, 0x4, 0xfb3a}) 2018/04/13 16:42:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x5000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:04 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1062.016426] binder: 8915:8921 got transaction with invalid offsets ptr [ 1062.054871] binder: 8915:8921 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:42:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x3f000000, @loopback={0x0, 0x1}}, 0x1c) [ 1062.090256] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 lblc [ 1062.111854] binder: BINDER_SET_CONTEXT_MGR already set [ 1062.130535] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:42:04 executing program 2: r0 = socket(0x200000000010, 0x3, 0x0) write(r0, &(0x7f0000000000)="2400000026007f000000000000007701000000ff010000000000001b0000010008d10600", 0x2) [ 1062.151421] binder: 8915:8921 ioctl 40046207 0 returned -16 2018/04/13 16:42:04 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:05 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x0, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) [ 1062.198130] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:42:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00O0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:05 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x2000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:05 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000018000)=0x1, 0x4) bind$inet(r1, &(0x7f0000003ff0)={0x2, 0x0, @multicast2=0xe0000002}, 0x10) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000040)) r2 = socket$inet6_dccp(0xa, 0x6, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000000)=@fragment={0x0, 0x0, 0x67ed, 0x9, 0x0, 0x6, 0x64}, 0x8) sendto$inet(r1, &(0x7f000001d000)="a9", 0x1, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) writev(r0, &(0x7f000051c000)=[{&(0x7f0000000140)="480000001400190d76a81014aed182f30284470080ffe00600000000000000a2bc5603ca0016087f89000000200000000101ff0000000309ff5bffff08c7e5ed5e00000000000000", 0x48}], 0x1) [ 1062.283704] binder: undelivered TRANSACTION_ERROR: 29201 [ 1062.316717] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 lblc [ 1062.353692] binder: 8953:8957 got transaction with invalid offsets ptr [ 1062.402192] binder: 8953:8957 transaction failed 29201/-14, size 40-8 line 2991 [ 1062.431435] binder: BINDER_SET_CONTEXT_MGR already set [ 1062.437231] binder: 8953:8957 ioctl 40046207 0 returned -16 [ 1062.467120] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:06 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) ppoll(&(0x7f0000000040)=[{r0, 0x40}], 0x21f, &(0x7f0000000100), &(0x7f0000000140), 0x8) 2018/04/13 16:42:06 executing program 2: r0 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x200101) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000002c0)={0x0, 0xfff, 0x10}, &(0x7f0000000300)=0xc) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000340)={0x1, 0x1, 0x0, 0x5, r1}, &(0x7f0000000380)=0x10) unshare(0x20000200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)="6e732f6d6e7400c552c5ba9e2c33e308163dd83bbbef1a23efb866ab2c1b66c09db90000000000000006f4d0e9ae0e19c79a35b158ae") setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f00000001c0)=[@in6={0xa, 0x4e20, 0x1000, @ipv4={[], [0xff, 0xff]}, 0x2}], 0x1c) setns(r2, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=0x0, &(0x7f0000000100)=0x4) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000140)=@assoc_value={r3, 0x6}, &(0x7f0000000180)=0x8) clone(0x3002017d, &(0x7f0000000280), &(0x7f0000000440), &(0x7f0000000480), &(0x7f00000003c0)) ioctl$EVIOCSABS0(r2, 0x401845c0, &(0x7f0000000080)={0xffff, 0xa7d, 0x1, 0x0, 0x20, 0x80000000}) getsockname$ipx(r2, &(0x7f0000000200), &(0x7f0000000240)=0x10) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)=0x1) 2018/04/13 16:42:06 executing program 0: r0 = perf_event_open(&(0x7f0000014f88)={0x1, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000454000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x20040, 0x0) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000140)=0x4) clone(0x1000000, &(0x7f0000000200)="64b010c7e28947f69b7b4c6b9fc3ab1a615cd4442d47300158686ff01b820000000000001f00de6617ffeaec8f29a036a48c9ce4e8d94b03518da939ef742d39f8f1d0fbca2a5ffa24383a8f7bc01fddf3e3e1940847c08fb1ce072c79499ffe427df429a8f0c064bff2a480c2ff21b3e7b9f64f4f027d813471ec8f741bb58d60bc5d5a195d4787992c03fa95bda6ed70aa35749b50103a7502518cf56e4d3a6ba527699909661a274262aa30c2b45a47c454f0f4a6d22733c90ad400aa0c1e976a2cc67347633bdc2cf21168a627b1a8436d75fedca4d29cf08d46e986fd8fbf4e135ff162554da5bca446ed88afd8c747f38c17ac491b84f97a1ad3fc", &(0x7f00000001c0), &(0x7f0000000040), &(0x7f0000c12000)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) renameat2(0xffffffffffffffff, &(0x7f00001f4ff8)='./file0\x00', 0xffffffffffffffff, &(0x7f0000aaf000)='./file0\x00', 0x0) ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, &(0x7f0000000180)={0x5, 0x4}) fcntl$getownex(r2, 0x10, &(0x7f0000000080)) madvise(&(0x7f0000b72000/0x1000)=nil, 0x1000, 0x10200000008) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) 2018/04/13 16:42:06 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000000000000020c4900", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xa00, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:06 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x0, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:06 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:06 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1063.426885] binder: 8976:8978 got transaction with invalid offsets ptr [ 1063.460934] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 lblc [ 1063.466603] binder: 8976:8978 transaction failed 29201/-14, size 40-8 line 2991 2018/04/13 16:42:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x10, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:06 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCEXCL(r1, 0x540c) syz_open_pts(r0, 0x0) [ 1063.514694] binder: BINDER_SET_CONTEXT_MGR already set [ 1063.544906] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1063.552213] binder: 8976:8978 ioctl 40046207 0 returned -16 2018/04/13 16:42:06 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x0, 'lblc\x00'}, 0x2c) [ 1063.584325] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:42:06 executing program 4: r0 = socket$inet6(0xa, 0x800000806, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000000)=0x9fd, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e21, 0x7fbfba9c, @remote={0xfe, 0x80, [], 0xbb}, 0x8}, 0x1c) connect$inet6(r0, &(0x7f0000050fe4)={0xa, 0x4e20, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}, 0x1c) 2018/04/13 16:42:06 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:06 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x900000000000000, @loopback={0x0, 0x1}}, 0x1c) [ 1063.699667] binder: undelivered TRANSACTION_ERROR: 29201 [ 1063.788843] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1063.804701] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:42:06 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x9, 0x105f, 0x2}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x7, 0x5, &(0x7f0000000100)=@raw=[@alu={0x7, 0x2e33, 0xb, 0x3, 0xb, 0x50}, @ldst={0x3, 0x1, 0x1, 0x9, 0xf, 0x10, 0x4}, @call={0x85, 0x0, 0x0, 0x23}, @map={0x18, 0x6, 0x1, 0x0, r0}, @alu={0x4, 0x7, 0x6, 0xa, 0x7, 0xfffffff0, 0xfffffffffffffff8}, @exit={0x95}], &(0x7f000031cff6)='syzkaller\x00', 0x5c6e, 0x96, &(0x7f0000000000)=""/251, 0x0, 0x1}, 0x48) prctl$setendian(0x14, 0x6) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000200)=0xc) r1 = fcntl$getown(r0, 0x9) r2 = getpgrp(r1) sched_getattr(r2, &(0x7f0000000180), 0x30, 0x0) 2018/04/13 16:42:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:06 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:06 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x0, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:06 executing program 4: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x1, 0x0) ioctl$TIOCSTI(r0, 0x5412, 0x7) r1 = socket$inet(0x2, 0x800, 0xfffffffffffffffe) getsockopt$inet_mreq(r0, 0x0, 0x24, &(0x7f0000000040)={@rand_addr, @multicast1}, &(0x7f0000000080)=0x8) poll(&(0x7f0000000100)=[{r0, 0x10}, {r1, 0x40}, {r0, 0x4}, {r0, 0x102}, {r0}], 0x5, 0xffff) ioctl$KVM_SET_BOOT_CPU_ID(r0, 0xae78, &(0x7f00000000c0)) 2018/04/13 16:42:06 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0xd, 0xfffffffffffffffa, 0x0, 0x2}, 0x10}, 0x1}, 0x4) 2018/04/13 16:42:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x700000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:06 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000001ab7300", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1063.954238] binder: 9039:9040 got transaction with invalid offsets ptr 2018/04/13 16:42:06 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:06 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f0000fbf000)={{0x80, 0xff}, 'port0\x00'}) open_by_handle_at(r1, &(0x7f00000004c0)={0x103, 0x941, "0a6ecadb26bf7b7069ddf4aaeb75403c57a61f659cf87d56032ad3581afdc17780536e27b1f85539b14de9045275052975de4f932057645b7852526ee157b53f6c42b93bdc3b9718da01d465ba1fa5a987bb1f3910cb823555a42f6f7beeedb8bd5c4785c790bcab439e7d39fbec48c4e08bb7a9861e3d3695bb28113c39eeff9f13d58c77c0bdbe564528e94739cb168b5346b1faed78a85e7e9b5b9d30e64b6fed46cfe0c507562befa088a19b1010b320f7c6eba43f7d87e190862b38c737abca1c0af069a5961c4e5cc3f24e554d200b037ed7abf6abe277e46788ed0363a75f31994af9dda62d003b3bbb3098fe7df370b6d88541a31a7b37"}, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x20000, 0x0) sendmsg$netrom(r2, &(0x7f0000000480)={&(0x7f0000000140)=@ax25={0x3, {"1c2148d4fab06e"}, 0x24000000}, 0x10, &(0x7f0000000240)=[{&(0x7f00000001c0)="b992d044a64879dd8c6dca16037f128738bc12ab55396a1b2b65dcfed081e1bb62036db00c23e388351f08762fbc4c99c7ff7a56a2358492fd219e4dfcf768e1c9d03760b4461ddca7cbc3e7b995a3175d0f8c5d46174a", 0x57}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="30000000000000001301000000040000bcead721c4df44e8df6b109e270188632ce34b4a1f6261b8f27c39e2e1ff5e6a"], 0x30, 0x800}, 0x84) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl(r3, 0x227e, &(0x7f000040c000)) [ 1064.004548] binder: 9039:9040 transaction failed 29201/-14, size 40-8 line 2991 [ 1064.042808] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:42:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xff00000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:06 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='pids.max\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000280)={[0x36]}, 0x1) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x80240, 0x0) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f00000000c0)={0xf001, 0x4000, 0x1, 0x7, 0x3}) ioctl$KVM_GET_LAPIC(r2, 0x8400ae8e, &(0x7f0000000340)={"e73e38bda23e178be7a57c2a516bd0bfe6335a6b079fcbfdfe8f1326d66476079c58931534ee3e9d7d6a7aac01c2fbb625e157ba35a07744a50ddcfd062ff31d843ee0be1c300b50963d095d532879d25c16d3ddf8028d660eda42750a7d505bfb5ee1a54e5c2bfc57d2052c1fed2830735bab555528c5aec06281adac9e1593da9a7a67531206724f9977981e0c714e9f60223348e6f55546adfd2a33ca8e5102dc02500cd69fefcdae466e05a077696ed2d829ff97bbc5d17259dcd602ff5a56e91ecc72b2afaa5d29663d193df726a7de1013d82d21e7ff0d2b9f2fd6b55b6dd51126558b108da3b43327ba692df319bb4d492fdc2cb4190dab3921d828c34bacfc2b3a3de2e33ea46d9b5b8001bd08f274dfc5d6687f474cc34ef79c43b9bc0b370d012f6bd1749522738b21277f71c6765b4ea3f7414a41ce0506b12f5f561c8652b93a614f43264fcface16cf966ccb3e5deb747b503952f7a08dad41cb107fe95b5121f8871ecf0183943127b76c7f3d1a26fe56cce13136468e36f89c62e6f98e5dfd7833cbbea2e6b5935c4ff7d011d16e74ae9614f0559bd35bdf9775cdc0729e37a2c9a13a9e4bc37f291849de2d6e2dc2a775f3c2846268cdf5e797317c77aab06905110d1bc86c4b52f3bb4d616aba29f9ef133931967a38867543454d0d46468f9e47f34d79616abcbe9767eace91847562dea082b5cb56101ef9ee748136767b587f855eeea68cf207fc1d2091e40541ec1cce5e34b8f9bc821d2ae1d0732bba2aee53a28165f62680058f3e8daf9b50a1bf874e6d549d4597af67256e1cd8acf1ba4e210f7776186b0863ccc845cccbe0b1f81dcc4ad4954389f8a5624f6432e5b7fbf80e5d999ba4f0c73053581101d178512c77caf4bafd40add27c0e00c63d749c015266499956a1ee9a4385d237c9018b8f05d5e76b903df3b1d4d2238e1266bac598136071a104a3ad40ab7498907dd88b3620d93edf0654231320dd88149656848344fbd52ba25c96cf0405ac7f2d2bd7d5b9c578fc9b61c2928b214ef3868cbb226d8f128c777679cb7cab9afa6e2a968a12567ada7ecc78b828807150573590eccd31fd0d3c7c8e7dfcf2c3927e0d52cf0e9c326099d8d45bbcdebb2482809ff2042b543a731e5864a2819bbafd9846affcbbbcf3e117f4873ea8659be4f202e4f033ced14c73fa1320d82a4dcc7de03e9203aac33adb2770a673f0b6378bbdd5dc66b5146ac7f502d8d758a7a1ecdb61d299256c587197535a05284b339f89ee8a42fbc764a652bcbb82257a4a54fc6c756c4f0b1f171a2de99ad67a3dfe765d1ca57dd86b6c51ad594d73b7655e5b5345652b9220ee0f0e7293fbb75f7f5c2f7758909b5e437e5a0187aa7945dc9d12ba4d8838129bdae4cc7c39682dd0129d69161560dcad33210739b763f3ec288e7e3d268"}) sendfile(r1, r1, &(0x7f0000000040), 0x1) [ 1064.099323] binder: 9039:9040 ioctl 40046207 0 returned -16 2018/04/13 16:42:06 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1064.140067] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:42:06 executing program 4: r0 = socket(0x10, 0x803, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) write(r0, &(0x7f00002aefd3)="2600000022004701050007208980ff0600cc00002b1f00c0e9ff094a51f101000000000f584d", 0x26) 2018/04/13 16:42:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:07 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x7, 0x2) setsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet6_int(r0, 0x29, 0x4c, &(0x7f0000d0fffc)=0x200004000000804, 0x4) 2018/04/13 16:42:07 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x0, 'lblc\x00'}, 0x2c) [ 1064.217669] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1064.225729] binder: undelivered TRANSACTION_ERROR: 29201 [ 1064.256867] binder: 9071:9073 got transaction with invalid offsets ptr [ 1064.265925] cgroup: fork rejected by pids controller in /syz0 [ 1064.312582] binder: 9071:9073 transaction failed 29201/-14, size 40-8 line 2991 [ 1064.360571] binder: BINDER_SET_CONTEXT_MGR already set [ 1064.387647] binder: 9071:9073 ioctl 40046207 0 returned -16 2018/04/13 16:42:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xa00000000000000, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:07 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:07 executing program 4: r0 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x2) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x1411}) io_setup(0x4, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000016c0)=[&(0x7f0000001380)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000080)}]) 2018/04/13 16:42:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000000e0690100000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:07 executing program 6 (fault-call:1 fault-nth:0): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:07 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f757465000000490c0200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:07 executing program 0: r0 = socket$inet6(0xa, 0xfffffffffffffffd, 0x2) bind$inet6(r0, &(0x7f00004c0000)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) stat(&(0x7f00000003c0)='./control\x00', &(0x7f0000000480)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f0000000640)=0xc) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000500)={{0xa, 0x4e23, 0x4, @local={0xfe, 0x80, [], 0xaa}, 0x9}, {0xa, 0x4e20, 0x8, @mcast2={0xff, 0x2, [], 0x1}, 0x4e}, 0x0, [0x1000, 0x9, 0x5, 0x800, 0x4, 0x9, 0x2, 0xe51a]}, 0x5c) r2 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$adsp(&(0x7f0000000300)='/dev/adsp#\x00', 0x0, 0x2c0180) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000040)={0x6, r2}) r4 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f0000000400)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000001c0)='asymmetric\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a}, &(0x7f0000000240)='K', 0x1, r4) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0x0) clock_settime(0x0, &(0x7f0000001440)={0x77359400}) r5 = semget$private(0x0, 0x3, 0x11) semctl$GETALL(r5, 0x0, 0xd, &(0x7f0000000780)=""/245) mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r6 = open(&(0x7f0000000040)='./control\x00', 0x0, 0x0) sched_setscheduler(r1, 0x0, &(0x7f0000000100)=0x3) mkdirat(r6, &(0x7f0000044ff6)='./control\x00', 0x0) r7 = fanotify_init(0x0, 0x0) fanotify_mark(r7, 0x11, 0x40000002, r6, &(0x7f0000000000)='./control\x00') r8 = open(&(0x7f00000002c0)='./bus\x00', 0x84, 0x0) close(r7) listen(r8, 0x3) r9 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) sendto$inet6(r9, &(0x7f000087dffe)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) splice(r7, &(0x7f0000000080), r6, &(0x7f00000000c0), 0xff, 0x8004) close(0xffffffffffffffff) shmget(0x2, 0x3000, 0x340, &(0x7f0000ffb000/0x3000)=nil) 2018/04/13 16:42:07 executing program 2: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x8, 0x10800) ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000040)=""/82) mprotect(&(0x7f0000032000/0x3000)=nil, 0x3000, 0x0) setitimer(0x0, &(0x7f0000032fe0)={{}, {0x0, 0x2710}}, 0x0) [ 1064.434761] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:07 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:07 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r2, r1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000005c0)=[@text64={0x40, &(0x7f0000000640)="653aba1f00000066450ff37a00b9900900000f32420f07c744240076000000c7442402180d0000ff1c24b9800000c00f3235008000000f30c4e235ba618266baf80cb8bc6e4283ef66bafc0cb856cbc4fdef0f01d62e42de8a00000000"}], 0xaaaaaaaaaaaaac0, 0x0, &(0x7f0000000600), 0x100000000000024d) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000002c0002000091040000000000000000630000000088c9632b276522c6b07ad308d1806e3f894954c870576f5ab52c5b8de9de5d188e41ce986393fbe163f3befcab59094cb3b8009deba8d6928666cbf3794597bbeb9023f0fd88ebb164568ecd976dc19d8d4f2e863be94aaeee9515dd832fe389a94b05399ec2b7b9b3c94f57e021bfa6ba7adee2e6561670a98a5ff748cf2831cee8afd51524a01d0215e07c483c321b47cd95ea280694fb99e15f41e54f2979d57711257602beadb31fa78d329d6d19d713bdcc85f88b8c707f37e7e33f388e3a0ef986d4b9ebaba4e31e32af871b1daf4a7b3d38734d44df"]) [ 1064.486161] binder: 9102:9104 got transaction with invalid offsets ptr [ 1064.491887] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1064.501077] binder: 9102:9104 transaction failed 29201/-14, size 40-8 line 2991 [ 1064.534426] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:42:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x11000000, @loopback={0x0, 0x1}}, 0x1c) [ 1064.561735] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1064.575081] binder: 9102:9104 ioctl 40046207 0 returned -16 2018/04/13 16:42:07 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:07 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xfc00, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000300000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:07 executing program 4: mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0xfffffffffffffffc, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x5, 0x1) sendmsg$key(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001040)={0x2, 0x16, 0x4, 0x9, 0x46, 0x0, 0x70bd2b, 0x25dfdbfe, [@sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e20, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e20, @multicast1=0xe0000001}}, @sadb_ident={0x2, 0x0, 0x695d, 0x0, 0x21fb833b}, @sadb_key={0x7, 0x9, 0x158, 0x0, "236ccdeac880d57b6200a44594f84db2681fb3424236f6da7b52663e2cde33f1c8afa04a079111c3c9f7b2"}, @sadb_ident={0x2, 0xb, 0x4, 0x0, 0xc0}, @sadb_x_sec_ctx={0x1f, 0x18, 0x100000000, 0x1000, 0xee, "9490563d00273311be73b57d98f9fd9e64fe677832ca38f437a369cb09ef504d25cfe44fee78b54d6ebc863895f2166c8d675d924dfd97e0a0dc946b3c76484e8a10455704b2e8ac00d6ba1bb8eac82756fafd4ec8f210c6841e5b7b158a28ec43deae9bf40ee8e920ff80f226246035ad96b48443c7d78f32146c1e72662e67658785017c06e821aea8fcd5543c5a5673d21210a0b01582de1e32b8e19740ffaa48896114b8951be5a086bed827e6a254294fc8242dd86655c7d431d2f91f1cf2527a517b51250d7eebf4e7efea3072dd93798e1ed91a6f3cfd51c0c19094a4ae0ccee29a425b14f24b443cb86c"}, @sadb_ident={0x2, 0xb, 0x2400000000000, 0x0, 0x8}, @sadb_x_kmaddress={0x8, 0x19, 0x0, @in6={0xa, 0x4e24, 0x3, @local={0xfe, 0x80, [], 0xaa}, 0x3}, @in6={0xa, 0x4e23, 0xffffffffffff8000, @loopback={0x0, 0x1}, 0x7}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e24, @loopback=0x7f000001}, @in6={0xa, 0x4e20, 0x1, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, 0x1}}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e20}, @sadb_address={0x3, 0x6, 0x3c, 0x20, 0x0, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1a}}}]}, 0x230}, 0x1}, 0x20000000) r1 = socket$key(0xf, 0x3, 0x2) write(r1, &(0x7f00000000c0)="f73bf99aaac609c43ad68f20be476489567f8f0398554f585bdb56e9d836c6c17eb36cb544cc53d449814bf86e991eb3fc6aabfb3d971409f9bf98799f7a0fc4d25e1b763f88da3b9c7787cad61211bfa9e9a1c7a83e48888edc3333719e42e95704f99cc91a942c4142d10c57ab0ebce2398db21e693a20d751b678d5b46850f8144296c12be366ecff9ae3a73aba874a0b702ff2730fcfce4151ee0517cd7f405b43debda319d27179a32892b8707123ef2cfcad087037ddac93b2a914fb11d358c7aa7f741501cb18c9a8e2025798f8b681bc06ce660aec503f81485ecd7f4057f43f33e298889db1df58fc1f0231fa738fb88815fcdf9a06ea3be4540610740f2032dda5429cbc0ca38521b2ac92b5acff62910fad071ad380b4ccd198681e2c3707dd74f9ae07b7aac231db279a30005fab916df20ffdf43425a39057bcd7f4cc0200ee314f0bb1ff9c772bfa1dc2357c164b58ae78801b9410a790d990a54aee8b4e6268f1a642407bdf7bca700d453f40add12388e05094182e466dddb8c8e269a708765c9dc8bae31ab1c8341328c8927ec8563088dd169ce4d9388d50f737b3a8b7a5532c18d3b39bfc7aa873b1df6feb632d7bb35d178f59f973f1ae39accaaccf10e77cbc1c47950b543af3ec50d1a49c0e131a7a4eebd76dd1e4c24214db26339f6b0bcd76882895bc0b345f31359c024cb5fcc2f97f6f130479e1017da06c31534c03f958c3db2897e795f01e9f53967735784fc818a84b07163391cc99fd3dd5cccb39e64ae97a9cb237e015859634f820a90d07732f8789ae9c05ac7ffa739bf83f5532ad4887ea31c902dc4d9878c17f9a880e27023352f158bbcf26dc541de84e0f3b52580c1a2f0f354e86e09ebbc4cdfd2c18b2a63d48237afb840d01a66d092b4902b14cf9694763c31f00bb12701b3641595e29769b932f9e081a5904f2a70fa7edaef699e277f2bedff1f040342f5f4c4452dde5d1ac6d4ea88a80906ebe846a6f3a67b5562b3cecca34e6f0e7383234f1fcfd5b4d4e358211fd8702fa13b45ef62691f51bf03272064f36026dac5cbb7ca0f615fc67783defd9b6d4be2fa0eb8b38df8427690efe2ba9dc6931f996ab02d7d73a6b405d9a9e146998434e42f8aa1affe4ffccb54dd3686448c21c0aba2ea9b6f9dd092b1f49672ebd95d28865039232b884212cbe3495f75236fe299116024e985e41ea34b9f2db147d8c3d0d30d9aec5089e581d6136895b38bccfc40824f174385c463c2cfbd94dc27b77c05ef3d9416d4982258cf2ff10a3613e50ec930908d15e1465c40e310b1d211bd2b884584738d00f45e961c9d2850e3b204f7d88863e2c657d0d425ae2e6776fdb2bc01d4df317ecadfb7aad0871bf529d98b5a8446d1e0da593d3ab428eb0f2164fa3c5326f7617c701da53b78bd8295042cf5e1f451227e51abef5892f86801056781b9f88ae46e829530631881b472f4485abd1326115d8aafab9c4e5ee16de410d2c112d57902e3e3a227cb2bd9d2dcf18ebe3a642e191730607cf538f9393e3c465c12d3d3b61bc4bb4e3ba58cb07d51797ac9a859fcd2a65e944552f57ed6c3f99362d4e5f8988506a118ccd5456b67be0c5f9996af11a9e0b562771a219ad82c1a3ab1872ccd260f3faf6d082eaefe57c87dd73f5011fff8ef74ff993eb99747d3ad2d43a62fe3cd0b1a5a53042d5ecd749a0f3a036213e7fb220954a8e785b97b796737aec5eacfd1eafe3a4888dd1fd66706d1271bafc211b119d08554ee5af128cd1e22da54fe51b5ec4f24c74791a60c59e141fe25bdf465f9b8017ff3969409737d107d70bfe2ab98fd2c562345eed4bf6fcef72a9e374ef0c86b66aab3a02fc6e4ee00c90eba0fd182308da3e697a6062daa22bc63d1d8f671c9354610d06d3d9b4e8e1a909757cb04a1033d9d96228a67b2a3a732072135a435640b59bbf15a883ca7607cf1a3decdb59c4447904768ae9fe9ef1e9ad5fcfc6fe71b55fe092afe73e5a7ee6ce73312cd1c3637b9fadd738bb33001e89cc7f35867d229e00a90a3129961752c4f5798aa9ede70cdc7cbd08f455d9514d3de3b3601b84b2dfe8f810016dab9ab76ef05952b369d0d014ddb0a6e737f9c09926a3027b66126baff3929f64b90dc57c50eef5e957ee8170a137a73cd65a023d7997abd1ccc05231d5e4fe81ab2d64549bbbcf9587c0a86dfcb5de4931ede5a2296afe858081520438a3f86920b1553442a91e6c12f0a8210a13e1b3b7d37951ef2e72aca071d9f0772adc7c7f7ec8f5b9b75f63b2815319fbbfcfa6d73338fbfcc0a1894f7962106f8ea57d40a5a88e5a8987dbeb87cd202b802dc530ccb40954ca1c67f155a65c06b92839c06e9c6afdfc96175c99062373405a45614d3a5d07c510952825a9dce838f506e8e4d8e197870b9d14ce388648d75c8f805ba8f44d66f7e9871d3a2bdb479144bfeade1b913969dbfc49ab7953ea2ba07801c128100a06d4740d7ce886a98207da32f0901c1193e7f8eef0dea5f4b29ff2b05cbe103c87696692c155ab0335e30c88ffa86dbb6c97a8166045d10b053d005d4ef99e29342b2d3f561ce7e9138b474f9cc946b1f7cf83e6f2bf17aa5df58b3bc3f23c98f8041b257c790338b83099d2313d433ba3ebc600377805970c375bc5dd6375d1b798cdf3188aea0296daa501ecc7cec223d5e83cc4580d5e004e61b594b51410f43316ee843c6e0b8dbeb0d1c9cd2c5ca55bd06bb60936a8e5ee76ddfe03869050f724636ddfd75c22044ed6caeaa817f9e96f8a4d4f57127368275bf73225eec7c139d3e4e109124e635e9a9994cfa62a3b628b94c414dae5832e6c4aade290aa1f3bdddb5a609144a9864675f355e1cd6a5013ba532041dd832563fe6fc6a38eb685f897fa10ce8bc9f2b7a6d548ba296e76430e7e5e9f580f355ac5e25bcdd7f04988fe5956d379b1d7b7cb3e52f0dd9dfbfd5334cc8ed04b8407e9c36c482c5ee2ee96e552b60e170250b714e0328150f29c961db1aa748f8a9c0faad4ee0d6fac18310c5c0318b865c01a791e45663e5875601540c94bc7c78aa31532cc48a4563a40fdfc05c82100b6e9d75f337c0723bf0f8e4f50bf44912922b9fb9e0945ccaa5b2d331325646d3fd3b8bbe5f40378777d689ea602f93787d2c7ab49a04862d19bbcddfc90b40dd0e951bcadc9b34807f4106237d77e2f13a4ed5fec0e1c9009e79a7e3d14a5f1cad647aa78a807b941004f9bbbd6a6f7c1a47cb96577f58ff9f0a28c1648c668fe4595f6d241a385be7edfd26c5e0b259aabf43b3fa3b08cb06eeac5efe417fa1476571cc5a8d33af50152438173f2b399e0dc4859c552ab78e5d9de4f95ab7d749806d40030244cd3cc3bda055500c85f0ec750679ce8e3b4f24121e68e80188a447c654185b5860d5e031862411815b3bab8a35271937daf9248fe535492176453e9c6299bcb8a49fa57a759fa535cc4a8266f5837982ca03912c708805917c26665f49f8acf46042261c4404b812a4aa24989727ec2f79002686a3580a7fa234ea089cf1e8884272aa81bde4bf269a285fd62b0e0e0a1cd43621beff5874ff8e0d04a0448de8747121e43632c8a83efce5dd8fb70cc6b2621d8abbebf257cc2ab4c93b24fe680dd4947b5007e6f2160316a84be937a776a9f88f220d0bda6be2f7a9a667a053c207583c5aa72128345c258e8c7e5e3b1165062e3882bfa39288d35be16c3156565cc061bbbd3bb0f7be45eaa62b7b51de4cddd0a66cf47b76f3457827ad6122bf23250e07af6c4dadd6da04a3c32cf3d8567b5d6911319d0e1f20ca980f06c90d1e35ed6ce9fd89a0027c032f3887eba202f4d0eb571fda314d98959f0a92a35c2beeabd3c980bf5276d3b53010e37e777107e64ddf8b04144c4c18eefb0d63757a64331b6fd48329e39816cd27375c3c52526ade3ff4ca9537ae531dfb7039fb05b92b3db3487b171b2dc6e534a1589e374463268c799ca56a78943cdfee844e88ec07eadb7f7ac4f89579634fab2b71b99264445b48c3f0ab1ed174d71dc816b7a02bfca9e00d04aac8e67a9820b0e24bbf3c0d95063dd5a8c6cd190ce9e25b165ec1dba2e23bbdda4469b350c530f5608581c63813bb95411db31eb063c749cc39f496872f4e263637097252a62c399ddf73fc591f0d851358a65f2106cc43fd7aa364983c7b2b0be3b666fd29ce575aac2ae6c791c4d3207fcc16218d551875b095264b6395cb1dc29f0f5d88cde2703dfd04cbcb09639a3d37cd9b79545467b29e1a6f60e64fbfd6714ff822e86c9a0a497854914ad868800aa089efebfbe1ccd7fa8365c11517ae93d6977e4a3d8c3239b33344b4918d7a67bf9229119ab4439867de9f2e46ca030fbc18ff5794751f9f5ff55b21bfbef1227b4bd7edae1c4b40590381e2fc508149ef72e12a9c5ce96f2b552edf9b11bf693af880a522042fe56ec64d353abb86568415d3ac4468910aadde0abe5672938f8ea1b8c30589ebd599bd3a29beabf9599c4667da61325b6c0192519b211defed7112a6783381ca3a2b2d715369ba91e514bd6c18215a2bb336244bcef3fe67c512a853802b17cc57d812788983291b15e781836b91f64656f21ac6ea891095ea3c607037f1177e459c711978e04daee10aea9f51aacfb51baf5bfc6f05708a7e7056c12ff6a287772365ee415d446baf33387581eee0b2b83f1a5d970eadad3d9e694aca661c2815f343f2973b7532aa88a310a09292aa9177f2e2b36a82e2e20ac98c74d1f8a82b0f2488851547c5ce59a2a8143ff07719805dce172a9aa39f356fbcec305588171263c035eab8d8a49dec511eec76774671e862e2afb34fb32662aa123530708be61d48cfa6ebfc06df29dd3a8ca7fe2030d2812ad4dd8d6e30aa1e8e92016e4805e19f6635ea045a75a1d398b3e2cdd7df316b570c3077aae20e9fc73e801c0766186ff9a948681b25d7e948e0a0a9829ffbce0ddaa0dc29d65b48cd27dbeadcee2168ed10c01a083ce29ca9d5d09b7a9ebb8e9e8c48e40e0201b6e35f257329b3ebc7176af926f16b9a15188aa2cd6e3ec53ac171cd1081d0b08d8df7af75e8f392b028b4c13cbc8b27373d4a94193cd1ce5d663168ad0046020765184530b4f0d8e9227330f432ea2da1f90eec42108f907f50ed95427648398ea3f60cc871ace61ed33ed92e8a26a3a9ea68628f3b5a672851b355209836c6fdebc3301edf250106a9bca2c30bdc15ca4e9744dfd071414ef88ea81e6742a7177b56c7f84733c2c57d8b56177ce121d4badb7b60899d34b12a77f5533f52f64705ace3d83cae1c66a6028286fbc0c5aae43fdf9ab9e560d6c67c4cd7e6cceeaaeed2dc86334fca258cb9c3fa78703e25ba0f8337fc7f3fbc9a0b00ad9b2ae35ac03ba00ab6a8100ee8592e2df8bb7e29e83d7ad8a95dffbacb15c2be4999bf2a4030470aa570a75ecdea8cd30803542c1f743e0677f3ca8d49394aab791d0b6f3844b8e9a5b", 0xf41) 2018/04/13 16:42:07 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000200", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) [ 1064.708765] binder: undelivered TRANSACTION_ERROR: 29201 [ 1064.794894] binder: 9134:9135 got transaction with invalid offsets ptr [ 1064.845225] binder: 9134:9135 transaction failed 29201/-14, size 40-8 line 2991 [ 1064.867689] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1064.883522] binder: BINDER_SET_CONTEXT_MGR already set [ 1064.890852] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1064.912475] binder: 9134:9135 ioctl 40046207 0 returned -16 2018/04/13 16:42:07 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00004c6f8b)='mounts\x00') mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f0000000580)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1006, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000640)={{{@in=@multicast2, @in=@loopback}}, {{@in6=@dev}, 0x0, @in6=@dev}}, &(0x7f00000003c0)=0xe8) mount(&(0x7f0000000200)='.', &(0x7f0000000500)='./file0\x00', &(0x7f0000000600)="5a6500000b609ab4000000", 0x5010, &(0x7f0000000980)) mount(&(0x7f0000000140)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f00000002c0)='ramfs\x00', 0x0, &(0x7f0000000380)) renameat(r0, &(0x7f0000000180)='./file0\x00', r0, &(0x7f00000001c0)='./file0\x00') mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f0000000980)) ioctl$KVM_S390_VCPU_FAULT(r0, 0x4008ae52, &(0x7f0000000380)=0x5) preadv(r0, &(0x7f00000023c0)=[{&(0x7f00000012c0)=""/4096, 0x1000}], 0x1, 0x0) 2018/04/13 16:42:07 executing program 2: open(&(0x7f0000000040)='./file0/file0\x00', 0x204000, 0xe0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000300)={0x0}, 0x800) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000000cc0)=[&(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000bc0)}]) link(&(0x7f0000f3bff8)='./file0\x00', &(0x7f0000000100)='./control/file0\x00') 2018/04/13 16:42:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xe00, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:07 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r1, 0x10000) sendto$inet6(r0, &(0x7f0000000040)="12", 0x1, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x1c) shutdown(r1, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x479, 0x0) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f00000000c0)=0x5) 2018/04/13 16:42:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000cc06000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:07 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:07 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:07 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x8f04000000000000, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) [ 1064.944477] IPVS: stopping backup sync thread 4669 ... [ 1064.969640] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:07 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1065.030202] binder: 9158:9160 got transaction with invalid offsets ptr 2018/04/13 16:42:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x40000000, @loopback={0x0, 0x1}}, 0x1c) [ 1065.081201] binder: 9158:9160 transaction failed 29201/-14, size 40-8 line 2991 [ 1065.098742] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1065.119304] device bridge_slave_1 left promiscuous mode 2018/04/13 16:42:07 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/hwrng\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, &(0x7f0000000100), 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000140)={[0x1, 0x0, 0x2000], 0x5922, 0x1, 0x9}) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000240)={[0x10000, 0x112000, 0x2000, 0x5004], 0x4, 0x62}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = request_key(&(0x7f0000000200)='encrypted\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000300)='/dev/hwrng\x00', 0xfffffffffffffffc) r6 = request_key(&(0x7f0000000400)='big_key\x00', &(0x7f0000000440)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000480)='/dev/kvm\x00', 0xfffffffffffffffa) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000500)={0x20000004}) keyctl$search(0xa, r5, &(0x7f0000000340)='.request_key_auth\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x0}, r6) tee(r1, r4, 0x1, 0x1) getsockname$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, @multicast1}, &(0x7f0000000100)=0x10) openat$dsp(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/dsp\x00', 0x1, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 1065.126179] bridge0: port 2(bridge_slave_1) entered disabled state [ 1065.138230] binder: BINDER_SET_CONTEXT_MGR already set [ 1065.156484] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1065.184374] binder: 9158:9160 ioctl 40046207 0 returned -16 [ 1065.228120] device bridge_slave_0 left promiscuous mode [ 1065.233708] bridge0: port 1(bridge_slave_0) entered disabled state [ 1065.280666] binder: undelivered TRANSACTION_ERROR: 29201 [ 1065.297900] IPVS: ftp: loaded support on port[0] = 21 [ 1065.369873] team0 (unregistering): Port device team_slave_1 removed [ 1065.399633] team0 (unregistering): Port device team_slave_0 removed [ 1065.435067] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 1065.459383] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 1065.512763] bond0 (unregistering): Released all slaves [ 1065.906370] bridge0: port 1(bridge_slave_0) entered blocking state [ 1065.912766] bridge0: port 1(bridge_slave_0) entered disabled state [ 1065.919962] device bridge_slave_0 entered promiscuous mode [ 1065.945187] bridge0: port 2(bridge_slave_1) entered blocking state [ 1065.951580] bridge0: port 2(bridge_slave_1) entered disabled state [ 1065.958704] device bridge_slave_1 entered promiscuous mode [ 1065.983139] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 1066.008813] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 1066.078296] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 1066.105397] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 1066.213100] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 1066.220424] team0: Port device team_slave_0 added [ 1066.245161] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 1066.252423] team0: Port device team_slave_1 added [ 1066.278116] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1066.305710] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1066.331899] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1066.358866] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1066.587981] bridge0: port 2(bridge_slave_1) entered blocking state [ 1066.594388] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1066.601052] bridge0: port 1(bridge_slave_0) entered blocking state [ 1066.607774] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1067.419338] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1067.501087] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 1067.579736] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 1067.585921] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1067.593635] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1067.668233] 8021q: adding VLAN 0 to HW filter on device team0 2018/04/13 16:42:10 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:10 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x8800, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:10 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000940)={0x1, 0xde}, 0x8) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}, 0x0, 0x6, 0x0, "37b5e9ef253b4a17814c1b38c9b81a56a397da8bcdabdd0e9383bcf622da24ecb5f4ff8b353a40eb8032a5b64a6fe5073a334eeb3b30a354760cc0b9d14f3363180e01222db4b130ca85a373740d1e60"}, 0xd8) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00004b5ff0)={0x1, &(0x7f0000acbff8)=[{0x6, 0x0, 0x0, 0x6}]}, 0x10) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000009c0)) syz_genetlink_get_family_id$fou(&(0x7f0000000980)='fou\x00') sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10}, 0xc, &(0x7f00000004c0)={&(0x7f0000000a80)=ANY=[]}, 0x1}, 0x0) pipe(&(0x7f0000000780)={0xffffffffffffffff}) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f00000007c0)={&(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil}) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000800)={0x10}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x14, 0x0, 0x0, 0x0, 0x0, {0x2}}, 0x14}, 0x1}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f000098dffc), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f00000000c0), 0x14) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000), &(0x7f0000000040)=0x1) setsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000080), 0x8) bind$inet6(r0, &(0x7f0000000880)={0xa, 0x4e22}, 0x1c) socketpair(0x0, 0x0, 0x0, &(0x7f0000000540)) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000680)) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f00000006c0)) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000000100)={{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, {0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, 0x5c) getsockname$unix(0xffffffffffffffff, &(0x7f0000000180), &(0x7f0000000200)=0x6e) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000240)={'nat\x00'}, &(0x7f00000002c0)=0x78) sendto$inet6(r0, &(0x7f00002a0b14), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto(r0, &(0x7f000092d000)="d5", 0x1, 0x1, &(0x7f0000ad9000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}}, 0x80) close(r0) 2018/04/13 16:42:10 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x80fe, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000004000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:10 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f75746500000000000000ffffffe400", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:11 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) tee(r0, r0, 0x8001, 0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000fe8)={0xaa}) r1 = epoll_create1(0xfffffffffffffffc) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreq(r2, 0x0, 0x20, &(0x7f0000001000)={@broadcast, @remote}, &(0x7f0000012000)=0x8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) dup3(r1, r0, 0x0) 2018/04/13 16:42:11 executing program 2: setsockopt$netrom_NETROM_N2(0xffffffffffffffff, 0x103, 0x3, &(0x7f0000000280), 0x4) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000080c0)) r1 = accept4(r0, &(0x7f0000007480)=@rc, &(0x7f0000007500)=0x80, 0x80000) getsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000007540), &(0x7f0000007580)=0x4) fstat(r0, &(0x7f0000008240)) stat(&(0x7f0000008500)='./file0\x00', &(0x7f0000008540)) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) timer_create(0x0, &(0x7f0000000140)={0x0, 0x0, 0x0, @thr={&(0x7f00000001c0)}}, &(0x7f0000000280)) write$rdma_cm(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000180000fa0000000000000000"], 0x10) write$rdma_cm(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="140000266b00fefa"], 0x8) r3 = socket$vsock_dgram(0x28, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000180), &(0x7f0000008600)=0xc) r4 = openat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0x12000, 0x1) ioctl$TUNSETOFFLOAD(r4, 0x400454d0, 0x9) r5 = msgget$private(0x0, 0x80) msgctl$MSG_INFO(r5, 0xc, &(0x7f0000000340)=""/222) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000180)={0x1d}, 0x10) r7 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r8 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x81, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r8, 0x114, 0x1, &(0x7f00000001c0)={0x2, 0x4e21, @loopback=0x7f000001}, 0x10) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000380)) ioctl$TUNSETOWNER(r8, 0x400454cc, r9) sendmsg$key(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005ff0)={&(0x7f0000000040)=ANY=[@ANYBLOB="050000001b000000000000000000000004000000000000000000000000000000000000000000000000000000000000000800120003000000000000000000000006000000000000000000000000000000ac14140000010000001bdc26ef0000000000000100000000000000000000000000000000070019000000000002000000ffffffff00000000000000f7000a00000000000000ff02000000000000000005e40bf43f5980bcf70bcbf3d00000000000010000000000000000010014000000000080000000000000000000000000000000000000000000"], 0xd8}, 0x1}, 0x0) dup3(r7, r6, 0x0) r10 = open(&(0x7f00004b8ff8)='./file0\x00', 0x0, 0x0) ioctl$TIOCMBIS(r10, 0x5416, &(0x7f00000001c0)=0x7) [ 1068.270273] binder: 9447:9449 got transaction with invalid offsets ptr [ 1068.286193] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/04/13 16:42:11 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) 2018/04/13 16:42:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0xfffffff5, @loopback={0x0, 0x1}}, 0x1c) [ 1068.312356] binder: 9447:9449 transaction failed 29201/-14, size 40-8 line 2991 [ 1068.347920] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/13 16:42:11 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x8f040000, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) 2018/04/13 16:42:11 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1068.372682] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1068.409816] binder: 9447:9449 ioctl 40046207 0 returned -16 2018/04/13 16:42:11 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x3, 0x1f0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'eql\x00', 'bond_slave_0\x00', 'vcan0\x00', 'veth1\x00', @random="175c89467277", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'teql0\x00', 'veth1_to_team\x00', 'nr0\x00', 'tunl0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}]}, 0x398) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={"62726f7574650000000000000100", 0x20, 0x2, 0x398, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000900], 0x0, &(0x7f0000000240), &(0x7f0000000900)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gretap0\x00', 'syz_tun\x00', 'bond0\x00', 'syz_tun\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xa0, 0x138, 0x188, [@pkttype={'pkttype\x00', 0x8}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{"73797a30000200"}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x10000, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x130, 0x130, 0x180, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}}}, @limit={'limit\x00', 0x20, {{0x0, 0xec}}}]}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x410) 2018/04/13 16:42:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x78, @loopback={0x0, 0x1}}, 0x1c) 2018/04/13 16:42:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000000000000000006cc00000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1600000000000000"]], 0x0, 0x0, &(0x7f0000000280)}) 2018/04/13 16:42:11 executing program 4: unshare(0x0) r0 = syz_open_dev$adsp(&(0x7f0000000180)='/dev/adsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0xc000000) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f00000000c0)=ANY=[@ANYBLOB="0300f47a1fdbc79c036361053ef67f996a27793ffed03c253dc85a48070d4041efe032b2305dc4c61e349a4f5136bf9e1d175a5176"], &(0x7f0000000080)=0xa) 2018/04/13 16:42:11 executing program 6: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x1100, 0x48f, &(0x7f0000000000)={0x6, @rand_addr, 0x0, 0x3, 'lblc\x00'}, 0x2c) [ 1068.519367] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/13 16:42:11 executing program 3: syz_emit_ethernet(0x66, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\t\x00', 0x30, 0x400000000033, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff00000000], 0x1}, {[], @icmpv6=@time_exceed={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a97188", 0x0, 0x0, 0x0, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}}}}}}}}, 0x0) [ 1068.572207] binder: 9487:9488 got transaction with invalid offsets ptr [ 1068.575734] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1068.620180] binder: 9487:9488 transaction failed 29201/-14, size 40-8 line 2991 [ 1068.640503] binder: BINDER_SET_CONTEXT_MGR already set [ 1068.647393] binder: 9487:9488 ioctl 40046207 0 returned -16 [ 1068.668174] binder: undelivered TRANSACTION_ERROR: 29201 [ 1068.682773] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1075.591217] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1085.839138] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1096.087141] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1106.095146] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1116.343152] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1126.591150] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1136.839140] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1147.087165] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1157.335193] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1167.591161] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1177.847236] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1188.095173] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1198.351215] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1208.599201] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1218.847148] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1229.095096] unregister_netdevice: waiting for lo to become free. Usage count = 1 [ 1229.791337] INFO: task syz-executor2:9455 blocked for more than 120 seconds. [ 1229.798667] Not tainted 4.16.0+ #2 [ 1229.802773] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1229.810764] syz-executor2 D23592 9455 4531 0x00000004 [ 1229.816455] Call Trace: [ 1229.819064] __schedule+0x801/0x1e30 [ 1229.822808] ? __sched_text_start+0x8/0x8 [ 1229.826970] ? lock_repin_lock+0x410/0x410 [ 1229.831244] ? graph_lock+0x170/0x170 [ 1229.835058] ? graph_lock+0x170/0x170 [ 1229.838884] ? print_usage_bug+0xc0/0xc0 [ 1229.842975] ? __schedule+0x809/0x1e30 [ 1229.846928] ? print_usage_bug+0xc0/0xc0 [ 1229.851056] schedule+0xef/0x430 [ 1229.854445] ? lock_downgrade+0x8e0/0x8e0 [ 1229.858632] ? __schedule+0x1e30/0x1e30 [ 1229.862617] ? mark_held_locks+0xc9/0x160 [ 1229.866797] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1229.871394] ? _raw_spin_unlock_irq+0x27/0x70 [ 1229.875923] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1229.880969] __rwsem_down_write_failed_common+0x919/0x15d0 [ 1229.886637] ? rwsem_spin_on_owner+0x7b0/0x7b0 [ 1229.891254] ? debug_check_no_locks_freed+0x310/0x310 [ 1229.896479] ? __lock_acquire+0x7f5/0x5130 [ 1229.900747] ? rcu_is_watching+0x85/0x140 [ 1229.904936] ? debug_check_no_locks_freed+0x310/0x310 [ 1229.910153] ? graph_lock+0x170/0x170 [ 1229.913984] ? graph_lock+0x170/0x170 [ 1229.917812] ? unwind_get_return_address+0x61/0xa0 [ 1229.922797] ? __save_stack_trace+0x7e/0xd0 [ 1229.927195] ? find_held_lock+0x36/0x1c0 [ 1229.931364] ? lock_downgrade+0x8e0/0x8e0 [ 1229.935544] ? lock_downgrade+0x8e0/0x8e0 [ 1229.940092] ? kasan_check_read+0x11/0x20 [ 1229.944270] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1229.948819] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1229.953431] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 1229.958576] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1229.963781] ? trace_hardirqs_on+0xd/0x10 [ 1229.967969] ? register_netdevice_notifier+0xb4/0x8f0 [ 1229.973198] ? lock_release+0xa10/0xa10 [ 1229.977295] ? check_same_owner+0x320/0x320 [ 1229.981641] rwsem_down_write_failed+0xe/0x10 [ 1229.986181] ? rwsem_down_write_failed+0xe/0x10 [ 1229.990886] call_rwsem_down_write_failed+0x17/0x30 [ 1229.995960] down_write+0xa2/0x120 [ 1229.999529] ? register_netdevice_notifier+0xb4/0x8f0 [ 1230.004852] ? down_read+0x1b0/0x1b0 [ 1230.008610] ? kasan_check_read+0x11/0x20 [ 1230.012812] register_netdevice_notifier+0xb4/0x8f0 [ 1230.017916] ? __dev_close_many+0x360/0x360 [ 1230.022289] ? lockdep_init_map+0x9/0x10 [ 1230.026365] ? init_timer_key+0x17f/0x470 [ 1230.030541] ? find_held_lock+0x36/0x1c0 [ 1230.034638] ? __rwlock_init+0x1c/0x140 [ 1230.038700] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1230.043789] ? __lockdep_init_map+0x105/0x590 [ 1230.048347] ? __lockdep_init_map+0x105/0x590 [ 1230.052882] ? kasan_check_write+0x14/0x20 [ 1230.057152] ? sock_init_data+0x983/0xd70 [ 1230.061321] bcm_init+0x259/0x300 [ 1230.064803] ? canbcm_pernet_init+0x90/0x90 [ 1230.069152] ? can_get_proto+0x245/0x380 [ 1230.073243] ? can_pernet_init+0x3b0/0x3b0 [ 1230.077512] ? rcu_is_watching+0x85/0x140 [ 1230.081695] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1230.086909] ? canbcm_pernet_init+0x90/0x90 [ 1230.091348] can_create+0x28a/0x4b0 [ 1230.094990] __sock_create+0x526/0x920 [ 1230.098902] ? kernel_sock_ip_overhead+0x570/0x570 [ 1230.103847] ? putname+0xf2/0x130 [ 1230.107335] ? rcu_read_lock_sched_held+0x108/0x120 [ 1230.112382] ? kmem_cache_free+0x25c/0x2d0 [ 1230.116654] __sys_socket+0x100/0x250 [ 1230.120471] ? move_addr_to_kernel+0x70/0x70 [ 1230.124928] ? ksys_msgget+0x1a0/0x1a0 [ 1230.128828] SyS_socket+0x24/0x30 [ 1230.132310] ? __sys_socket+0x250/0x250 [ 1230.136303] do_syscall_64+0x29e/0x9d0 [ 1230.140227] ? vmalloc_sync_all+0x30/0x30 [ 1230.144391] ? _raw_spin_unlock_irq+0x27/0x70 [ 1230.148919] ? finish_task_switch+0x1ca/0x810 [ 1230.153530] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1230.158498] ? syscall_return_slowpath+0x30f/0x5c0 [ 1230.163458] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1230.168858] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1230.173736] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1230.179006] RIP: 0033:0x455319 [ 1230.182233] RSP: 002b:00007f4ae5036c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 1230.190060] RAX: ffffffffffffffda RBX: 00007f4ae50376d4 RCX: 0000000000455319 [ 1230.197364] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 000000000000001d [ 1230.204724] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 1230.212046] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 1230.219406] R13: 0000000000000613 R14: 00000000006fc268 R15: 0000000000000000 [ 1230.226743] [ 1230.226743] Showing all locks held in the system: [ 1230.233150] 3 locks held by kworker/u4:4/141: [ 1230.238041] #0: 0000000090019c63 ((wq_completion)"%s""netns"){+.+.}, at: process_one_work+0xaef/0x1b50 [ 1230.247665] #1: 00000000344f7030 (net_cleanup_work){+.+.}, at: process_one_work+0xb46/0x1b50 [ 1230.256387] #2: 00000000dc3fa76d (pernet_ops_rwsem){++++}, at: cleanup_net+0x11a/0xb20 [ 1230.264594] 2 locks held by khungtaskd/889: [ 1230.268932] #0: 00000000e3bca030 (rcu_read_lock){....}, at: watchdog+0x1ff/0xf60 [ 1230.276615] #1: 00000000ed720f87 (tasklist_lock){.+.+}, at: debug_show_all_locks+0xde/0x34a [ 1230.285284] 1 lock held by rsyslogd/4363: [ 1230.289451] #0: 00000000f0b7d954 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1a9/0x1e0 [ 1230.297732] 2 locks held by login/4453: [ 1230.301739] #0: 00000000e8025cab (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 1230.310114] #1: 000000004a21457d (&tty->atomic_write_lock){+.+.}, at: tty_write_lock+0x23/0x90 [ 1230.319071] 2 locks held by getty/4454: [ 1230.323244] #0: 0000000007743f38 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 1230.331717] #1: 000000004bcf8486 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x321/0x1cc0 [ 1230.340613] 2 locks held by getty/4455: [ 1230.344622] #0: 000000003b4e3e3e (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 1230.352962] #1: 00000000c1d7aa6c (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x321/0x1cc0 [ 1230.361932] 2 locks held by getty/4456: [ 1230.366536] #0: 0000000046bbd0fe (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 1230.374896] #1: 0000000093d1bea6 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x321/0x1cc0 [ 1230.383787] 2 locks held by getty/4457: [ 1230.387779] #0: 000000004990f081 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 1230.396648] #1: 000000007f26f6fd (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x321/0x1cc0 [ 1230.405542] 2 locks held by getty/4458: [ 1230.409523] #0: 000000007af586c2 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 1230.417813] #1: 00000000fe86ceae (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x321/0x1cc0 [ 1230.426687] 2 locks held by getty/4459: [ 1230.430683] #0: 00000000a9b3ac7b (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 1230.438965] #1: 000000009d5003ad (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x321/0x1cc0 [ 1230.448011] 1 lock held by syz-executor2/9455: [ 1230.452622] #0: 00000000dc3fa76d (pernet_ops_rwsem){++++}, at: register_netdevice_notifier+0xb4/0x8f0 [ 1230.463601] 1 lock held by syz-executor2/9507: [ 1230.468187] #0: 00000000dc3fa76d (pernet_ops_rwsem){++++}, at: register_netdevice_notifier+0xb4/0x8f0 [ 1230.477694] 1 lock held by syz-executor0/9514: [ 1230.482279] #0: 00000000dc3fa76d (pernet_ops_rwsem){++++}, at: copy_net_ns+0x297/0x4c0 [ 1230.490487] [ 1230.492120] ============================================= [ 1230.492120] [ 1230.499174] NMI backtrace for cpu 1 [ 1230.502834] CPU: 1 PID: 889 Comm: khungtaskd Not tainted 4.16.0+ #2 [ 1230.509219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1230.518556] Call Trace: [ 1230.521154] dump_stack+0x1b9/0x294 [ 1230.524780] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1230.529955] nmi_cpu_backtrace.cold.4+0x19/0xce [ 1230.534609] ? lapic_can_unplug_cpu.cold.26+0x3f/0x3f [ 1230.539788] nmi_trigger_cpumask_backtrace+0x151/0x192 [ 1230.545063] arch_trigger_cpumask_backtrace+0x14/0x20 [ 1230.550268] watchdog+0xc10/0xf60 [ 1230.553730] ? reset_hung_task_detector+0xb0/0xb0 [ 1230.558582] ? __schedule+0x1e30/0x1e30 [ 1230.562549] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1230.566940] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1230.571508] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 1230.576592] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1230.581588] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1230.587118] ? __kthread_parkme+0x1b7/0x280 [ 1230.591429] kthread+0x345/0x410 [ 1230.594782] ? reset_hung_task_detector+0xb0/0xb0 [ 1230.599604] ? kthread_bind+0x40/0x40 [ 1230.603384] ret_from_fork+0x3a/0x50 [ 1230.607201] Sending NMI from CPU 1 to CPUs 0: [ 1230.611756] NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x6/0x10 [ 1230.612727] Kernel panic - not syncing: hung_task: blocked tasks [ 1230.625745] CPU: 1 PID: 889 Comm: khungtaskd Not tainted 4.16.0+ #2 [ 1230.632128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1230.641460] Call Trace: [ 1230.644036] dump_stack+0x1b9/0x294 [ 1230.647646] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1230.652820] ? printk_safe_log_store+0x260/0x260 [ 1230.657559] panic+0x22f/0x4de [ 1230.660750] ? add_taint.cold.5+0x16/0x16 [ 1230.664910] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1230.670451] ? nmi_trigger_cpumask_backtrace+0x13a/0x192 [ 1230.675895] ? printk_safe_flush+0xd7/0x130 [ 1230.680209] watchdog+0xc21/0xf60 [ 1230.683658] ? reset_hung_task_detector+0xb0/0xb0 [ 1230.688632] ? __schedule+0x1e30/0x1e30 [ 1230.692595] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1230.696990] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1230.701559] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 1230.706659] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1230.711853] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1230.717553] ? __kthread_parkme+0x1b7/0x280 [ 1230.723078] kthread+0x345/0x410 [ 1230.726448] ? reset_hung_task_detector+0xb0/0xb0 [ 1230.731279] ? kthread_bind+0x40/0x40 [ 1230.735071] ret_from_fork+0x3a/0x50 [ 1230.739485] Dumping ftrace buffer: [ 1230.743215] (ftrace buffer empty) [ 1230.746908] Kernel Offset: disabled [ 1230.750526] Rebooting in 86400 seconds..