10 12:54:20 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0x1100}}], 0x1, 0x0) 2018/04/10 12:54:20 executing program 7: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)="2e2f6367726f75702e6370752f73797a3100f912bcbd80c5a209dda4d62d2d40bbd298133965ffc1ec575d8820835be2fa78feb37c8bffbe668a945f72c0a54d4575399ed34d89a3e4f1bc4ff8bc143441b0a207f4de1ad187c38b951a02aab3686c6896faf50436b01f988c22623957caf541ad024a2b1665bd057a60c0d6467a8a1696c057d5752d9c2783b74c1351ac41304ec559732a037af2f1c61646ebe508c37363f32d1740b7dae08856a3b159", 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000240)='hugetlb.2MB.max_usage_in_bytes\x00', 0x2, 0x0) read(r1, &(0x7f0000000140)=""/232, 0xe8) 2018/04/10 12:54:20 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:20 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000020000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:20 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000003, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:20 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff]}}, 0x14) 2018/04/10 12:54:20 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xe803]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0045877, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 931.553414] binder: undelivered TRANSACTION_ERROR: 29189 [ 931.559729] binder: release 28072:28075 transaction 490 in, still active [ 931.566659] binder: send failed reply for transaction 490 to 28072:28118 [ 931.573569] binder: undelivered TRANSACTION_COMPLETE [ 931.578692] binder: undelivered TRANSACTION_ERROR: 29189 [ 931.653107] binder: 28135 RLIMIT_NICE not set 2018/04/10 12:54:20 executing program 7: r0 = socket(0x10, 0x4000000002, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f00000000c0)=@add_del={0x2, &(0x7f0000000040)='nr0\x00', 0x22}) r1 = accept$packet(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000180)=0x14) setsockopt$sock_void(r1, 0x1, 0x1b, 0x0, 0x0) fstat(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000580)={{{@in6=@dev={0xfe, 0x80, [], 0x11}, @in=@multicast2=0xe0000002, 0x4e21, 0x23, 0x4e24, 0x9, 0xa, 0x80, 0xa0, 0xbf, r2, r3}, {0x0, 0x6, 0xff, 0xa58, 0x6, 0x629, 0x80000001, 0x80000000}, {0x3ff, 0x0, 0x7a5c, 0xffffffff}, 0xffff, 0x6e6bbc, 0x1, 0x0, 0x2, 0x2}, {{@in6=@local={0xfe, 0x80, [], 0xaa}, 0x4d4, 0x7c}, 0xa, @in6=@local={0xfe, 0x80, [], 0xaa}, 0x3500, 0x2, 0x1, 0x6, 0x9, 0x7, 0x5}}, 0xe8) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/sctp\x00') ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f00000003c0)={[{0x4, 0x7, 0x7fffffff, 0x3, 0xffffffffffffff80, 0xfffffffffffffff4, 0x5, 0x4, 0x7, 0x6, 0x0, 0x6, 0x8eb}, {0x0, 0x726, 0x4, 0xf788, 0x8, 0x0, 0x9, 0xfffffffffffffe01, 0x6a, 0x20, 0x8a5b, 0x40, 0x1}, {0xffffffffffffffc0, 0x9, 0x4, 0xffffffffffffffff, 0x2400000000000, 0x5, 0x100000001, 0x4, 0x3, 0x5, 0x4b7c, 0x5, 0x8001}], 0x4}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), 0x10) msgget$private(0x0, 0x80) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000380), &(0x7f0000000100)=0x10) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000200)={0x0, 0x2710}, 0x10) recvfrom$unix(r0, &(0x7f0000000680)=""/4096, 0x1000, 0x2, &(0x7f0000001680)=@file={0x0, './file0\x00'}, 0x6e) getsockname$packet(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000300)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000001700)=ANY=[@ANYBLOB="280000001500010c0000000000f22273b0000000000004000eafffc8550fd16b29f165f022d9aa08e4279245f99bc66297de3ad1ed47219d7edc7f8b1d4e94ca809ff13c4ce923f4411af689b5f87789097e47bd2c8c022a88061c9cb67439271aa1f0f98bc31b541312e2edf34538f665bb9b54bad915e28746690533692b09ab0930c30938148f6f08252b37e26e0de5eb676e5605a08488e8ab3acf0a9af47dcb9f922be73d13ada2d1123d2fc4da3369428d48a443a216035f03c7c28529df780fcb0a111abc9eeb7bca5171ef42d1510bae8143625bad379ace118e63ad77e1f742b97ef348b7838d39cb0aa840ad72c941f7186811ffe3bc0807c7c29cf44fd17311e0e60e7c4a4153054ea27df0f10000000000000000000000"], 0x1}, 0x1}, 0x0) 2018/04/10 12:54:20 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:20 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000ffffffef0000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:20 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000005, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:20 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000003fff00000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:20 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x1f4], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:20 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000001, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:20 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000], 0x1}, 0x5}, 0x1c) [ 932.454105] binder: 28135 RLIMIT_NICE not set [ 932.460638] binder: 28131:28135 ioctl c0306201 20004000 returned -14 [ 932.460764] binder: BINDER_SET_CONTEXT_MGR already set [ 932.472651] binder: 28131:28172 ioctl 40046207 0 returned -16 [ 932.484254] binder_alloc: 28131: binder_alloc_buf, no vma [ 932.489909] binder: 28131:28172 transaction failed 29189/-3, size 0-0 line 2963 [ 932.600755] binder: undelivered TRANSACTION_ERROR: 29189 [ 932.606402] binder: release 28131:28135 transaction 493 in, still active [ 932.613337] binder: send failed reply for transaction 493 to 28131:28172 [ 932.620247] binder: undelivered TRANSACTION_COMPLETE [ 932.625410] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:21 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0x2}}], 0x1, 0x0) 2018/04/10 12:54:21 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000200000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:21 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:21 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}}, 0x14) 2018/04/10 12:54:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:21 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:21 executing program 7: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt(r0, 0x10e, 0x400000000b, &(0x7f0000000000), 0x0) recvmsg(r0, &(0x7f0000000400)={&(0x7f0000000000)=@rc, 0x80, &(0x7f0000000540)=[{&(0x7f0000000080)=""/71, 0x47}, {&(0x7f0000000100)=""/93, 0x5d}, {&(0x7f0000000440)=""/244, 0xf4}, {&(0x7f0000000280)=""/158, 0x9e}], 0x4, &(0x7f0000000380)=""/2, 0x2}, 0x10000) 2018/04/10 12:54:21 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000004, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:21 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe000030a}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 932.828187] binder: 28194 RLIMIT_NICE not set 2018/04/10 12:54:21 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000300000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:21 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xf401000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:21 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe000000b}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:21 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000400000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:21 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:21 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0001400}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:21 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000100000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 933.612977] binder: 28194 RLIMIT_NICE not set [ 933.621339] binder: BINDER_SET_CONTEXT_MGR already set [ 933.626933] binder: 28186:28194 ioctl c0306201 20004000 returned -14 [ 933.630113] binder: 28186:28234 ioctl 40046207 0 returned -16 [ 933.647112] binder_alloc: 28186: binder_alloc_buf, no vma [ 933.652798] binder: 28186:28234 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:54:22 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0xf00000000000000}}], 0x1, 0x0) 2018/04/10 12:54:22 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:22 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}}, 0x14) 2018/04/10 12:54:22 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000002}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:22 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000500000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:22 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:22 executing program 7: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000028000007a0a00fffffffffd630108"], &(0x7f0000000000)="47504c00bc3047eb525f484f89fc96dd6ca64da40ff023122e66f6", 0x0, 0xce, &(0x7f0000000300)=""/206}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xc, 0x5, &(0x7f0000000040)=@framed={{0x18}, [@jmp={0x5}], {0x95}}, &(0x7f00000004c0)="73797a6b584e3e2f9afed6d0ee3d5d5de2f791e4545b69c564e359a02949ab535c1b25caa665b968d2f1a32e3febe4189befa5f044722bae83e5b6959e392e8d24e41b4ce153c97b5a23e135e38d3b1d14ad7a9eeb7069347fee053569544f1a0000000000000000", 0x80000001, 0x7bc, &(0x7f0000000300)=""/187}, 0x48) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000000)) socketpair$inet6(0xa, 0x6, 0x2, &(0x7f0000000040)) socket$kcm(0x29, 0x0, 0x0) socketpair$inet6_sctp(0xa, 0x1, 0x84, &(0x7f0000000080)) syz_mount_image$minix(&(0x7f0000000540)='minix\x00', &(0x7f0000002900)='./file0\x00', 0xc90e, 0x3, &(0x7f0000002cc0)=[{&(0x7f0000002a00)="9a06d59cbd80034b1758d5c4e80c93873569ed89352b04681a6926e852201d16b3c958bc59f5bbc550ff89966b2bf2721cccc42d79d1bf7c8138b8bd744f337e47e2b2730f2fade92470568f7d8ce219ed3fad1178f06dfadc8b7d88e4b149ba2706d046362490e50a8689d2d2aaa29df845fe37d931893dfb0616cba287dfb9c869710895515e205905c05b1d626f2c0d95d21bd6ebfe8a3436e6bcea28d175b6f115b3942dcaa7f65715591429257c8e002a665514d313f6c236a7f4cde9b5693d7dad5f7dbd4f", 0xc8, 0x1ff}, {&(0x7f0000002b00)="66fad19b2faa75dab2a3178028b07924866410eba574026126e60f55871e14448267f9293b6f10176a846e207980ba32efc391cdce7fb533fe46d8410ac4e7e83fd342f2754671cc7e7dfb2a0b157ce32335974d613896155e5d6f1b83f808f5d77afd5093eb7c20a2d23fa091ebeb949fd8a5286a58701bb5549adc56a180f61070cc147fa0f4e1ff5dfff1c6a045c25c5e13a2b0fee27aa392c1f611509d7cc545c73fb2e61d24cd30717369d6382202136a36b6b895d40b4668d62b88329b1684fcedeb5730", 0xc7, 0x180}, {&(0x7f0000002c00)="b5fa630e17de2e46bdba3d59b6045d3a50eb21e748d5bc4948b53e0c1fe2bc5d4be2cb82df500094820655fbde6be306a842578d81c882622a85d05016509b8e0fdd06e38ddee1129b9fc9ec401057c04f3b8214af80e3654883fab2071c60f5bc99772051576d2057433a04ce9d13ece97dd30bd89f2b96a99e9c3f7f434aeea7757a48c7fb09d51572f204d69923487201ec675b02b9f2c3", 0x99, 0xab}], 0x0, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0x13, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@exit={0x95}, @call={0x85, 0x0, 0x0, 0x1e}, @alu={0x7, 0x7966, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff}, @generic={0x7f, 0x968, 0x697}, @initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xffffffffffffffc0}, @jmp={0x5, 0x400, 0xa, 0x3, 0x7, 0xfffffff8, 0xfffffffffffffff1}, @jmp={0x5, 0x80000001, 0x8, 0x9, 0xf, 0xfffffff4, 0xfffffffffffffffc}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2}], {0x95}}, &(0x7f0000000100)='syzkaller\x00', 0xcf, 0x8c, &(0x7f0000000140)=""/140, 0x41f00, 0x1}, 0x48) r0 = socket$kcm(0x29, 0x5, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000003e80)={0xf, 0x14, &(0x7f00000002c0)=@raw=[@jmp={0x5, 0x2, 0x0, 0x9, 0x7, 0x50, 0x10}, @map={0x18, 0xa342e40de9d8422f, 0x1}, @exit={0x95}, @alu={0x7, 0xfffffffffffffffc, 0xa, 0x9, 0xf, 0x50, 0x1}, @exit={0x95}, @alu={0x7, 0xc97f, 0xf, 0x7, 0xa, 0x96, 0xfffffffffffffff0}, @generic={0x2, 0x1b63, 0x300a, 0x4}, @exit={0x95}, @alu={0x4, 0x5, 0xe, 0x2, 0x3, 0xfffffff0, 0xfffffffffffffff1}, @generic={0x1ff, 0x200, 0x8, 0x81}], &(0x7f0000000380)='syzkaller\x00', 0x0, 0xc9, &(0x7f00000003c0)=""/201, 0x41000, 0x1}, 0x48) recvmsg$kcm(r0, &(0x7f00000029c0)={&(0x7f0000002880)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000003d00)=[{&(0x7f0000000280)=""/18, 0x12}, {&(0x7f0000003a00)=""/236, 0xec}, {&(0x7f0000002940)=""/95, 0x5f}, {&(0x7f0000003b00)=""/207, 0xcf}, {&(0x7f0000003c00)=""/226, 0xe2}], 0x5, &(0x7f0000003d80)=""/209, 0xd1, 0x6}, 0x40000000) socket$kcm(0x29, 0x5, 0x0) mkdir(&(0x7f0000000580)='./file0\x00', 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000005c0)={0x0, 0x6c55, 0x18}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000600)={0xa, 0x1ff, 0x1, 0x5, 0x1d, r2, 0x57}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000000640)={0xf, 0x60, 0x5, 0x4, 0x11, r2, 0x19}, 0x2c) bpf$OBJ_GET_MAP(0x7, &(0x7f00000006c0)={&(0x7f0000000680)='./file0\x00', 0x0, 0xe}, 0x10) mount(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)='./file0\x00', &(0x7f0000000780)='9p\x00', 0x0, &(0x7f00000007c0)="587f") socketpair(0xa, 0x0, 0x80000001, &(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMUNATTACH(r4, 0x89e1, &(0x7f0000000840)={r0}) mount(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)='bdev\x00', 0x2000010, &(0x7f0000000940)="512f456d8b95445247012d0fbfbb3a9e953c7b3f7d1ccfde5395fb21f303af86d0dd42b8492b5c6f6756b984b54f12bdf0cc3ef61c9989b574fd64f8d71ad755236bb715b925b3641ab490c37082e03e6225c50226e24eb3a975c781b09233afaa87ebfe1a21555a4932ab1b63266c4bd9837bb49366561c0384953933c4655d68a3bf7b4c22b3460c89f1a5d611796bc864cfb906204a1edd50fa82e7a148d0ec78f049e16d2f1fa02d1389165695447e0837fb441e3f86ee13bd766fb0741bc722dc225d12") recvmsg(r0, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000a40)=""/171, 0xab}, {&(0x7f0000000b00)=""/34, 0x22}, {&(0x7f0000000b40)=""/161, 0xa1}, {&(0x7f0000000c00)=""/81, 0x51}], 0x4, &(0x7f0000000cc0)=""/107, 0x6b, 0x3}, 0x40000041) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000d80)=r1, 0x4) socket$kcm(0x29, 0x2, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000002600)={&(0x7f0000000dc0)=@nfc, 0x80, &(0x7f00000024c0)=[{&(0x7f0000000e40)=""/87, 0x57}, {&(0x7f0000000ec0)=""/103, 0x67}, {&(0x7f0000000f40)=""/154, 0x9a}, {&(0x7f0000001000)=""/194, 0xc2}, {&(0x7f0000001100)=""/202, 0xca}, {&(0x7f0000001200)=""/224, 0xe0}, {&(0x7f0000001300)=""/4096, 0x1000}, {&(0x7f0000002300)=""/152, 0x98}, {&(0x7f00000023c0)=""/170, 0xaa}, {&(0x7f0000002480)=""/39, 0x27}], 0xa, &(0x7f0000002580)=""/95, 0x5f, 0x69}, 0x10002) mount(&(0x7f0000002640)='./file0\x00', &(0x7f0000002680)='./file0\x00', &(0x7f00000026c0)='adfs\x00', 0x255542c7d125f19c, 0x0) sendmsg$kcm(r4, &(0x7f0000004c00)={&(0x7f0000002700)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha256\x00'}, 0x80, &(0x7f0000004b80)=[{&(0x7f0000002780)="63ea197191f594c41d951de7344b73be307ab0a41efba8a1a874edec8866521c7432e3fe61fb355684bbe053fb02ae42555ad8ee2a9dd09985a956f2f4687be7a4e44e58d9c0a8f33582dcd80102449414d8d5c8d6a83dceb6b15121f5885bfdf368d4fabd8a1abee11a2a2a18010d02662141f000e34ac215d9672764343dda72a40c376fa18cc4c8f57b7d31c708a9d80b63a77439897d4d6111457b4479cf89e4def4f18b0d0e9a16c12ef5102667d0d10b25f9d461b616da34a62c686332cf4f12b5ee7616e3e9ae", 0xca}], 0x1, 0x0, 0x0, 0x4000}, 0x44880) [ 933.761614] binder: undelivered TRANSACTION_ERROR: 29189 [ 933.767272] binder: release 28186:28194 transaction 496 in, still active [ 933.774215] binder: send failed reply for transaction 496 to 28186:28234 [ 933.781126] binder: undelivered TRANSACTION_COMPLETE [ 933.786285] binder: undelivered TRANSACTION_ERROR: 29189 [ 933.854763] binder: 28249 RLIMIT_NICE not set 2018/04/10 12:54:22 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe000003e}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:22 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:22 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000005000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:22 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe000000c}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:22 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xa], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:22 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000efffffff00000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:22 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000006}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:22 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x1}, 0x5}, 0x1c) [ 934.655176] binder: 28249 RLIMIT_NICE not set [ 934.660895] binder: BINDER_SET_CONTEXT_MGR already set [ 934.661009] binder: 28247:28249 ioctl c0306201 20004000 returned -14 [ 934.666551] binder: 28247:28298 ioctl 40046207 0 returned -16 [ 934.685229] binder_alloc: 28247: binder_alloc_buf, no vma [ 934.690900] binder: 28247:28298 transaction failed 29189/-3, size 0-0 line 2963 [ 934.699343] 9pnet_virtio: no channels available for device ./file0 [ 934.799460] binder: undelivered TRANSACTION_ERROR: 29189 [ 934.805289] binder: release 28247:28249 transaction 499 in, still active [ 934.812179] binder: send failed reply for transaction 499 to 28247:28298 [ 934.819085] binder: undelivered TRANSACTION_COMPLETE [ 934.824225] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:23 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0xa00000000000000}}], 0x1, 0x0) 2018/04/10 12:54:23 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000020000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:23 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000306}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:23 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfdffffff]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:23 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000]}}, 0x14) 2018/04/10 12:54:23 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:23 executing program 7: r0 = perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x2, 0x0) fstat(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setfsgid(r2) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000000)=ANY=[], &(0x7f0000000000)) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0x8) r4 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x4a, 0x2000) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r0, &(0x7f0000000140)={0x20000000}) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000200)={r3, 0xfff, 0x20}, 0xc) write(r1, &(0x7f00003fe000)="24000000260007003200000800367700fbffffff0100000000000000ffffffff0100ff10", 0x24) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x40, 0x0) [ 934.879844] 9pnet_virtio: no channels available for device ./file0 [ 934.950788] binder: 28318 RLIMIT_NICE not set 2018/04/10 12:54:23 executing program 7: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x800, 0x0) pwrite64(r0, &(0x7f0000000000), 0xfffffdcb, 0x0) fdatasync(r0) 2018/04/10 12:54:23 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:23 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000003000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:23 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xa4ffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:23 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000c93000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) close(r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e630c40"]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x14, 0x0, &(0x7f000000cf68)=[@request_death={0x400c630f}, @enter_looper={0x630c}], 0x1, 0x0, &(0x7f0000008f37)="c2"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012fd0)={0xc, 0x0, &(0x7f0000007000)=[@dead_binder_done={0x40086310}], 0x0, 0x0, &(0x7f0000012000)}) 2018/04/10 12:54:23 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:23 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xff00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:23 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000003fff000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 935.142132] binder: BINDER_SET_CONTEXT_MGR already set [ 935.172348] binder: 28352:28354 ioctl 40046207 0 returned -16 [ 935.197346] binder: 28352:28354 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 935.205836] binder: 28354 RLIMIT_NICE not set [ 935.744912] binder: 28318 RLIMIT_NICE not set [ 935.747193] binder: BINDER_SET_CONTEXT_MGR already set [ 935.754860] binder: 28316:28366 ioctl 40046207 20000340 returned -16 [ 935.763771] binder: BINDER_SET_CONTEXT_MGR already set [ 935.769337] binder: 28316:28318 ioctl c0306201 20004000 returned -14 [ 935.776203] binder: 28316:28366 ioctl 40046207 0 returned -16 [ 935.788243] binder_alloc: 28316: binder_alloc_buf, no vma [ 935.793912] binder: 28316:28366 transaction failed 29189/-3, size 0-0 line 2963 [ 935.795426] binder: BINDER_SET_CONTEXT_MGR already set [ 935.807006] binder: 28316:28369 ioctl 40046207 20000340 returned -16 [ 935.925302] binder: undelivered TRANSACTION_ERROR: 29189 [ 935.928782] binder: 28352:28372 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 935.930899] binder: release 28316:28318 transaction 503 in, still active [ 935.945117] binder: send failed reply for transaction 503 to 28316:28366 [ 935.952073] binder: undelivered TRANSACTION_COMPLETE [ 935.957210] binder: undelivered TRANSACTION_ERROR: 29189 [ 936.058357] binder: 28352:28372 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 936.065410] binder: 28372 RLIMIT_NICE not set [ 936.070073] binder: 28352:28374 BC_DEAD_BINDER_DONE 0000000000000000 not found 2018/04/10 12:54:24 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0x11000000}}], 0x1, 0x0) 2018/04/10 12:54:24 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000020000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:24 executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) write(r0, &(0x7f0000000080)="130000001000ffdde200f49ff60f05001b230a009d0000000f7fcb697ae1a3490096ea0601b93c189814e301000000f949a1b4b88ed4fc65be060202000000f1da8ed7c06c7e000000d87d8d424e35a43d585282cd0001e42d732747442d1f90f26af098ad800000000006518c2c681bbce9ec3c3f8612f026723affc1681de8f100d4eec8a70935b80a7f41c08ffa56b97c987c4d465ddab5439b20db0f7e5bf12930d837b9cb3349b6c440007d886959eaeb01800000000000001ad5b56d2a91e1a70000000000000000000000914393c7d88b4588bef57618da12bb5dcf81b0ef81956388698cab2a7f377acfb859eab1dbe9f28e29fc2c6490d80ae6eb5c59f0057ad1cb249087ad17a5e2ae7454d7fba24d121329c2998737806a94721eed70549cf1b3bc5ab4bc6957a87d7709fa6813cfaf26f6b31f1265ddc8a7b0e0367358d4", 0x144) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x80000) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x4) 2018/04/10 12:54:24 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x28], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:24 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xfffffffe}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:24 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:24 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x14) 2018/04/10 12:54:25 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xe], 0x1}, 0x5}, 0x1c) [ 936.230799] binder: 28387 RLIMIT_NICE not set 2018/04/10 12:54:25 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000004018000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:25 executing program 7: r0 = socket(0x11, 0x4000000000080003, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000b40)={0x7fffffff, 0x5, 0x8, 0x4, 0x6}, 0x14) connect$bt_rfcomm(r0, &(0x7f00000009c0)={0x1f, {0x0, 0xfffffffffffffff7, 0x9, 0x3, 0x2, 0xf2b2}, 0x7f}, 0xa) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000004c0)={0x0, 0x5, 0x80, 0xeb}, &(0x7f0000000500)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000540)={0x0, 0x7, 0x0, 0xfff, 0x3}, &(0x7f0000000580)=0x18) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000a80), &(0x7f0000000ac0)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000005c0)={r1, 0x5, 0xfffffffffffffffa, 0x8, 0x6, 0xa4}, &(0x7f0000000600)=0x14) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000640)={0x0, @in={{0x2, 0x4e23, @rand_addr=0x7f}}, 0x100, 0x7, 0x2, 0xffff, 0xf9}, &(0x7f0000000700)=0x98) sendmmsg$inet_sctp(r0, &(0x7f0000000a00)=[{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x4, @mcast2={0xff, 0x2, [], 0x1}, 0x7}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000040)="9f9953c73041dd83bdc3dd75652a81171979e2f89b87c95626fa806b565c7b581d0877bb33c41155a24616777170e388b98a722d871247cfd711d80ccf051a18aa3b1f4edefd7fccb9834a8f9d3c77d71419b16c28ecf989a85f5a", 0x5b}, {&(0x7f00000000c0)="839d91ef5278e248debea9ee3fd882d006506a8935002dfc7a3d4bb0c396498265cac55a53e5fe0c1e233ecb426d950bb28e4e4064f758c78aefe82c94efab3c7891eb6ca7a05a7ea55417ea49dd77ac117a40b2f45cfde4209ebde5084a2584e9c6ccb60b2dd78f05cadda71efb19048a8a708440b379b502a75d68fb17ba14", 0x80}, {&(0x7f0000000140)="49d6f2f34c2698e6b4530da14a7a03abb762f69425b51275c2ffb3c7ffe7bf9b25842c3c8b34a432b89828990a662693409aabb836848d8dbf4f40a32d75faad876c14584edca22f0baeb37c49edb88601286e1fc856c2d3ee5b85d4f458840c8352a5ca828448628351ebc159f0354d9e135d423bafd3b91943dad4a1fdbd93ba1219e74f7f15d5765db338f9c3172d3c2d2fd2bc2c378634243606d38ba61bc35d8e0b995145ec3f37171e9902", 0xae}, {&(0x7f0000000200)="f78f2112ce395671ae5f1f7099f4784239de330b291f616ebd75f595be15cf220b22432a9730e8c0", 0x28}, {&(0x7f0000000240)="f7d371fb981db415d4db5a570c9bcb07cd5218dbece6a99531204405f6560ffba83e3187b0f8aec64b1d51d5fd569624a9e01f304abdbb0cdacf18ab2e13637d4a1abee3bb58a022993a6f0117986a6a7439ce4b10e2e55d4a6aa4d94c068974ff45056f087a6280aa8b82badfe31fa0539cb407b38a36a58db2be997a7040be0dd64f709174b64754db97881e5e789f7c3e4dd2c3cbde09d87c346451bfa3d487949fa47a91ed386724727d8d5777dd204f3acb7ed5ac34f41283d6486bfc71dd1e8e563e6f4b45a5ea05803d8c287a3aad78446f2ed44dcfbc92ab9815c3501024ee9f1d8dd332ae70f1cbb9222a31a9af0dd56c505752909f341519", 0xfd}, {&(0x7f0000000340)="1ccf8d1641b260125d9a257376ef92ae90d57aa4784c", 0x16}, {&(0x7f0000000380)="ea1602d8d595574c8f9e16d47da6b140fd7a2f2c6329352252683e4ae315fe3812bea3e5dbc4e5832b14541c97c2352962ad344ebeff45fdad5ac2c6cf5efc0b947e961e909fd57e72b49abeb812dc98f08b21f9aaa329ada76f194a90f978fea333244084613c4c1bb70eb15bb6fd612998dad857802ec34e5f5850521c49d7acdb7991aafde05d2c667c260d6de84f0b4663b0d8960957cb6e91fac637bb2b99f09da8000b4c", 0xa7}], 0x7, &(0x7f0000000740)=[@sndrcv={0x30, 0x84, 0x1, {0x2, 0x9, 0x8208, 0x4, 0x2, 0x7, 0x7, 0x4, r1}}, @sndrcv={0x30, 0x84, 0x1, {0xffffffffffffffc0, 0x80000001, 0x4, 0x3ff, 0x1460, 0x200, 0x4, 0xf241, r2}}, @sndinfo={0x20, 0x84, 0x2, {0x3ff, 0xb, 0xff, 0x0, r3}}, @init={0x18, 0x84, 0x0, {0x9, 0xffff, 0xaca, 0x80000001}}, @sndinfo={0x20, 0x84, 0x2, {0x5, 0x1, 0x5, 0x8, r4}}], 0xf0, 0x40010}, {&(0x7f0000000840)=@in6={0xa, 0x4e24, 0x3, @empty, 0x80000000}, 0x1c, &(0x7f0000000980)=[{&(0x7f0000000880)="ed43b10d8fb4daf40755e867ad1cfcaf855441172ba0165b5682bdb567b4e70126e9e31f8f9db934342c35d79036249ef1920fee7579695e2ff2895bed3385249f889cd736d67ad0efd2011422a5fe0a3ff1d0d79f127da16d0b52fddc32619f2a06d7141c4ccc2bf29300bb55c92ee1196f25440a6294fd28e249ae838179fa7b62994a1b5cdfb9edfa3d32512623058d943184b6f8c0bbfdeda661be235f23764a186f003042d4b7704670854c689106d02fed9a09b551ea0705dc1a7dc1daff6b24ecda138943d1bb6f94e1268cc7ee715b04fb7b3f3e6ffa64f8b8c43046a50905910c7720d844aa4da25c98599571", 0xf1}], 0x1, &(0x7f00000009c0), 0x0, 0xc000}], 0x2, 0x40000) setsockopt$packet_buf(r0, 0x107, 0x1000000000013, &(0x7f0000000040), 0x160) ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000000b00)) 2018/04/10 12:54:25 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xfeffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:25 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff020000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:25 executing program 7: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e21, 0xfffffffffffffffc, @mcast2={0xff, 0x2, [], 0x1}, 0x400}}, 0x6, 0x7}, &(0x7f00000000c0)=0x90) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000100)={r1, 0x4, 0x5, [0x7, 0x9, 0x4, 0xcb6a, 0x400]}, &(0x7f0000000140)=0x12) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000003000)='D', 0x1) getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000739ff1), &(0x7f0000003ffc)) 2018/04/10 12:54:25 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000003fff000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:25 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xff00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 937.032227] binder: 28387 RLIMIT_NICE not set [ 937.039578] binder: BINDER_SET_CONTEXT_MGR already set [ 937.039589] binder: 28378:28387 ioctl c0306201 20004000 returned -14 [ 937.054521] binder: 28378:28429 ioctl 40046207 0 returned -16 [ 937.065403] binder_alloc: 28378: binder_alloc_buf, no vma [ 937.071071] binder: 28378:28429 transaction failed 29189/-3, size 0-0 line 2963 [ 937.177593] binder: undelivered TRANSACTION_ERROR: 29189 [ 937.183808] binder: release 28378:28387 transaction 506 in, still active [ 937.190755] binder: send failed reply for transaction 506 to 28378:28429 [ 937.197657] binder: undelivered TRANSACTION_COMPLETE [ 937.202792] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:26 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0x2000000}}], 0x1, 0x0) 2018/04/10 12:54:26 executing program 7: r0 = socket$inet6(0xa, 0x10000000802, 0x88) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x7ff}, 0x1c) rmdir(&(0x7f0000000040)='./file0\x00') getsockopt$inet6_int(r0, 0x29, 0x1, &(0x7f0000000200), &(0x7f0000000140)=0x1) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x40001, 0x0) fallocate(r1, 0x10, 0x480100, 0x8000) ioctl$DRM_IOCTL_SET_MASTER(r1, 0x641e) 2018/04/10 12:54:26 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:26 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000ffffffef000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:26 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}}, 0x14) 2018/04/10 12:54:26 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xd000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:26 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xd400]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 937.277360] binder: 28438 RLIMIT_NICE not set 2018/04/10 12:54:26 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:26 executing program 7: r0 = socket$inet6(0xa, 0x10000000802, 0x88) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x7ff}, 0x1c) rmdir(&(0x7f0000000040)='./file0\x00') getsockopt$inet6_int(r0, 0x29, 0x1, &(0x7f0000000200), &(0x7f0000000140)=0x1) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x40001, 0x0) fallocate(r1, 0x10, 0x480100, 0x8000) ioctl$DRM_IOCTL_SET_MASTER(r1, 0x641e) 2018/04/10 12:54:26 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000401800000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:26 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xff000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:26 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x7e05], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:26 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000b9bff0)={0x2, 0x4e21, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfffffffffffffd90, 0x20020003, &(0x7f0000385ff0)={0x2, 0x20000000004e21, @loopback=0x7f000001}, 0x10) recvfrom$inet(r0, &(0x7f0000769f0f)=""/241, 0xf1, 0x10020, &(0x7f0000497ff0)={0x2, 0x800000000}, 0x10) shutdown(r0, 0x2) read(r0, &(0x7f00000001c0)=""/252, 0xfc) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x801, 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000ef7fcee95a8c545e66a9499ac1f8b2b12d1ea4046c19498dd48042b8e086b69758fb86cd9de74a86660534be08672a93353fddb14c330104000000000000e594e88f82be8a2161d56f6554d9c438c4fe1afa8878e8162c749fe77e002e409fe195a5915852a1c83b5722cb7199029150d06ea214d813e6a13c400f3a902075e2db1771a688b0ecea4278f2bd7c32249bf57cb066"], 0x6) recvfrom$inet(r0, &(0x7f00000004c0)=""/149, 0xffffffffffffff38, 0x10100, 0x0, 0x0) 2018/04/10 12:54:26 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3e8], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:26 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000003400000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 938.073758] binder: 28438 RLIMIT_NICE not set [ 938.080095] binder: 28436:28438 ioctl c0306201 20004000 returned -14 [ 938.080106] binder: BINDER_SET_CONTEXT_MGR already set [ 938.091977] binder: 28436:28483 ioctl 40046207 0 returned -16 [ 938.103125] binder_alloc: 28436: binder_alloc_buf, no vma [ 938.108783] binder: 28436:28483 transaction failed 29189/-3, size 0-0 line 2963 [ 938.220106] binder: undelivered TRANSACTION_ERROR: 29189 [ 938.225919] binder: release 28436:28438 transaction 509 in, still active [ 938.232823] binder: send failed reply for transaction 509 to 28436:28483 [ 938.239729] binder: undelivered TRANSACTION_COMPLETE [ 938.244863] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:27 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0xf000000}}], 0x1, 0x0) 2018/04/10 12:54:27 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xd}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:27 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:27 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000007fffffff00000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:27 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}, 0x14) 2018/04/10 12:54:27 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:27 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000b9bff0)={0x2, 0x4e21, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfffffffffffffd90, 0x20020003, &(0x7f0000385ff0)={0x2, 0x20000000004e21, @loopback=0x7f000001}, 0x10) recvfrom$inet(r0, &(0x7f0000769f0f)=""/241, 0xf1, 0x10020, &(0x7f0000497ff0)={0x2, 0x800000000}, 0x10) shutdown(r0, 0x2) read(r0, &(0x7f00000001c0)=""/252, 0xfc) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x801, 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000ef7fcee95a8c545e66a9499ac1f8b2b12d1ea4046c19498dd48042b8e086b69758fb86cd9de74a86660534be08672a93353fddb14c330104000000000000e594e88f82be8a2161d56f6554d9c438c4fe1afa8878e8162c749fe77e002e409fe195a5915852a1c83b5722cb7199029150d06ea214d813e6a13c400f3a902075e2db1771a688b0ecea4278f2bd7c32249bf57cb066"], 0x6) recvfrom$inet(r0, &(0x7f00000004c0)=""/149, 0xffffffffffffff38, 0x10100, 0x0, 0x0) [ 938.382444] binder: 28503 RLIMIT_NICE not set 2018/04/10 12:54:27 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xa605000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:27 executing program 7: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000013000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/cuse\x00', 0x404000, 0x0) syz_kvm_setup_cpu$x86(r3, r0, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000740)=[@text16={0x10, &(0x7f0000000700)="d9f21f2e672e0f01c90f20d86635080000000f22d80f01ee2ed9ea0f1800660fc7b0000064da59000fd2ff", 0x2b}], 0x1, 0x0, &(0x7f0000000780), 0x0) fcntl$lock(r1, 0x7, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1f, 0x722d, r2}) r4 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x4, 0x82040) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000140)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x180, 0xc0, 0x180, 0x0, 0x0, 0x460, 0x460, 0x460, 0x460, 0x460, 0x6, &(0x7f00000000c0), {[{{@uncond, 0x0, 0x98, 0xc0}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x1c0000000000000, 0x3}}}, {{@ip={@multicast2=0xe0000002, @rand_addr=0x40000000000000, 0xff, 0xffffff00, 'irlan0\x00', 'erspan0\x00', {}, {0xff}, 0x2f, 0x1}, 0x0, 0x98, 0xc0}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x3f}}}, {{@ip={@loopback=0x7f000001, @dev={0xac, 0x14, 0x14, 0x19}, 0xff, 0xffffffff, 'bcsf0\x00', 'bridge0\x00', {}, {0xff}, 0x7e, 0x0, 0xa}, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@ttl={0x28, 'ttl\x00', 0x0, {0x3, 0x3}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x1}}}, {{@ip={@rand_addr=0x5f, @remote={0xac, 0x14, 0x14, 0xbb}, 0xffffff00, 0xffffffff, 'gre0\x00', 'yam0\x00', {}, {0xff}, 0x21, 0x0, 0x1}, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x4}}]}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x27}}}, {{@ip={@multicast1=0xe0000001, @multicast1=0xe0000001, 0xffffffff, 0xffffffff, 'vlan0\x00', 'ip6gretap0\x00', {}, {0xff}, 0x6c, 0x1, 0x48}, 0x0, 0xe8, 0x110, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz1\x00', 0x7, 0xb, 0x2}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x2, 0x7f}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x558) fcntl$lock(r1, 0x7, &(0x7f0000603000)={0x0, 0x0, 0x0, 0x3}) 2018/04/10 12:54:27 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xffffffa4}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:27 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000200000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:27 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:27 executing program 7: r0 = perf_event_open(&(0x7f0000220000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCDELDLCI(0xffffffffffffffff, 0x8981, &(0x7f0000000080)={'lo\x00', 0x6}) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/qat_adf_ctl\x00', 0xb0400, 0x0) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000340)={0x8, 0x7, 0x0, 0x9, 0x20, 0x66}) r2 = shmget(0x3, 0x1000, 0x20, &(0x7f0000ffc000/0x1000)=nil) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000180)=""/108) r3 = memfd_create(&(0x7f0000000040)='\x00', 0x2) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f00000000c0)={0xdc6}) clone(0x0, &(0x7f0000000040), &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) mq_timedsend(r3, &(0x7f0000000240)="7f31f9c33f576559390e937ef55841900ac47d007c408e5ae60274c54c88c9e3cf0b8b23f56349d11a27bbd4749278f255d50e7c98eaef802481f30c0804b7105bf2bba576d4d0e2330e2a6135c7115488fa2b1415ad32c858588a7e43701a676ec77fe6abd486573775e73cc343b4580b634d809e3115ce4c83c75afb2ba7cd0159d31515594016c3f667d45f59b78c2e5aab6b9a523f3804c52d58b1bfd339cef7ede67232d1f1f8c1ca174d0d8579591b1d", 0xb3, 0xcf, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r3, 0x8040ae9f, &(0x7f0000000200)) 2018/04/10 12:54:27 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000500000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:27 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xa4ffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 939.177389] binder: 28503 RLIMIT_NICE not set [ 939.186332] binder: BINDER_SET_CONTEXT_MGR already set [ 939.192430] binder: 28499:28503 ioctl c0306201 20004000 returned -14 [ 939.198077] binder: 28499:28547 ioctl 40046207 0 returned -16 [ 939.210214] binder_alloc: 28499: binder_alloc_buf, no vma [ 939.215914] binder: 28499:28547 transaction failed 29189/-3, size 0-0 line 2963 [ 939.320304] binder: undelivered TRANSACTION_ERROR: 29189 [ 939.326500] binder: release 28499:28503 transaction 512 in, still active [ 939.333424] binder: send failed reply for transaction 512 to 28499:28547 [ 939.340351] binder: undelivered TRANSACTION_COMPLETE [ 939.345492] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:28 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0xa00}}], 0x1, 0x0) 2018/04/10 12:54:28 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:28 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000001840000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:28 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x14000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:28 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}}, 0x14) 2018/04/10 12:54:28 executing program 7: r0 = syz_open_dev$evdev(&(0x7f0000bfcfee)='/dev/input/event#\x00', 0x0, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)=0x4, 0x4) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000040)=""/168) 2018/04/10 12:54:28 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xb80b]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 939.445011] binder: 28567 RLIMIT_NICE not set 2018/04/10 12:54:28 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfe1f0020], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:28 executing program 7: r0 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x4, 0x444000) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e20, 0x1, @loopback={0x0, 0x1}, 0xe8a1}}}, &(0x7f00000002c0)=0x84) syz_open_dev$dspn(&(0x7f0000000380)='/dev/dsp#\x00', 0x1, 0x400000) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000300)={r1, 0x778, 0x30}, &(0x7f0000000340)=0xc) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa}, {0xa, 0x0, 0x0, @empty, 0x1}}, 0x5c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x40, &(0x7f0000001fde), 0x4) r3 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0xc9e7, 0x400) ioctl$DRM_IOCTL_ADD_CTX(r3, 0xc0086420, &(0x7f0000000180)) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0xa001, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r4, 0xc0f85403, &(0x7f0000000040)={{0xffffffffffffffff, 0x2, 0x462, 0x2, 0x5}, 0x7, 0x8, 'id1\x00', 'timer0\x00', 0x0, 0x101, 0x7, 0xc21, 0x1c0}) 2018/04/10 12:54:28 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xd00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:28 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000004018000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:28 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:28 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x1000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:28 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000ffffffef00000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:28 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x2000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 940.245369] binder: 28567 RLIMIT_NICE not set [ 940.252216] binder: 28557:28567 ioctl c0306201 20004000 returned -14 [ 940.252381] binder: BINDER_SET_CONTEXT_MGR already set [ 940.264176] binder: 28557:28610 ioctl 40046207 0 returned -16 [ 940.276261] binder_alloc: 28557: binder_alloc_buf, no vma [ 940.281964] binder: 28557:28610 transaction failed 29189/-3, size 0-0 line 2963 [ 940.391269] binder: undelivered TRANSACTION_ERROR: 29189 [ 940.397075] binder: release 28557:28567 transaction 515 in, still active [ 940.403987] binder: send failed reply for transaction 515 to 28557:28610 [ 940.410912] binder: undelivered TRANSACTION_COMPLETE [ 940.416059] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:29 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0xa}}], 0x1, 0x0) 2018/04/10 12:54:29 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x7e050000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:29 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @rand_addr=0xffffffffffffffff}, @icmp=@time_exceeded={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @dev={0xac, 0x14}}}}}}}, 0x0) r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x1, 0x20000) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{}, {}, {0x0}]}) ioctl$DRM_IOCTL_GET_CTX(r0, 0xc0086423, &(0x7f0000000100)={r1, 0x1}) 2018/04/10 12:54:29 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000003fff00000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:29 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffa4]}}, 0x14) 2018/04/10 12:54:29 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x14}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:29 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 940.510565] binder: 28627 RLIMIT_NICE not set 2018/04/10 12:54:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000dd3000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00005c8000)='/selinux/load\x00', 0x2, 0x0) r2 = syz_open_dev$dspn(&(0x7f00008f4ff6)='/dev/dsp#\x00', 0x7, 0x80) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000560000)={0x3, 0x0, 0x0, 0x7}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f00005a5000)={r3, 0x8}) syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x2) r4 = syz_open_dev$sg(&(0x7f0000000ff7)='/dev/sg#\x00', 0x0, 0x0) r5 = syz_open_dev$loop(&(0x7f000046dff5)='/dev/loop#\x00', 0xffd, 0x23fff) listen$netrom(r5, 0x3) r6 = creat(&(0x7f00003f1ff8)='./file0\x00', 0xc4) vmsplice(r0, &(0x7f0000222fd0)=[{&(0x7f00005e0f1c)="a63d0481c0a82141d542765b339093777320409445fe115ed10ca5e1eb57fb1bb67dbfeec616bbf2353503d3c129995ad677160b93637fe7bcada6f6e1289867ab5ad42d6bceeae5f2162560c07d1709f6e371942d5c717daa2633df629cf966bca11517bb7c0f9855952c5c64179baae436a94d0287e0777b8f77723676a9c131dbf124990d36684026c5f04c4674b02bfba3b9e86d2ffdd5b310abf7dd254e92d00aa63ec293aba52a4b0e378048dfd01a621f763bcc75570e7ce85fff57e5548adde58497c32282dc521568b3786772c9c303bdde9eb305c2c0f34b4de6812b338794", 0xe4}], 0x1, 0x2) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000895000)={0x7e}) perf_event_open(&(0x7f0000348f88)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = socket(0x1000000010, 0x802, 0x0) sendmsg$nl_route(r7, &(0x7f000070d000)={&(0x7f0000775000)={0x10}, 0xc, &(0x7f00002c9ff0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000000000000008000015dfcd1a97091e9e0000dbb982e609572d3c971eb1fe6e50da1adf2052d608501e7701000000ad8b167f320e9bd1ea539e336d3d2066e77f068fa0e76eb4fbebfaa49d19b42e967ce5030168f5dcc9c3608a3d1bb7a9f5726699d70e92b369876283728ef79055a8ec79b47245231b4bf37388264a2ca2d3490d5c0b87cf84eb9507e3d045940d47a300da6dfcb3a9edadcdfe9828a2b7582a8ab522beadfb47f1b1df4781efdcb8ec07fb13d012e70333bb127b0a9ef0a59679739bd3b05b2ae564a4845c2e9873060885fa056fa05c7ddbcf621ce14d450a9ca39dc34ed414e250a0855597c72572995f7f6625e42c1b02405e14ec82e3b7b178b298718b8a14edd55162171176ca24604eeb939eb6a5d194c94b2fd94e045e2cba9d3a8b75ac935d02545a634351b31901af98485ca30760c35084750cb63717d3f684a000ff09b0301d2cc2c76a825e352ced98d567e073f4"], 0x1c}, 0x1}, 0x0) perf_event_open(&(0x7f0000fdef88)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000000, &(0x7f0000000140)="64c7fbea8522b9", &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)="e0a99ce092438b06f6c6613b6b4cd8f6e3803f50640d2e588dad8813547c3d32d49b520ffcde8100b1c2ac0be88b9d19d1ba18247afc280619ce5fb7b5d68c6988ac2b65c1aa5a07779ba460cfdc65d7457549fead2f5681d1092578282c28d10719ecdc7058ff536f45eda90b5f88285a76fcd232d5cd62abed60a57c125f8e9057093ada7ed6357d93d622b3a600b7bf4e0f98d57b50de797d0525037af6610308fc960f757bc24c0978da5b") connect$unix(r2, &(0x7f00000000c0)=@file={0x1, './file1\x00'}, 0xa) ioctl$KVM_INTERRUPT(0xffffffffffffffff, 0x4004ae86, &(0x7f0000e2cffc)) ioctl$KDGKBSENT(r4, 0x4b48, &(0x7f0000053000)={0x7fff, 0x74, 0x7}) socketpair(0xa, 0x80000, 0x0, &(0x7f0000000040)) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f0000000080)=@generic={0x7, 0x46a2, 0x6}) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TIOCGWINSZ(r6, 0x5413, &(0x7f0000daeff8)) setsockopt$inet6_int(r8, 0x29, 0x100000000000c8, &(0x7f00005b8ffc)=0x20000, 0x4) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r8, 0x29, 0xd2, &(0x7f0000f04000)={{0xa, 0x4e20}, {0xa, 0x4e22}}, 0x5c) dup2(r6, r8) 2018/04/10 12:54:29 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:29 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000001000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:29 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x2}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:29 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20001ffe], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:29 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000002000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:29 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x1400000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:29 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x7e05000000000000], 0x1}, 0x5}, 0x1c) [ 941.309486] binder: 28627 RLIMIT_NICE not set [ 941.316240] binder: BINDER_SET_CONTEXT_MGR already set [ 941.320129] binder: 28626:28627 ioctl c0306201 20004000 returned -14 [ 941.329005] binder: 28626:28676 ioctl 40046207 0 returned -16 [ 941.340591] binder_alloc: 28626: binder_alloc_buf, no vma [ 941.346341] binder: 28626:28676 transaction failed 29189/-3, size 0-0 line 2963 [ 941.455302] binder: undelivered TRANSACTION_ERROR: 29189 [ 941.461140] binder: release 28626:28627 transaction 518 in, still active [ 941.468080] binder: send failed reply for transaction 518 to 28626:28676 [ 941.475090] binder: undelivered TRANSACTION_COMPLETE [ 941.480242] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:30 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0xffffff7f00000000}}], 0x1, 0x0) 2018/04/10 12:54:30 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000005000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:30 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x100000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:30 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5]}}, 0x14) 2018/04/10 12:54:30 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40030000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:30 executing program 7: r0 = signalfd4(0xffffffffffffff9c, &(0x7f0000000140)={0x5}, 0x8, 0x800) r1 = dup3(r0, 0xffffffffffffffff, 0x80000) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000200)=0x0) prlimit64(r2, 0xd, &(0x7f0000000240)={0x2}, &(0x7f0000000280)) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000040)={{0xa, 0x4e24, 0x4, @empty, 0x1}, {0xa, 0x4e20, 0x7f, @dev={0xfe, 0x80, [], 0xe}, 0x8000}, 0x1c, [0x5, 0x5, 0x5, 0x20, 0x100010, 0x80000001, 0x3c64, 0x2]}, 0x5c) perf_event_open(&(0x7f0000348f88)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0xfffffffffffffffd, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, 0x6f48, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipx_SIOCAIPXPRISLT(r1, 0x89e1, &(0x7f0000000300)=0x9) prlimit64(0x0, 0x7, &(0x7f00000000c0), &(0x7f0000000100)) getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x4) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x1a}) userfaultfd(0x0) 2018/04/10 12:54:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:30 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x900], 0x1}, 0x5}, 0x1c) [ 941.595624] binder: 28690 RLIMIT_NICE not set 2018/04/10 12:54:30 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:30 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000002000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:30 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x200000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:30 executing program 7: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) mmap(&(0x7f0000000000/0xeef000)=nil, 0xeef000, 0x4, 0x810000032, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x0, 0x10000) connect$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x476c6cbe, {0x9d, 0x9, 0x0, 0x100000001, 0x1, 0x3}, 0x8, 0x3}, 0xe) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000040)={0x0, 0xfffffffffffffffe}, &(0x7f0000000000)=0x8) r3 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x42000) setsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={r2, 0x4}, 0x8) 2018/04/10 12:54:30 executing program 7: recvmmsg(0xffffffffffffffff, &(0x7f0000003d80)=[{{&(0x7f0000000100)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)=""/60, 0x3c}], 0x1, &(0x7f0000000280)=""/4096, 0x1000, 0x7}, 0xfffffffffffffffd}, {{&(0x7f0000001280)=@pppol2tp={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @remote}}}, 0x80, &(0x7f0000002300)=[{&(0x7f0000001300)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0xfffffffffffffff8}, 0x9}, {{&(0x7f0000002340)=@alg, 0x80, &(0x7f00000038c0)=[{&(0x7f00000023c0)=""/232, 0xe8}, {&(0x7f00000024c0)=""/96, 0x60}, {&(0x7f0000002540)=""/129, 0x81}, {&(0x7f0000002600)=""/91, 0x5b}, {&(0x7f0000002680)=""/26, 0x1a}, {&(0x7f00000026c0)=""/40, 0x28}, {&(0x7f0000002700)=""/129, 0x81}, {&(0x7f00000027c0)=""/199, 0xc7}, {&(0x7f00000028c0)=""/4096, 0x1000}], 0x9, &(0x7f0000003980)=""/109, 0x6d, 0x1f}, 0xffff}, {{&(0x7f0000003a00)=@sco, 0x80, &(0x7f0000003cc0)=[{&(0x7f0000003a80)=""/233, 0xe9}, {&(0x7f0000003b80)=""/30, 0x1e}, {&(0x7f0000003bc0)=""/220, 0xdc}], 0x3, &(0x7f0000003d00)=""/85, 0x55, 0xb6}, 0x2}], 0x4, 0x40000000, &(0x7f0000003e80)={0x0, 0x989680}) r2 = accept(r1, &(0x7f0000003ec0)=@can, &(0x7f00000000c0)=0x80) getsockopt$ipx_IPX_TYPE(r2, 0x100, 0x1, &(0x7f0000000200), &(0x7f00000001c0)=0xffffffffffffff06) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000000)={0x0, 0x2d, "9c7bcbec0dedae94e1d63fccc010724b440d48df3e8bfba083143f8c4862af7e67dbee60c4b01298b359164416"}, &(0x7f0000000040)=0x35) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000080)={r3, 0x1}, 0x8) 2018/04/10 12:54:30 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:30 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}}, 0x14) 2018/04/10 12:54:30 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x1400}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 942.390191] binder: 28690 RLIMIT_NICE not set [ 942.395729] binder: 28688:28690 ioctl c0306201 20004000 returned -14 [ 942.395732] binder: BINDER_SET_CONTEXT_MGR already set [ 942.395747] binder: 28688:28735 ioctl 40046207 0 returned -16 [ 942.418732] binder_alloc: 28688: binder_alloc_buf, no vma [ 942.424462] binder: 28688:28735 transaction failed 29189/-3, size 0-0 line 2963 [ 942.530446] binder: undelivered TRANSACTION_ERROR: 29189 [ 942.536287] binder: release 28688:28690 transaction 521 in, still active [ 942.543324] binder: send failed reply for transaction 521 to 28688:28735 [ 942.550317] binder: undelivered TRANSACTION_COMPLETE [ 942.555463] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:31 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0x1100000000000000}}], 0x1, 0x0) 2018/04/10 12:54:31 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000003000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:31 executing program 7: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000480)=@acquire={0x128, 0x17, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000001}, @in6=@ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14}}, {@in=@loopback=0x7f000001, @in6=@local={0xfe, 0x80, [], 0xaa}}, {{@in=@rand_addr, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x2}}}}, 0x128}, 0x1}, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0xc0, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000080)={0x0, 0x2}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000100)={r2, 0x6}, &(0x7f0000000140)=0x8) 2018/04/10 12:54:31 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xf401], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:31 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xd00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:31 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}, 0x14) 2018/04/10 12:54:31 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0xfdfdffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:31 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xe00], 0x1}, 0x5}, 0x1c) [ 942.670488] binder: 28753 RLIMIT_NICE not set 2018/04/10 12:54:31 executing program 7: r0 = socket(0x10, 0x802, 0xffffffffffff3d62) write(r0, &(0x7f0000000100)="240000001a0025f0001b000400edfc0e1c0b0500000000001009ffeb0800010000080100", 0x24) 2018/04/10 12:54:31 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0xfeffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:31 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000ff3f000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:31 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:31 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00001f3fa8)={0x26, 'hash\x00', 0x0, 0x0, "6d6434001000"}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000004a80)=[{{&(0x7f0000001bc0)=@generic, 0x80, &(0x7f0000003180)=[{&(0x7f0000001d40)=""/224, 0xe0}], 0x1, &(0x7f0000003200)=""/218, 0xda}}], 0x1, 0x40, &(0x7f0000004c00)={0x0, 0x1c9c380}) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) 2018/04/10 12:54:31 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xd00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:31 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000], 0x1}, 0x5}, 0x1c) [ 943.466238] binder: 28753 RLIMIT_NICE not set [ 943.472629] binder: BINDER_SET_CONTEXT_MGR already set [ 943.474124] binder: 28747:28753 ioctl c0306201 20004000 returned -14 [ 943.482822] binder: 28747:28795 ioctl 40046207 0 returned -16 [ 943.494617] binder_alloc: 28747: binder_alloc_buf, no vma [ 943.500324] binder: 28747:28795 transaction failed 29189/-3, size 0-0 line 2963 [ 943.610885] binder: undelivered TRANSACTION_ERROR: 29189 [ 943.616500] binder: release 28747:28753 transaction 524 in, still active [ 943.623435] binder: send failed reply for transaction 524 to 28747:28795 [ 943.630340] binder: undelivered TRANSACTION_COMPLETE [ 943.635478] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:32 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0x1000000}}], 0x1, 0x0) 2018/04/10 12:54:32 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000040030000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:32 executing program 7: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net\x00', 0x200002, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1a}}}, 0x2, 0xf56b, 0x9, "03b68b5ca2f646e4c52ea7b2a29cec299a49440b1d392eeea0565b2069afa5d1700774d09280ed23c8931b8a40687c7dfe0218db1ca8f8aa6392e695795740a4bdd2962c0659949ddaf44315c47256ff"}, 0xd8) 2018/04/10 12:54:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff02000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:32 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000]}}, 0x14) 2018/04/10 12:54:32 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xff00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:32 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0xfffffdfd, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:32 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x1400000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 943.753151] binder: 28808 RLIMIT_NICE not set 2018/04/10 12:54:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:32 executing program 7: mmap(&(0x7f0000000000/0xff7000)=nil, 0xff7000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = dup(0xffffffffffffff9c) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f00000003c0), 0x4) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000080)="ed308a70b732cd8dd8749fe0b3e7c09552646e675d012a249418c9aa3cfe5dd53509e9c688304d3ee8cd6d7c468f") r2 = socket(0x40000000015, 0x5, 0x0) fcntl$getown(r0, 0x9) setsockopt(r2, 0x114, 0x1d, &(0x7f0000000000)="2a8e339c", 0x4) 2018/04/10 12:54:32 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000007fffffff000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:32 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x1000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:32 executing program 7: r0 = socket$inet(0x2, 0x200000000000003, 0x9) bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast2=0xe0000002}, 0x10) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x40) r2 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x7, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f00000000c0)=r2) syz_emit_ethernet(0x3e, &(0x7f00005b1000)={@link_local={0x1, 0x80, 0xc2}, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x9, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) 2018/04/10 12:54:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xf4010000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:32 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000034000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 944.556762] binder: 28808 RLIMIT_NICE not set [ 944.562948] binder: 28806:28808 ioctl c0306201 20004000 returned -14 [ 944.562962] binder: BINDER_SET_CONTEXT_MGR already set [ 944.574903] binder: 28806:28855 ioctl 40046207 0 returned -16 [ 944.585681] binder_alloc: 28806: binder_alloc_buf, no vma [ 944.591358] binder: 28806:28855 transaction failed 29189/-3, size 0-0 line 2963 [ 944.696375] binder: undelivered TRANSACTION_ERROR: 29189 [ 944.702012] binder: release 28806:28808 transaction 527 in, still active [ 944.708979] binder: send failed reply for transaction 527 to 28806:28855 [ 944.715900] binder: undelivered TRANSACTION_COMPLETE [ 944.721080] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:33 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0xffffff7f}}], 0x1, 0x0) 2018/04/10 12:54:33 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00006a4ff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$FIONREAD(r3, 0x541b, &(0x7f00000000c0)) r5 = dup3(r2, r4, 0x80000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000decfe0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r5, 0x8040ae9f, &(0x7f0000000640)) getsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000040), &(0x7f0000000080)=0x4) 2018/04/10 12:54:33 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xff00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:33 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000ffffffff000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:33 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xeffdffff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:33 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x14) 2018/04/10 12:54:33 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4010000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x7ffffffff000, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:33 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5], 0x1}, 0x5}, 0x1c) [ 944.828352] binder: 28875 RLIMIT_NICE not set 2018/04/10 12:54:33 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x5a6], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:33 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000004000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:33 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xffffffa4}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:33 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x400000000000001) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000180)=0x7) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_flowlabel\x00') ioctl$EVIOCGABS3F(r3, 0x8018457f, &(0x7f00000001c0)=""/215) connect(r3, &(0x7f00000000c0)=@pptp={0x18, 0x2, {0x2}}, 0x80) pread64(r2, &(0x7f00000004c0)=""/162, 0xa2, 0x0) sendfile(0xffffffffffffffff, r3, &(0x7f0000000080), 0x10ed5b) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000340)=@ioapic={0x2, 0x0, 0x0, 0x0, 0x0, [{0x489}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x4}]}) ioctl$KVM_ENABLE_CAP(r3, 0x4068aea3, &(0x7f0000000440)={0x79, 0x0, [0x19, 0xa052, 0x6, 0x6]}) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000140)={0x5}, 0x4) epoll_pwait(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0xfffffffffffffffa, &(0x7f00000000c0)={0x6f}, 0x8) getsockopt$inet6_tcp_int(r3, 0x6, 0x17, &(0x7f0000000300), &(0x7f0000000580)=0x4) write$rdma_cm(r3, &(0x7f00000008c0)=ANY=[@ANYBLOB="c151740eb2330b0681d8dad3d1be2f02818001920948e66e31bde0e878a147b6bca19fc7f0000000000000c2a5ac0d4ec934245aef00000000ce3243037573be885b08dcd5809e089e9a5eb1d129dd3035759c2be26855f971abdb11e3e77fbd27fe50e3e0780ccbae16c619f0a16bf4094abef9e84daf0700a9c6e9a5c8fe63e4221f16d391a80b70622f17cec82dd095933744a46f7d3acc66ecfa13012bd545fb29467bb5ecceb0da2f101584a1d7bfcca5dfe314a10b7420d363cc8df1c9727799dfb896ac009948a696593cb3550c5f45c5225de58578e6c3b7de5d3751dac4be599687e95fa6466a542640fbdc5d4f8e4b6bf70a8012b1cc71bd5da58849742b86feb318cf71bf998fa3244830dc73985ca6b29a4883c0f2ae2f5953d6c7f2ce36ca5ad72a3f6881f9de96256bbe5a425640daa075c825a82d4fb0101baf170000"], 0x143) r4 = getpgid(0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000680)={0x0, 0x0, [0xaa, 0x24c0, 0x9, 0x4]}) tkill(r4, 0x5) syz_open_dev$sndpcmp(&(0x7f00000002c0)='/dev/snd/pcmC#D#p\x00', 0x1, 0x400) eventfd2(0x3f, 0x0) 2018/04/10 12:54:33 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xffff0000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:33 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000300000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:33 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xfffffffe}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 945.617302] binder: 28875 RLIMIT_NICE not set [ 945.625174] binder: BINDER_SET_CONTEXT_MGR already set [ 945.630821] binder: 28864:28875 ioctl c0306201 20004000 returned -14 [ 945.634107] binder: 28864:28913 ioctl 40046207 0 returned -16 [ 945.648120] binder_alloc: 28864: binder_alloc_buf, no vma [ 945.653781] binder: 28864:28913 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:54:34 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x200000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:34 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0xf00}}], 0x1, 0x0) 2018/04/10 12:54:34 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xe803], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:34 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}}, 0x14) 2018/04/10 12:54:34 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000400000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:34 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0xfdfdffff00000000, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:34 executing program 7: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000fa8fe4)={0xa, 0x4e23}, 0x1c) connect$inet6(r0, &(0x7f000098cfe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0xfffffcb1) readv(r0, &(0x7f0000000240)=[{&(0x7f00000007c0)=""/4096, 0x1000}], 0x1) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000040)=0x8, 0x4) r1 = dup(r0) gettid() write$eventfd(r1, &(0x7f0000605ff8), 0x101bc) [ 945.759232] binder: undelivered TRANSACTION_ERROR: 29189 [ 945.766218] binder: release 28864:28875 transaction 530 in, still active [ 945.773174] binder: send failed reply for transaction 530 to 28864:28913 [ 945.780096] binder: undelivered TRANSACTION_COMPLETE [ 945.785241] binder: undelivered TRANSACTION_ERROR: 29189 [ 945.861445] binder: 28932 RLIMIT_NICE not set 2018/04/10 12:54:34 executing program 7: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='loginuid\x00') read(r0, &(0x7f0000000100)=""/4096, 0x1000) writev(r0, &(0x7f0000001240)=[{&(0x7f0000002400)='<', 0x1}], 0x1) r1 = socket$inet6(0xa, 0x2000000000003, 0x3) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000001100)={0x0, 0x9, 0x101}, &(0x7f0000001140)=0x10) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000001180)={r2, 0x0, 0x1, 0x1000, 0x7, 0xffffffffffff5783}, 0x14) setsockopt$inet_tcp_int(r1, 0x6, 0xe, &(0x7f0000708ffc), 0x4) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x1000}, &(0x7f0000000040)=0x10) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000001280)={0x1, 0x1000, "1b2f91aeb5618dfffc5ebbdb16f909063e58d3e9df4afebc07474a2d781ba6ec4a5239ac2d3b529c4e2d275949433f57625dbb067847c8b3e0f51af96ed3379ddb354e24611e10f9783cd77ea24e217f02a22344766d60a64cdbf15e5168c3688a9dce675d2568505122d1f897065da19460fb707571d32b3f5e43509fd92ea4d662010ec3afacb9576c16c476b74d3cd6d8eddb112651796ece6a930afc60d6d6c5504b059e4a26dcf7dcec972ea5c0be40a96d13314607710a176fd9742116cc8765e99f5b8377d5e94abf9a5a49f9d9d22efa37ef072ade39e13d82974073abafa847207d9ce5bf7374fd808e96bdb2560d844da5d4b89a6f6afa7ce0c747805d3f4575cbd73f474930cca866be973f4077c28b29fae9a6aef9035ed7ebb735986baab1d2183487611f746ce09ca0cb8f6b80bc877da9dd28cd9c216fec6ca7126ed6b68f17d5ce53708848a697de0f1fc35c63034912f8ca3361eeb8bfaeded30d06e7567c94774d843f6576b2135c3464e03d5012986f24f577c01e224e84d858f9bc5ff539072ffd305cf369618e45938c415025c2775fb5ea13bf277000965ee56060bdd863cd75b0751f08d38fa117d6bd9000fee61e8261e812cd31380ab5cf1501461b4c9c5e91cb91439a4425348e97ee1d889abefb7de1b7c699b9e44fc1146cba6616367777b15e5b0598226f4a6800dfded5dd5ac81a7f8cbee46fc30fbb3f923df84a7c393caf98aea1f5dbc6652113cfbf946cf035eaa8e4c4a02fc1335bca8176d6d14b7eb026b5d904d23268395a3acec02354a0d66db2b17380c1c629b6f50a07c8f64238d27e67643fc6816fd8adedcb8b16ae5042b30da0ce79bdf0034671b4a64a5af7bffe07b2bced50e51383dbc17afc5a0c63fc6696e1921c90ec60c5977d3fbb007684ac40dfd0408513d62e22296b0393914496dd6af4ab514a9efe4fde5838343f2a1224dad452c1070ab3552cc719398792705d0975fc26e15221b7171a6845b36292337b2b41e92d867a8fecfe6afa3519fd4633f73e43a875f4b08272352ef49c71a6bf61e865e6283481c98273123531cbe86d75e8b327bbd6b1c9f2f6bf3f4afe8edcd741014703480fb955ae5dc6643507de7a22e899e8b90a53064b7ee481b7f39a66b13a85a8ba571353e3bf23d265824cf3b0051e1aad42bea3e237941f09bef8cd669be25164750245d7097f53dca6a9b59258af1ff61d97347c6ce782f4856259a2b8d9a9f56ab8042245aef497735c6dbf691a9ae5fa35e6ddf7ad2e8cd1169d199a3ac98893339faea76c1d971b16955f575be12a9fab71129b72a0645a39cdf7f464436932b0cc10f7e31dfe202ac12bcf557e573894923dcb4de4c7d53e46c60fbe5077162ed8398a94383aeb2d378b372334b577bf48f1d35bc45f90d2744864051fd4a99a95325d9ef532d08c1fc2a53d4af6aa313fa27be5c5d3e3bf2b06e9b10dda5913b205c4f07854b45ef2d9871d939fa6a184e6f1f80a8a69967569407133a6b48734be11179e6507b5aed36ba09cdf32cfc5b23ec4bbf4d5ccb5f38fe4f4f7080ad8236ff6788eccceb30df9d8da9be1ae3ef56fb72048b76d0fd7a5286eb3620ecd1e2551ac22234695b56c39507fc6b537b548fb88f969a5c5a619a3e85b094fd6bd4aa95fa20c93ddc7cf9044d1518a75d78026d381d7e19805380448acb5b659c2544f7f4032d3f7bdfa3ad5f70f7d0ac3cff6ead0ba0d7ba73e52313fd234ef9fa1c7b37aa8675bd7b27084e8f455e9d8af0e41781abc6dbd9e0d5257dee3c3dc8318f1a1ca847dc69202046fb201d2ca7188b11a0ca4dee1c9b0f19f23714a79290e5623dc58bc51e73cd2c4f1747bf7b82682accfe09fdb060d98228ca40c7f1c0bf550bd61d4b911b565e32927bc63b2ae894524689e13ba93d51da9b542d7e76f8fa4624bb5681b4bbba5c0fb019762b9f5066ba40fb554fc20ea54365c9bbbd4ed2726328ff8708de17806695a4b02a709a0bc8af7d03a15f3a7931998f6d81a610a455c55cac533512a19ad320e5169b31e9adaf978a921f5b9d397627f57d4027a2b8c73f1b457fb6644e933c6aad74305a38b75af97a42f3fb0149f5072c48d5d2c28cce5c2d9382c75b911e64cd05385914680f6127cf9181b94039144cda65d8faf1cc4187f37f10350f55f4e237c4bdb987c712ad56b371f7f12caad8f86d245ced0ae3748082933b5af16c60ed62b62231ecb1038b3e9f3c9ad068cf0616dd9076bd6fe3bc310e2d596dfdae06b852332a938bf308a0f7ebe591901a8e059d1442a4451048a7f4fe957bebcac4272648d519f19282514b87200c687db0da9645e7d97d2e89cc78bd91d4e93c65e57be9c9bcf69a33496003b276b63a00c10566a5d6370d7f5267759cbd6bb940f36d6fa50e5afb92b5935f1d0a104c9f880ec4de7f35083bcd668118cd237781cbae83a631919220b5e751107581756f9664c3940e2e8e724f5f5e7c9e74cfabef603f1cee689aa34417b4c765b8fab725f186e0d5086574e4aa3916c84b7184f7d3f27b454c9612ceca75d134aafce64af1fd35677acffcd7ab42a43e2c1985f41dfc0760e006888da5e225551de79897f93bdfad13b9520a83fdca15d15ce687b2946c509e45092a2f3a6b119f8cc823609a1f83b3ac3a03c115089cba1b3c2edfeb025f4f442a3adf19a6281cd12cf1ecb20df38dbeced1688346ab8ec0a87dd89043a83a56b0a286b9859395a89171cb89255ac84ce875dbdbc9eda1aede53179f47e18f645f59fdcb930b3464a3971818c636b306a5eeb543689325af9d06424fc023cef716e110cc5ad48a624a043ec7732d3a7fb9b11c7cf5d09ff20f7b6f144097bf7dc8fb70f8edea202ad04045359bc9419dad54eeead5ac7c543c90c3a12e6b6717c1121e10511c358ba937a09b31969abc5c870d6da23bd21f3d4083b9483ee1bdc3f7d8e537ab5a74ef58c69aca538e83995fe937008a12131ff1ac514b30d4e34ae3c3c436de62abb2cf82b460bdd891c4296f3e906003d75185ecf86132311a5fabfbc231b375b278507bcce5e5d3cfc6cd763a0b0298fa33e3141eaebef718ed6e1df363af7a94e7860e5f4db38be687bedfd0277331ac60e3a4f61ca14dd0ede051c17d5a083fa47b676a438cf1c81c545893378ed5f88bd9dffd22b7c94557f175e55fc100e68a234c2a193d5248b38faeb2a14410e057b5edf88479c77db919b4dee3bc0aa0c314d214ea77a53ed030611db65993611e3dbffa33e6c4d45340a3fbe4e5e90bec3b65a2105373a2e5279336ed7493b75747bb56dcc338cb6233d82dd333b141b5a20417b766bd53fd13565573bc6af6545f87e38922ee31d7b104a09cc984d93911789d2643a649c7f51cea9c825ff79386b20e09ad53fb508e9f30633b5cfa124373125fdbf22df20afe9ff06dccfbb6865c832dd5ec5c5d7cbfab8f28ea31822d1ef3cbc2785913615bd81934fc612caa2a7aafebf89510b6f94af1c70009dfd18dc489d05d87d4bef56a5e3775445e845669c992c12c02eb6dfecb445002fa789bede0b0669826c074bc90de91b95462c38fc2438412fb4a49244636fca252134f03534cc6afe394f58ecc955ae903daa419f669ec0488ddfc0418eabe470836567620f6fd7ac308940c8f1a8576022e7b25c5ef5a9a9405f3fe1b67d6ddbb861f3e841742e27c8ea0ddfe7325c0bd14b644bf76e4865f7e1c343f93e74b46999513bccac09b86b6abda4d091db16a0cb2a7089d6b675be6056df6c21df92f4421f3949469a0726dec417c354a8a3a95fccb513189b625cae0264b4ad2bc447d1126e6bc5985ac36a3b035a13c0a233e8e6a34a0a5b33ce73592b67be0bf20af6e8b28887dbcce7fe589ab059e518fccc9eef6bafabd33d071271dd3e9ed94da414c4f9d6297f989257901543e93f60e973aace7d9440634c3e85c1b73793f62b211335e3a1bc1db1a60a787e36d8607195bb4a12db480455672e8c4c50f547b44f796f831f858d1612392fed34a10e823893dfa4c556c38fde3dd90011fa95e58845328280e1a32b895322c483e93998e93a84b84fc0c316d948a0913f8d58f2990bc64a5c4c6c08bc28dc304f5790683d90a71af13dc2ab290c0261509ecdfaed2fa8c40509eff2cf2d28a896540eaab0eb6cd5fdbd45a9bcf753d76f02c3ebdb4221e9576d97c1053e2b641371bdc509a59d4ee2146b0d74089ca7a652b9bcbb4addaea7da849c1c21516738445e2ad78288c83de4b6db048c4f7ffa09502df29bae8e8ecb822707194eacf9073f16d7f123be9b004b924a491eb85c0c104f262fd1540ecb5521cdd2d587c902359dd61fd3bf34ac2cb160c37a781c33f13cb933c0239027385afb4aa5e092383aad50e8a682444e3c6d02c77f2f1cdb2bcc6143994827315e0f58ec26f5955726cee2ad7d73b234863570edc3eceaa51d2ace1e07efb7890f1c02a29e4e227c38999200a98693e92c2c494ad3c0a0d2bcf8cb4cff7ec622c603731bb55ac173867f574b24516d45682ed385ab96844fb60192f1609bfdc5a85388a32aafe3414d2737d2b1694f4f4e5a05ff7c9f187d0a0f00d652a6064e7e29b2459a77be461ee32d44219424663bdb7b894231f92d877d6421c822d064c37af3c8e1f822a3681ce305b34af1ea79858cbbc7797141d9518442b7bc195e6b8795a45cdf5a90f4f6f2703a2d87dc3eae4c3590e17ad3f81e505fa7ae8b1caa854b101c5f9118ff8f2b25e26bf6cd2f4accd88943badfdd4f7249bed001dce094fd170b686e7dc59e7630c12e898a7d9c951aa35e888b8248e117911e30cfe62d3fe86cf9c54b16b3e51930e238bbde774a8eefee43693187130184c80c21ff3f6579380762ae55f48baaf1c4d58ab2a5404d1bc65457580fc489cea5331171f282f54a2e80bee79f3c16aaaf5bc1db819c2935693c3b33e733fd1d0db6bb570b83e130ccf7a9e647a0a8f044e4c9f9a835b4a6ea168b400c13d509279d13580a09a432d88508d73769d0f6c5e0160d7f7246a051fae68f445f04ef0bb788ac7fc4b81fdaeb2e06e3f622919ad0846cdf8f314b0332144daf41d01ee1070c795ad09d9dc925d8fecfa0d827e49242f8af119b901668e146f22adab4703679f436641a84834bf9f6b441960859d04d6e2ade1ccf67757fcdebce4884cff9deac4b6e6ba16c60be285968b5d7c6cb5c8047f0ba61882cb687d0e7a53cc1097015dac2ef6f81277e17816fba84c816498f0106e5a854e38d7bb63824f318f633990b916742b01d7b253abc42fd80dab947e2e045e234d39ee8b6be430661396bdddd243a7757e674d5c6e8dc84b1f7e2e7a15657a2d09fb4a1b1949f26b666abcd6cc3eb0f685d9c0a98573826776c06422c8fb43bb6273b096929c96cf48b886996239cf58392480ec616106d3e5a06e3b17f40573857f53e07b948c998e84fae1e2429a90a4a50f77af46364434843e7f4e412ce97f6ac5662f069faf74955bcec77f293b3bad1fe29f7de24a55bb0ff80f12b94f6c4244b7bf7f85322b83bd404cf3bfb2af86a76c05b09750cac378df981ff4c1c3f59dc79b80f6363e375e2cc580c19f2a02c45b3f5c911338e38bbe2b34b33296104ce8acb2e8a86a4f7dd8c19114e17d2a82cf2e7f9527ca374d02f2534c5cb3ca0c307524e612d50c0e687cb4c3ea780ea51cdcfef253e1d17e2286c1329bbc117fce9c76ca591d3f6214d1a8e5e047ff4a92c5b8564fb4119500dbadeb263bfb6ab"}) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000180)=0x40, 0x4) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000080)={r3, @in={{0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x1, 0xfffffffffffffffc}, &(0x7f0000000140)=0x90) 2018/04/10 12:54:34 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdef], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:34 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000040180008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 946.664765] binder: 28932 RLIMIT_NICE not set [ 946.671224] binder: BINDER_SET_CONTEXT_MGR already set [ 946.676693] binder: 28928:28932 ioctl c0306201 20004000 returned -14 [ 946.677116] binder: 28928:28955 ioctl 40046207 0 returned -16 [ 946.697166] binder_alloc: 28928: binder_alloc_buf, no vma [ 946.702831] binder: 28928:28955 transaction failed 29189/-3, size 0-0 line 2963 [ 946.810509] binder: undelivered TRANSACTION_ERROR: 29189 [ 946.816114] binder: release 28928:28932 transaction 533 in, still active [ 946.823059] binder: send failed reply for transaction 533 to 28928:28955 [ 946.829972] binder: undelivered TRANSACTION_COMPLETE [ 946.835158] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:35 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xa4ffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:35 executing program 7: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x3, &(0x7f000000b000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffff85, 0x10}, [], {0x95}}, &(0x7f00000000c0)='syzkaller\x00', 0xfffffffffffffffe, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x8, 0x501001) getpeername$packet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000100)=0x14) socketpair$inet6(0xa, 0x80002, 0x8000, &(0x7f0000000140)) r2 = dup3(r0, r0, 0x0) setsockopt$inet_dccp_int(r2, 0x21, 0x0, &(0x7f0000000000)=0x6, 0x4) 2018/04/10 12:54:35 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:35 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000040008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:35 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000]}}, 0x14) 2018/04/10 12:54:35 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:35 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0xf}}], 0x1, 0x0) 2018/04/10 12:54:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0xf0ffffff7f0000, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:35 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc0], 0x1}, 0x5}, 0x1c) [ 946.950988] binder: 28976 RLIMIT_NICE not set 2018/04/10 12:54:35 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup2(r2, r2) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000d00)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000d40)={0x0, 0x0}, &(0x7f0000000d80)=0xc) r6 = getegid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000dc0)=0x0) lstat(&(0x7f0000000e00)='./file0\x00', &(0x7f0000000e40)={0x0, 0x0, 0x0, 0x0, 0x0}) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x29, @mcast1={0xff, 0x1, [], 0x1}, 0x9}, 0x1c) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000080)) stat(&(0x7f0000000ec0)='./file0\x00', &(0x7f0000000f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = getpid() stat(&(0x7f0000000f80)='./file0\x00', &(0x7f0000000fc0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000001040), &(0x7f0000001080)=0x0, &(0x7f00000010c0)) r13 = getpid() fstat(r1, &(0x7f0000001100)={0x0, 0x0, 0x0, 0x0, 0x0}) r15 = getegid() sendmsg$unix(r3, &(0x7f0000001200)={&(0x7f0000000b40)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000cc0)=[{&(0x7f0000000bc0)="898635b23294452e4037b0eca7948c181e49e51506e15368be357fab0383efd17ed660f3582f4ebacfe233715da022b4437675f7089accdda5d4cc1390a9360c889edcbb6377edf8cb289bd6d6a8102c6e9a2545e311baaf04904a5d7563d3c08b66207b735542408ddf25887e36bf0e1cf5bd33c0ff1a777065b5be1e4ba01ae74cd73d4c61c89de6fa9cde53d20f164fb24e95f9ac03604a", 0x99}, {&(0x7f0000000c80)="94a36fd2b00874f53f96a717f1f7a413712d0e5fef04af777684e948413ee6e3e07f66deb23b1f8df7a26d9d60e4", 0x2e}], 0x2, &(0x7f0000001180)=[@cred={0x20, 0x1, 0x2, r4, r5, r6}, @cred={0x20, 0x1, 0x2, r7, r8, r9}, @cred={0x20, 0x1, 0x2, r10, r11, r12}, @cred={0x20, 0x1, 0x2, r13, r14, r15}], 0x80, 0x840}, 0x40000) mmap(&(0x7f0000000000/0xff7000)=nil, 0xff7000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0xc028ae92, &(0x7f0000000000)) 2018/04/10 12:54:35 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x1400}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:35 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000007fffffff000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:35 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xe803000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:35 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x2}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:35 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000002000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:35 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:35 executing program 7: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000384ff7)='/dev/ppp\x00', 0x101005, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000000)={0xff, 0x4, 0x7f, 0x7f, 0x0}, &(0x7f0000000040)=0x10) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'yam0\x00', 0x1000}) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000080)={r1, 0x3}, &(0x7f00000000c0)=0x8) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f000082ef0a)=""/246) pwritev(r0, &(0x7f0000cdcfe0)=[{&(0x7f0000b20000)="80fdb1000000", 0x6}], 0x1, 0x0) 2018/04/10 12:54:35 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xd}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:36 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000efffffff000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:36 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xa00], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:36 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}}, 0x14) [ 947.754207] binder: 28976 RLIMIT_NICE not set [ 947.760466] binder: 28972:28976 ioctl c0306201 20004000 returned -14 [ 947.760529] binder: BINDER_SET_CONTEXT_MGR already set [ 947.776090] binder: 28972:29031 ioctl 40046207 0 returned -16 [ 947.792280] binder_alloc: 28972: binder_alloc_buf, no vma [ 947.798082] binder: 28972:29031 transaction failed 29189/-3, size 0-0 line 2963 [ 947.901958] binder: undelivered TRANSACTION_ERROR: 29189 [ 947.907729] binder: release 28972:28976 transaction 536 in, still active [ 947.914686] binder: send failed reply for transaction 536 to 28972:29031 [ 947.921598] binder: undelivered TRANSACTION_COMPLETE [ 947.926780] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:36 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdffffff]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:36 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340), 0x0, 0x11}}], 0x1, 0x0) 2018/04/10 12:54:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x100000000000000, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:36 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:36 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000018400000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:36 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x14}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:36 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff00000000]}}, 0x14) 2018/04/10 12:54:36 executing program 7: r0 = syz_open_dev$vcsa(&(0x7f0000e2b000)='/dev/vcsa#\x00', 0xc81, 0x1) write$eventfd(r0, &(0x7f0000fdfffb), 0x5) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000580)=0x0) getresuid(&(0x7f00000005c0)=0x0, &(0x7f0000000600), &(0x7f00000008c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000900)={0x0, 0x0, 0x0}, &(0x7f0000000940)=0xc) r4 = gettid() getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000980)={{{@in=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000a80)=0xe8) lstat(&(0x7f0000000ac0)='./file0\x00', &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000b80)='/dev/vga_arbiter\x00', 0xa0000, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000bc0)=0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000c00)={{{@in6=@mcast1, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@local}}, &(0x7f0000000d00)=0xe8) lstat(&(0x7f0000000d40)='./file0\x00', &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000f00)=0x0) r12 = geteuid() r13 = getegid() ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000f40)=0x0) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000021c0)={0x0, 0x0}, &(0x7f0000002200)=0xc) stat(&(0x7f0000002240)='./file1\x00', &(0x7f0000002280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000002640)=0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000002680)={0x0, 0x0}, &(0x7f00000026c0)=0xc) r19 = getegid() sendmmsg$unix(r0, &(0x7f0000002780)=[{&(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000280)=[{&(0x7f00000007c0)="b3be893e323a05cb7b6ba5568173020e8fa21e189c91b7ed78ee95d871f5f7da2f6a2d7eab9c65c80ff52a9643766706a53685acea4a39f9b5d554ebdb73762bbcfe3acdecd12dc9856289dd3cf7fa806b1b13ff6a51782d92c4e2a450038424961a70881b0f98f4a8cb9d8c2670ef0a00aa24b65eb3164a8ff6bb90cac6d25850d3a10f5fdbb947a5d8ad0405b88b57b72f85e4ccb6899d40b03ade2c970ca56b2bbed0c9cd05c29d6823f2cf381e65ac3f6be8bc191d4d3038ccd7177f09e4a10f3b297de4c9430fdb10948cc69a412c8c574d20262c966cc8f5988942d4b0c0dafd6ba8ec3f786920c70874ec", 0xee}, {&(0x7f00000004c0)="b7a8b3e105be5db68e1c5d4db01ab23b94e82eb388d8a81f606fcfe02de84aa0a0b9e7da630a53774edfed7e3b510ade7982685f013b7abc67b5044971985d9397146cea819bc484d12e3bcd5b45c0c53c281442919ad5bdb90fa060588d1f9b33b43d4dca4708bd4e", 0x69}], 0x2, &(0x7f0000002840)=ANY=[@ANYBLOB="20000000000000000100000002000000", @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r6, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="0000000030000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32=r7, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r8, @ANYRES32=r9, @ANYRES32=r10, @ANYBLOB="0000000038000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="00000000200004000000000001000000020900000022e42e92f137c409592b036f472c60a7dae8", @ANYRES32=r11, @ANYRES32=r12, @ANYRES32=r13, @ANYBLOB='\x00\x00\x00\x00'], 0x158, 0x10}, {&(0x7f0000000fc0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002140)=[{&(0x7f0000001040)="c5418d87dd9c2acfaea0459067d11a782cdf2e20be429605f94b90b76bc8207c7770beede0aa270840279e283b7b4876781990e4f2a021faaa975c3a0b796f7bd25abcf26f88d0138328f362669ae1fa2788340c121401568b7656dc14aa2687b508ad39170c4dc25922bd16339366ba6eff057a521d760e9c58db522b4511e829c32c4bf1318db1d771b3693cc7ec15da3423fcae9bd31d07104b616babc5e5ca8b5df32cb59882e09ec4263867a974fd005e07a9736b9fc8d228b830f5c9bdd3a3f1ec7d3b54453f0faeeb56e494f45798449d4da4b77677fada13ee50e87413e125857a3bbe18dcb68380d3766db733dc7fbef8990f899c952db4a56f8b03c5d7ffa171a2c756cf629a9a62cd85719c5198dba704c9c03c7795dd1aa9a5ca3907dd99c8aa820e6e1a12992b580389332023a0f29f08dd965c84ebd8552e840a6147436dca48415b1a673c68f4c3101c8c4196557adb47616316729db7a4bf73a9f1940e4d8fbebd417aa04dac08ba1fca7598bab2d1d193875e8a7278542cf79613470becf233c7abf83cabb864ad1bdd007915393a4b00e256da48285fd22bcfaaa64716af5bdf0bb301901930626684f6cedb25ffc614608ee125ec3071f4ca683144bf5aed262f22fa53ed628eae51a9514d658d646fca0f7eddec53ad0353dc8ff83d1904df34158254af8359617ef2cb860874913e76c87a393d73c3f084273e134ed2ebf6c4fb5cac0af25c53a3f55f3c703cff57b6b3c6a3ff6cef3055d2860a803b1360713a4ebae9515b32eeb84b521eead06dfc1d50e87ddfa09d0a5ca3912e0b653e74eb746df879f648825505417f8acfcc60f06e2897648951aa131f33804a8ae8a6f47d43b72fd19fa2c9afd7a452880a4ef8e6686e287f2adeb75643e2ba11f932b09906baefcc46877b06e72de79dcb24e604b51a343707d7d07001e54dbe74f345bc752922865a60dbbcba496c3bd136e7c7abb7a1e66b14bd0ddb29e858e8d177c2748ca79e70f945ba4fbbcdf74602824e4065d58b52da9c9a83db1764d523344b46ca022ee227508a2bcc5b20142b96812e19954de5bf721e811f8a5530039d00e1e2b170c34f8bd0b27eee9bbe1f7c2c5176c7c5004590729a91b57b0f06a20aaa37f3c38775f21f2bc2f6b20e3b84299fa35e653c587332861137c786f17df0c75634137d1cc9543ca0b7a7fb6b2990e4f9fb3fcd4724c7a708d6593266fa533bae0900dbea85bb23fc4086017e840e26e88268d87c3c925a59b3c1a21ce7243f6cf75ca04e7ea9f64bbf516e7d1e89ee343efa2e8ecbe8d1306f42b833604ef8792a51c3496e25ebdc2dae218a66e2731ae9962f4cf5ea0949082a7c4cd63574b371c0b0e0ac78c0acfa7ce0465be93bc8b99e34844150a741ef95a23e3e2d06a413f0695254b1d4bd2617472bfe7c73a59c2efd8ccd97a1da273a2bc82c269b5e7cfbd2db8d4e4480e59eb5bee4c2ed1154a63b2c80d08f0c6c14cbe019d01ab4047517a996ddd827f525461e857ff6fde5f7176405eb5d44c6d5e724bdd9d823fdbfe42e23fa3afba2763d4e6bb62d3a192497a45bdca30f8cae6bf7c7d59bd6554fe3c3a76137e4072e0fe52d9e52a79d3a55ae70903b5e10a1f83ccd3ff87843b45691c88eb1452920bdc06dd0a11e0d9467fcf110d801b0fdc559f28b81682a867d83930c685b003ba3a8a189e65c037cfbd768a2a6366716551607a999a3eb8938f9fccc8e5cd1127875323fa39d339c9f6737ef5a7bbef3ae90e062a32a95ff26af8b297d8edebaba8942f3473bdc1ac83ac35597217c9a0b8ce873a6962bf78ed94987e10e15f9701390d8de3c45e70f90e968772cd9cd702d81594f94afc59f80e6cf8b5d03b2164d2f5a36ef405750b34319b9f08ccb497a6acb4af82bc71e67ef30b7b864db017da6ebf36d71e27e564ca419c450d279da4f4c99dfaadd7323740e5a91aa4acde724194b629c5594733542f2ed5f1634b2f0d7d6456b25af47ce9b5231111fdc7d656ce256dd800ccac34fa0e80cb0123ab03426d5328ab130512eb090a8ac69eeead6847da8f7cea14b3b153eb532a29efbdc37f05dde6681928c9ee6bd6894da252d921b0cc406748b5626411d742f609a71ab9afad3ea1d112d3a1acc2d71cc19cf96e224c48df1985c5aecd197ee1ad83b6d728ca064375faf32c4d09d25716e5c8d8f2c5b4484c353d1e93892454748048b50fdf5c8bc09aa1572a8b914cc16bc210832e449e0d08d117af3a6f1547a36fe49e0a9aaa46518d7df08d3f747f6de70e7272953ebff910bdff390a32da4414a6f6943bd0ca49125fe6306915d9d3c5eee85e509f4f3041ac7a6752be7b83ecd50d8b3fe2b510e6ae812a635b932e7d5bb3d828ab5332be01807f8439a563d8fe015c1af30c4fe4a425e49fe7df1de6e3ffaca2e0d0cf43d3d3e14a431c386addacc8cbb7602821f1d6cc418cf3c4e84d52ab28cd711ceeaaf88b5a462191da5d6d06355ce033d9b4f62db349c303b90b82f61d0db2de92eeb18928763589b37c069a14721fe00b75a28743f90a4bf9770ee8777cdd905e599da25b42c1b080079196555405152afa2fcb1087886eba1bfec9c5c00ab6325d466574af42eb9e7b7075993d4094e1cf035ad303348c171db64a9e36dfafc3a537a1360e0ba9c749cdfb6029d73e19f21d964a33306827e8f5779d4a7751cbdfeccd33312b6ecd00eb32565efc47f621e79bcc25a41ee2d0da7286642440afef6b45b209f857ce001825cea7ae6eae445f30976e9864aab01c29418fcd5ddc39a15d7244eca8bbd191d6eeda31b6785e7870cfcc84a0fe8493060fff1b8f5707f34a17709a61294effbd9fa5a726300fcce65320acefc748356dd2d191da325a7007516e4d15611c343e192210ade79d7988180723add18e0b83843935c133f6d8dca123b6cdbaff54e54090a5978eca2026f00d959ad240c3e1fdae0967794cd172b11a2ea32869c93d6ba6e2de67ef201d72364c3c49c0c7b954a2c31633bed8723c8086eb534fe7bc8e0431d2dc00af19f85cf3c482ca1f7233ac5f044cad7b41eabeb3791d37b852035dd518a8e66b8e19f49ced8f403f2fd05367dd5f955c56a113d9040370eb751cdcb5b1cea07caaca3177df563072ad647ea0bf1cad7d597371a2bd0b9144580a0bd8dfbdc26a1a635c28a287943ff2662e1a8362e2b5db2f4b406185fc0fc2e8b51ff22de8326695aa9f07ccdd172858f2d86537b08f412ff89485edd8a45050ef21867e683f1fff207c340960c8d71ee9e15471bb8eb3cb344f8e7b7e46c73ae45157c30ab31a6994f89f1b1d9a7db2b1ad844277558a7d11af7ff83f46f94eddd1e32c7f7a84bc842de7aebb6fd63b2e8575cd29684883b7bfffb8405aec3b6492ce9be6362c7b36cc706262286f395b94902c79a30a5cba1d73cc245064c638b18a0e7c689bc9632d7d951bf18e120e141775ef4bd03d6cd03b68ffc5c86d20f849ac52f02f59e59ff021b9bb79bbfc8c79570651a2a8c5db4f29142bd2c73bbcbaa13a33c79ca3d9da960118d192815d94af9a9fad4b8ecae5a362d68641627600a54a8e81f0d36a2342607e96371d05bfe1992df4609e025d17d502d5cff75186a986f116bfb85d3f35f9f1e5d02e3d0db02fb5b164dbd928059b37a7a1509069b2ea3c5e805fd54e031e7456c64663a85fc654da8af40611de1acb3a2369e7dd840f6da8ab1a0176b83dad19dae0b8143dac76cbe309999ef3e2e978f85bcc6d1346a1805fa755817dc3d3df156125c6b564c2e7502204876fb74768ffdef3236a5c90a317f254efb490065e02dfa02ac6dfef29b5f80655e76e496d2504ec7bf6960cce0679a919fc20b91a7b20373bf884c53cafd0d0f3300976397dfdcf588a06104a0f9c8a6e1938966f8f264ff9682c8c2e76402ce7024e531c3f679a068b1b28a991e87c4a35d292a6e9b94fc5a5f1913fa5d9e77d943de58b72fcced4605e33e825e87d589d8a72675470a67e2426d06488526568d08a41fbf1b8fdfad02a3a190d8d7e50cc458d9dd5cbd4035c78c56b99c0c16b4a12e16d1be6489180822cea852a0bc2fef533242cfbcf1f9e03508da14f9fef4f5c8e0df90c67368c7ccc65fc6f3d92ffccba0862e9b03e28a1fa7cb4af35d0ffc49b0eb376c8f8d1788f2c7c48c12f950a350a2a9d6335aabfd71db4b7625d2f0b99553be4b2cc9a3154abadd3dfb5014744848bba8aa9a56ede8075c669516a571ce47f0dfec3123ea130736c5143555878af95128dfbc23d007d041d10568269ad5c9830a04e75d0b85581a3cdc20303dc751a438f0ff5c6eb56067223e54a0baaffc7e1f2ec289610fb2535ca09275fa79177ff7625dab200ecadf127967cc96d4993112b57a867ee6d18523d0b69e96be47d5f4dad856fc785a7d87321c392dbdf004bcc794ddb0ac64f03e403dbb8b9187a11a62a2abe769d8887771397f1db031b7e8278a69f2a0045fe8ed5e931326e2c360a1756322e2131c597433e27646b590343632864f07acc99ed38ff741b6155272f28bf36431a20826aaf3a50345874127af73508688237b62e1a8acc257435e408e079110d47a53762d397fac03cd058279de056ff2e37db47e7253e262245a4d4a427e516016287e3b10aacc1688e8845f84862d0187f690cc4f698c7b03c386b671e54fa6e4d97f9a5205c61017a06cf7595f284f1cfaf9c1005f31616200f1dfb60edd2c0dbf638fa12ad99259f4757f02bfb0c1089386f30df0328ec6fd30a8374348664bd35493f49ccf59b5c1755d8b8be09596e2412b9045649c5884011627aef1aa09026718831b1342c1548e606885ea6ac75f5e004ae1a692f73c1ecb69f86f3a262bb675f603b3d34172a20da31905b3bbeb0265398bbc54a272d069febedc09a4b8e05275bd0d127479db8bfbadc10c8342c4569946d7451544332190a859609c1c7a56d6708ca1e709d1a856d3576f9a6e2da629051f323268096504feac3a3cd6dbc47abb04ce9a90e9db62ca701924a33a778cb3fb6ec05e1bde0b82f7084dfd1b63bd08ffdf394ff0505a872f098421d5d0afc64d0fcbbf4a064e474830ab83900f66712e795141ec2303a122e462d2d499e429b4d2e481d332a2d3c78103d999ef1aa7c6fb11d002180642c8a18088b074c3326421feedb275b9fa4041fdb92096cb4af5611a78b2c3a089bda3fe65a3fa8d7e952bc2b8b7ec0b8894b44adad9c5cce0b640c309f19951e8df41bf49fb6d138cc2fba8364c7b649f926030421d1e9f6649ad595e3a6447af6a41fae3f91d0d004e95b48edc7d36e2169995fab4fed6b6f609fcfe6bbd8a82495dc0840ad9eaea976f6548aa470c78b56b8cf3e26088a04bd5c2679f3ceb54065904dbaa6abcbc7219200c8374cec7fb12214b4d2d1d8ff982afe80e8f2f910a1a83afdfc4107f5f423e7adef7e16a5baa5dfa4e0f4f5cca1a154d39290bbd392cad6002036349d453d39e8c2fa15501390ce10ee443b1403cbb68e158b8cfd54e7793a6e858a622cabf988773fe55e8ac7aff2302798a427cc16ae40cd4e2495d3cf67a21f6fdab58610b5869d27db5ca6362f445246711ee1f3737b9abbc4a9c48d0cde6b6ff6e7c3ef4b228dc9a4e2b1413dcf009e3e677bc1d93d80645352942726ead640302a1315b756113385a744361fb7d3921420fea43ee4403204ddef9f3fbfee07c49ed451bc9d5b5fabc6f8877fa00dc9dbdd9e108554e61112b71568e591beb45f4ed47", 0x1000}, {&(0x7f0000002040)="9efbc85eaa12e42d2027c9cee693fc977e218fd37e55e5a2e774f5d40fc6e3099e3888f2a737fe06b6359d21464b102334ca39daf6188aa178146f8efd831eb23e28b8f8760388257dbe68176ee4bc79eefa126e26dc47599a973e1f009bd747ecdbb0d8224c93f763f158865c19afe8e1fb2e5e6cce4fcfd3c9c69a0e3c0c7133531d12f5e1cc06e1932476fc994e2f5b0af561189d37fbd96ed93af670f369da8d723d4d75e2bfe88e7dfa804d400cb86aa43bcfb3c488a0226e05e5646f924dd2478632e263083af75a651c1ae41e15", 0xd1}], 0x2, &(0x7f0000000e40)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="040000001800000000000000010000000100000016138609a9684eeaf55f8215c545cff5153ce75ab1f3517ca1f2c5ebc95aa9f10e35d05226c4b61c139e33aeb334a570a33d990b625b990edd4e0fbb70496731e4baee900b8a8d85aee1468b01f2ed83598c", @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00'], 0x58}, {&(0x7f0000002380)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000002600)=[{&(0x7f0000002400)="4e4c82f8184d6509588d0c023b20765f82756f79ce613829697909e4789d6bfed10d32a0932181e5b32c42d7f0a1cc0c868ef6572fac80a467eafbea29185f445164225a9e922e12fc51aef2e2393182387b673047b5f5248f712a75762991c1cfe8aa67767ee6ca5cd22b5707e2509ac4d7f7a6ca4c56d8bb671d5f1f2f94e1af5c76367df08d4abf56e3cf692b6878499b257dd1b00b2f6ef9ab1b3e8aae15f55e514c22aa62c1b4e11bcb188fb147ba18d4b30b0e5350b6ced6c7012b65eac650497b672f1ca4c3295d84ff37a3b2c628724df193a09c3fbbce2b80f00dbc6d3dff5bdab717341e6786b96fc74d12fa01aa", 0xf3}, {&(0x7f0000002500)="b50cc050909573eef174165583a4068aff241db4ce222212fd85d724a9c1e40b51a8da4cba89893b5c638549c564b47defae17225c7408c4f4e75944ecd707568ddef16d2a2743b38d5fa6ee8fe445b941d8f1fbf54317d66f0d4d8ce536c15566f1d925e17fce1aab0717153412e552d7897479751411e96cfea087b2f2499ffe718e025ad8e28ca40397e6d4fa2b70", 0x90}, {&(0x7f00000025c0)="4df1460895738ebe9164cd0fb45e36e8034d487b608ed243d65c06151377e31f310bb55345b37d", 0x27}], 0x3, &(0x7f0000002700)=[@cred={0x20, 0x1, 0x2, r17, r18, r19}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}], 0x50, 0x20000800}], 0x3, 0x40010) write(r0, &(0x7f0000000640)="8fc0c9294d0e1783262288a5ecd57497fab24472557eb927fda5f0dabaabc1a511b66152316acea86ccca136908485829d00afa0eb95885a6ed8c881d299f8d9b509975de49fa238df7385bcbad48dd6ba2d4a9c0f21a0b980b61b044f6230d95fcbfa4b8e009af53d017c318ab205295124d81871826482d9e4cf96db6af2c640e99ee805793c15b49927689bbde502bd020900000000000000d800003682debde4b08a833cd659160bf2a6f2982d31be51887655e2e52722ed8fb78db74515c57623bec2cb7c6a6e62949b6446ffe5e62fc46bcd64fda9d2c69ac437d3a40b546c981fbe1ff72d621f4d03c66b3c0d247280b56ebdd7751b741067cf7e8cf497e0b8101d0ac8f9c3444566e2b6f4d6714ead520de624e27747dc9a61060093cc0f35ad00aa4e7293346f091588e40b8f4a8ae7dd6aa465360b02877ba0eccdf5c1c7c45b29f7b17952de", 0x39) io_setup(0x3ff, &(0x7f0000000000)=0x0) r21 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000140)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000200)={{0x6, 0x4}, {0xffffffffffffff81, 0x5}, 0x1, 0x2, 0xad}) io_submit(r20, 0x3, &(0x7f0000000540)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0xb, 0x7f, r21, &(0x7f0000000180)="02169f863d2a120ff891986b9b", 0xd, 0x6, 0x0, 0x1, r0}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x7, 0x2, r0, &(0x7f00000002c0)="79ef3c2025633ea6c43126afa5bf8c8425c67b18ff2be612deebeeaf98502714436e145d973b999c11eec416698ad81a2ccb561bd772c1ab42f303fb5e3bc79e93fa1c38fe187c0e5768fb22a9355a00d7b7991aebc32629706a521b79d7a53d05142386d2ad07950556075fb3f3058d382050ea732d399461cbbba86d759d6ff26d", 0x82, 0x5, 0x0, 0x0, r0}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x3, 0x401, r0, &(0x7f0000000440)="576f1d2d31c6e3d7", 0x8, 0x68, 0x0, 0x1, r0}]) add_key(&(0x7f0000000080)='pkcs7_test\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a}, &(0x7f0000000100)="105e", 0x2, 0xfffffffffffffffb) 2018/04/10 12:54:36 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], 0x1}, 0x5}, 0x1c) [ 948.024698] binder: 29050 RLIMIT_NICE not set 2018/04/10 12:54:36 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000002000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:36 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xfeffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:36 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:36 executing program 7: unshare(0x24000200) unshare(0x20020000) syz_mount_image$hfs(&(0x7f0000000080)='hfs\x00', &(0x7f00000000c0)='./control\x00', 0x1, 0x1, &(0x7f0000000340)=[{&(0x7f0000000100)="02aff63ad7f47b454234b32f50b10e0d22325b1b2c96f2fcdc1cb795860c421074b373685d9b091099fabe0daff7ff04973007ce98bf3cc5e86266b71767193142e5ac74f6fce92582b927e088d4e4651c0fb7ecf495856fb8a522dbf62414ee8c391e0af3b264d80b3c4f3e27b10e84513056b7f84192cc9442c8c055bbfa5ecc283cf31e808c5f313a1b8acd5819551fae4eadf9", 0x95, 0x3}], 0x6, &(0x7f00000003c0)=ANY=[]) mkdir(&(0x7f000000e000)='./control\x00', 0x0) r0 = open(&(0x7f000003dff6)='./control\x00', 0x0, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f00000001c0), &(0x7f0000000200)=0x40) mknodat(r0, &(0x7f000003f000)='./control\x00', 0x1, 0x0) ioctl$TIOCMGET(r0, 0x5415, &(0x7f0000000240)) execveat(r0, &(0x7f0000010000)='./control\x00', &(0x7f00000003c0), &(0x7f0000000380)=[&(0x7f0000000280)='hfs\x00'], 0x0) setsockopt$inet_buf(r0, 0x0, 0x3d, &(0x7f00000003c0)="7884b9169f469f5a26211a6f7bb5ea98594f56715bf7efb62c65b7a01fb37fc9c113122bf211a735ef77bd5fe158b8ea9ae1e887b01d1665efd553175e90f59f69ec030176b7980b7f7fe46c2e9cad4d953bd875e7195a345693a60ab04fff7dc1e5aed84591f5a0a13e4647ef8516d6177f8bde329caf1fb941cbd391420ed0563613", 0x83) syz_mount_image$minix(&(0x7f0000000000)='minix\x00', &(0x7f0000000040)='./control\x00', 0x9, 0x4, &(0x7f00000002c0)=[{&(0x7f0000000480)="580fcb03051228283b65bdd925aa74d09d093f6c5bcf0167695f996a7f9cf73b7192297f631563b2e492f432486f21627eadc9844b0ea946c6cc3ffef9347ce735ee19711e85a7aa4adb1a61fb47bdaac3407d21f57749805d9cd694bc1f28cb6457b96a6f796ebc815f970493c616a54e45d016994ae3ac56ae8404356dacf5fbdc32a8d1ab19ea3f65fd2745697c485a239e9e57cb6802c892b53a1ee287045af2e8a0b795bd04f1bb201652165450f1392cd0f4a2244e628b1e8196aeafbc85c1a9134813514fe287e556e2ff9e190b22e66bb0e2a4847b0406a2ba205ef52c487e1438676ec7d4ca5509a1d769b064a8893552e18124b74714366de4c62c8aa5d41a2d9b9f39301b2c8465a5f1aedf8480cf2a52036e30d1d84c97b70e42e0516775555f1d49e3caee6bad56f8fd5084090c9e952119052a4572dcf821ee08bcd49b07d01cf11e4588af140795e5e8eb9d52dedfa4ae48f46ce226706e916c400e026306fdd9af9cb4fa415c6a3d2333af9f5f28b2e57229faf02f97f3774c282e1d0afef4e4d3c5f671c603cde6035ea7679aad1e2e0375fb591e9fe3415e4cfc7024aecc80d925ac229cc0d491cc31c2c5cfb849f11a044129c0ba643f4550bb429539721a649f7279328aff2b5e778794dca2bd435e1758387da7b5bb2caa56941fe4881427b89e120516b96dd27b573a8482ce9fab8fb9e6142c64ef5e46ee153644cf047e44f66aa13d92807f0f0ff6fe5256e46af89e8534efcbcedb095c7177b989f09f637eab1ea7ad966b8d99f5be3bb519854164aebf29a8bb34ae4d77144d395844cf998ab056907d232478e239e6285591fea695baeeedeef5b4eea3650707e01306cd928c9b400b9aabad6ad2646e6639480733973998dccf4db213b5c2db9777665b436050f9712416ad792cb345bab112c4f0a643ea02d51dd0c6ed4257680a1dd6f7a1db49a781dc6df1e76d2f291cafb96841c58c38e8869c313e3d74ca50b108d5f0d660b2841566558c79e5c8c8e9a3a7e6df7ffb089020583ff68dfca85b3e9ea1f9f010deca48ae6087e650a6ddf3bcf48c1a1460ba1c0ed04286c05bcba50bfc697c56298a16e3b75b9331909cc58d1850fa17412923570950a1386c4f4f8184d308d7f0c1750c541c3d05f4a50639cb7d9cdadfeaa2d15c2c0289e3da4a068629d90d64bde39f599671f19f5805076f76831a22f83fa57ed91f5970bd820b3aac9dcc73768319f5687638b1ec5264499bdd205c022102caefae513128b4b48a8f36e960d95a51a9d7dce0c1bdd9373b813f022df8b1b44a48a563ff39c2d8f73c29d3ee7370afa592f0a05c7600fc670f6cb6e790ded1f8e447dec6d0aafbc5ac02af6b9825fb5af122e6f44aa2386ce34eaddbb2337154805eb98ebf5b6aabb4c5835aaff8ba055e249171a3b55c3e853b4e5cda3a6c5c2c07c07552008f7dc81ee7462280ebc61933a1c59df566c661a8c1a6e4ccac1c2975f7d10215f817187c588fc8bd00fac693ff50c587cc293a8f3581465594f1dc3165bd93b80b4f85ea6e55362427532bccae199cc15f33eb19385353d21ae4289bf03596c2a74502f7022a31ee3ef7d4be89510f43b7fb067a79d6cfe7fbd27f59159c3097710bf63149aef5f7df3d7f08339296d674de334b6b97ae506e9ee32f20b05b47898ecbff6327a6dbeb9b739d3662a6cf7dc7e42b1e87dd16d5b6ac7203a62a098c97a81a076195fbb135674b8027cd0441345d88d2fc1eacdbbe3588994d4f8d0289665572c3882c5f24993b0fcc52b001ad95b79ba02b75e5fc5dc72eae479b5638882cbd2acacc22da8b5523702fbb41540901076de254bf283be48352cd72e63c26132dd70c3a592602f23ee174aafcd7961485e9b021fdf688c23b5a8f6429c5194a6d00c9f4b51cd82dd843b050ac986a994b297245f469daeb287abea7bdc9af4142c26a368a75785a2b8cfb23dbf83f19392c4e89f88e990d2ad9a091c78b04dd6a3a4cdc3c1710844ebba26963efa8d1113351c7540c4009eb0edd9d5d9eb741b0297a4eaa0510d4cf78b663b60011e6215b664b59c4bacc0ef4e4b20a2965b19e950af60c3e2de524eff98e522875c9770a8297c5a0e4b97da8db828fd16b46e9ab576f56b39a164a572687c984c868826b753d76a8cafd3b498f2aa73ed768a60e10da1a77edfd24a5ae430265a53e144e099bc506226a1cf41a2a81ed57b96da093deaeb04a21d8cef506dfca8ad4efe00a7d8eda84bb80fe3cdf55b09d196e34e16a275b1a1934df10eca2ae0167a7483b3651e22498a32b4340cd75b651df6daa5d0c0e9c7bb0c56f246e1e7171e7278f1653b4eb702b2da2f43af47598a902e94e84be21985ef0616dba021a3a5fb190e1ce19497542e173adb9e8da17264758781b7fd9ee2288cf3dd048b7ef9503fc9533d2a0000a663b5da8b8f71411534aa4432d82441e1e379bad11a4de886e7d06c98b97438155876b9a485abe786d0262d544a8184b137f5060c21cd6de97fcc50e39e2bac6a59eaf1594832b8f284660d8ea46015fe1180df28c69f6f08324e691c7eaf0a34eae3bdbaa80ad9fa949bad12c51a391e9f85c5edf7529b68b4c6f9ce338e46e285cf88f461ffd97770c6aa228159388d2ae3e8deb6839ba99aac767842348c87b7a66242adbbe9272145d11dd374808d2e68495d777bdbfc2c1698647f320ce7e37566194329f48f461e93c55a62951a0d89eccd108fa825923e7450c815df3ed548a33d34c873a29a646fda64721b8f331204623822540998d4de1f56b0168e1308d068089f9b2ff3a860bab2dcb8d05891755e8d231405fdd4232dc3bad1ebfafff27b1ee0e18d44bb91ed910e6ff23bfeb5a421a6bf2c934566e154e942629b1ddee1803ccff59e6a6cb1f0eb2337d0955b0277ba586f6749f2593b654f544942336573e078bfb7a3124beac0fe09ddc00645074f7b722410e5bb6e5ce4c6d6b872dc9255fd50dfba32237f9823c94af257c57aea2680db583126d2550dd17fd567c64540e47ca74c53f558147ed76bf7dccc969f00c9c0ed9643447533c23fd6872ec91e45d53a06f19d168cbeec3851720ec69217f5372f0c3c11127288d7f2e4f69eb772f64c44b435f26b53c03d9f738343bf4cf765ff728213fea4cfc33ff96fd756292eaf7995b7e711cc6d8059eac78f1712042168d3bf61b59f92ff9c40bca817c3329ad61015475999d7f2c690141eb4ec0a9b619d2674f53c773d178d4345941b34a4250d64804701df6668125a50799d0fcee19796b2018186edab10ea83b8cf8d09ab8cda7d8d4722cdf4134db35c776080143bcbb012e6468097749be0fec64b984175303ce31e2cbbecc4a49a004f6d2d30adc05f1c028da44c5ba00833ecbae6d8d6d586e8432f524efe3e55a44926cb0058d294525959cb29a274c76089a5656e006b5d7d93d347f5b47e8164770aac23d5351b6d7f34bbb145d3fe900998bbd1518d8559afad6cb0c19b7a3a511d92b2cd066a8ee31b76afe2214f3cd67e4d371d4606a48bd3380c8d70dba342454547de04e9e3f9bfe2e6733df173a65822b53e3e2206cf9d1cdc69614c503d65711f26e82b16887f2095f3d4ec9267766efb3c019880746f993179b56599ada4097244641496d514d836d02af9fba980a82f9c4a736ad1da286309ae0d97becd513cd950855f694222b07f323e94e9cc2c21f1dcda20052235363b9632a01b5990ff32ca198f55b93a9ace44e16a05ddd799e29eab7243d3130f5ec36a50a353f4d922124ad63c8c6195b4721ede53f0c9dd5c33a3926c3729c16eb9c442e2bdb65b196eb842347a9bcad256d47eb556b4de4744cd4f26ba371386c0ce1510d4e0fcf823d2932b1f72c47716ec6ea70859f6a8151ad9665f03437c78b04ff6a75bd37a51cb4a66bba9bf3b568f21887c4c46d4e491a8d0220164f549c01978dd872ee14f50948fa79ff1c2f818cf4679aa254529438ee6c60ea42937842989cd65d18d50004d40379f82a1410b8ec85d1daf3a2b75e0f4557ec30e6f321bffdae98bdf0df0030dd176692fa1b5d0da59a3714220aa2f276c08b2c48df71aaf852db95866c206974239b289813a4dd4cf8e9e53b3112b5ebc215ce52ece7e69c4bf6f3094a02cf9317e33e9d27c39edbd0f81a3afaf92090a8084d367de863ee41505a91c5689d8ecce9e5d5fb88a9e7b0f2b9b5641d67ef057506f7c5713ebd28762aea650dfccdb0692c38f04bac007bdc7c28f1c25c28d6e7102dcbb25857218a2c94c7774332178b5c843e949e56c155c3ed7df6f1dbeb16e2dbcbb062c34a0117be05200ed9be35738e3d9d9a234aed8ac7698f031ec58619d4d2269dce93c773bafb826aa5d75f0c568746a97d704832783f48c2078442d037cf45dd41d94eba4241f6f90e74be200ffe2d874128017ba0104bfa01abdefda6c01f3364b68da597d4732ae58020c97a1106e810e7059caf0f736663073b377ff2ae7e1de41c2f27859e63036f2f187ef1a67ff11f45ba9a40f820711a487e1f77a2af74ee9e8d238ff18d42bcaffc7120cb8425b0616d2833c6bac1e230a348fffc3e42f6a31f5a4e5978fb98b259550d66ce1b37c69f14a18a4a2efda55563defa80ec4d0efea1d5548b2341322e311ab1f265f5f64e66cdee3ab5ce2e76f8c86dbf79bb72ebaf72a03e9a97983c4f23b705ce112f766493f78cb24bf6a280708fabe932196fc8f19c41fb4b0df7879bbd97236dfe49c46891e75ada0e27985a86b11f3ba8ee4f2ce5b47da278f73829e8cca205479d045ccef91a24c312bc1095bb5fb4171671a959457301c80d7e32b487cd070adf3ad0c2e08bd0c2b442bdaaa2bf6effdb9cb3e377e05b32504738df3450f7d7bee78695e4baef9f150b9fb1a32e89dc369a9b70d538d8ac439a7c844749ab03c097c682674ecde9f8dbe2cac4d60145e8d9489c3ade5c0bc8b6eddc49362cdcdf506c03453a116704453cf4021a112ad0e917711e62123c427c267cd650e46849f89af5e5342b8f68ab1a7ea034b64f8713cf6b7d079fb403718172546f6c742850ccd99044109e8f01c061752d443b19dc7190c43d1b772f92cb1c9026c5af42608b4dc417e35b3bc33af415b8ad9993103cabc4ffe53693652cf8dc7274ff956b461dc19f948553c3e98cac16a31c06a3256ba8b8509852505aabb8054c3edf8000ad780bf91b9ce0a5d0821a957ac4dbbc3a68b7eadc183b8967271207a0781ae576ebfc232c69208c15200e9fb21900dd7fa359790faf143926f3cc30057d46e595728016d65203b9afe9fed6519a940bf068e76e976409e1cadbabdc9ef4f74dafff421a938abb656bfa2d525c0465efd007b46929e5f6ecbce5215fccc410e138e339aa915bba1fd5f0c4ee728cd8e92737a2e4270089779fa450952378bad98a2c5f3742fd026ebfb54b138ccf76a944d429f669f49d688f7cacf4e450ba66bbbfc2e270da0d8c4c09de35c35017b516700549118d56742d590aaefb0061fe7761932d5b2f5bd3ec7298e560ae070c84b85938d0d5767bef5abd461a80999ab21df3aff218c2e00594ea1fbc07d01c42a9c419f1a2379e3cf3ef19de3f2c6da49442c6117473c23a8663baf6f0a40099f48e741b65930959b725553db776ced79ac81d8cccc0a9f485a7e3477626a02b097448245485b7407df008b68b6b57eb7b38aa22d921b4848a49abb73ba8dbc5905b746bdbc29a99bcf20411438afad48af7547f3484a78fea6f", 0x1000, 0x3}, {&(0x7f0000001480)="71bce5ed2bd83e671f9bc8af09525b5175058bdc03e2543b76a6967dfdc0571369886b00f9eadfb7f6e128f3dd3c7aee7fe590fbaf30926aa98ed6c4cd682b851ed1fe25ed0189629dee467ebbea0d9b4a9c94b2bda8d415610f5a350fcfcc7b7e014731cdb0ce275cdf0c0db07be19dc9c8f8c8d296d8f11d9ff95ff6f1295fef386ade84e4df702c5a9a611d921ee0598c1f54b4dc2bb3f4a189adef7bd831a47a795977a16c9facfa62506236c2c2388814c8de4e20", 0xb7, 0x5508}, {&(0x7f0000001540)="ea606fdd266c61fad2e6c2c777d41837038fe505f956395b126bcd9147a5bfa26515c25d6289dc9792ea23d2201fc7c2b388de8c67d7baa75ba51e11210a9e2d040604936eab9a5c1b747bdc4cf5f437879238f0e4872865f5ec62431442c339e39cefe6e4ad2fe753458b744a705755841cf5bb5e56dae5493e2c58cc0c81a3e80e75f19bed788c095b9bd5afa00e", 0x8f, 0x2}, {&(0x7f0000001600)="d67a278c60d257a511443d2fc3943b35487965f633d2f0e859f8dbb64345333b6f8372706bdb845ac0b6c6c032ec653a25549d118349195dade822d1a845ec1130e84e611dea79d3a88fe6a39eadab290985bea39c890eeef339c5d1d6a8b54a8ddf37915b10586ebb7a1b7058e93f5a3d7b73b675c1f47a8ffe6a3fdc7931bd2b004c198fed93e4b97ddc51f4321da336492975f1aafafeec3a0268768a361f9d0f3f5188dac8d3b9135536ceed7296c18edffc985d94e0f9a4664a90d3c43d6330423f62eba27c78fe6880ace6bea82505186eab77cd9b00befce30676119a693778930b8033500f01b3c9eff8b755f812cdea5a82b653a09778f76843fa992bd8e78a9fc1fa576611cba4b68e331e74f515ef3b6a24b3f7874ac90bc6778f71be20fc74309347fbc38146b73d2f13f365659a634818ff493f9c56bce11cf7a4cfe374d651b145e2cbba21f796467574ced795e0d9d4866ff32b7b555b567f3e6b9518d8ab59da69723b0d02a3598371e9be449f0b8c390b854313392a7f174b5a1a6d156bb31eda7e37d51d615e112e575ae67bac7fb1c51209fca6a90e49572aeab222e026d23090b47cc2ee2ba2be490aa1a2ea118a95f29b69ffad3b924c31ea2058783a7657898fc7b96dfa319f5d0328022a627694b002f866b1e014e28118843b3dbf735ba22411a564d99a7700c963b7dda05317d1b53ba77c5f8e0f9f6d72086ca3c0f1cd9b7ffcfcb2a53487f35c057b0ef04b9e995ddca673ba46daeb02527f7f6777306be7b8f1ab24bf59126587e87b049e51479e3b729c86eed9afa3c7bc152481ec28aaccae7c0a6f30d83e0fac005254a1941d7bd7a31df09c5a3768377fe6cbac22ef1091919ef9a462c8eac894b3d345287e5236dfc806e4592a2024664cf0d14576ff9e64a56ce96c9eb62fc86106fc50df1a0a728ffa7db978d1f4802840abb6a7a951d218cf15cd873c30ce190cf5628b257738b881f6db65b2fa59cd05b062f3533e07790dc0e75fe24cf3c975c2c86c41eb2b2532ec779215950e1bf47101f72a8355165d0bf6092e353bacad5d0b9a9bdc8476aab752523e7fb15a666c0883281a13211def9c06cf9d4d9c6558182c53c03a15d676c65647a8f887efb41f45439a4f98c05f48977a201a7f257313715eca8c155c38ec1de6bb398b05511b3796f3c89498bbc30a257d10b6bbfae491eec647a8e257bb77000a0367631f454aabaff51813058b95a18cea766e16752eb68721035d19a0d6f97d109076548cdfbc824ad32e6b7fbd723823af8c8c2801571c9609744f5d43ef6874ab2cc01e48766180e65dd1139951a57bef1c6b270b0300d11183642da633950b388c4702642f7efbaaa23f3a7a713f34645249c49c1dd25653d4282dfdcb966ace48ac97e6cd9ffc5a7d8dd2f23f9546d32efe6da7a039cdad4148be18ea55076b3c62dace89c77e43c0b458f43c5009464c01d6083164ac5f520810f47e0a14a526f520d19a4df1d973d99fc980a91e8d37f1ad85f724af3119d8e384d43a9375224985b9d637640415269ba4fb870e505cba8cc2b3f682d733062ecc76c93e0284577ae08da16b7c2fd5b3c1f20efa4f06fc7c22f01f693cf2fe08de1420f461a6d9fd2e1f61ace05c6f7f28bf7481aee1bdf3c852580838acdd0f467a885ca49cb437f4b0d42606394c8e6ceff0bac84dc0de9a1f197f7082b7087bd1d08c479c3e5a379d959ecab5e52d186fc748de7eb4c6549b0f47018efc695a9ed78c243698bfc43b8178c23c40c6e42c94f771ca998cb2f03f2ff6d83605a4e7bfbd877fe4a617f973519cc30ecffb49b96f14619feeff45c17f00399b190bef961d0ff7aff5294639ddba203a67f24172d48968ee6162bdc67324c5eb6bb45e8ec513fe38e8d7094d3a0c3c10e212b90fe641d32de421955aae0ebb6778da23ace175bd653eb5dcc6179fc7d00dfe6ac466a45b9c84cda1c8b641f3f62cfb69eb95e9042542c0bc3fb82a9b3b9583fe2e9f1ad5b94b5bf8ac760919498c65e3f8ff8700fcf489bb1aeca1f370e735c48a3e189f814625baf77c085ef5c48e77f3571de8930a8a49153192760e4caa08bb47fb5d116d10bfbe98fbe456bc27967f57bf330a9482d6e5e2756d0dbadc92c28718b15f9a17e0d18aec129983b54ca13f2432e9e2021470268cc7ebd0574a63aed9f3a6f0a917ca84d501f1b4029054f2fb5b63031d7d406b223f73168a4a23fb7058bb4b12fc9d8cb1e34d383389ab401d36ffd42e02b920f1b198ddab49a561f3116be08810d7fa7b55fb29cd67c17b23a4adfb6de8139d6ec3135bb52a2df32d76946d6f1989266aa8d7c48b087e6a8c997b6d1e1b93a12a1b92bfaca48878cddbb1ab39e46b71d1037fbf69bd92a4c1645a7221935db08c2fb5ed87ecf2495c418dbfa87f3df220a7213c5eff038dc2701962d4c72674acde11b6b79d71435d1a64b5fba9b35224917eed61cafc1dedd45a408d726c9ff56b647e7b9c172e387c26d3e7dadf1d8f537d543464ef6723cde8534aeb07d8c439a00673a507698ce41083011c93e0a943d066a128d6aa4b184ede8d3fb5953abb2f0924cad93370b022b89f2cc442f91ea9ceb462d6483209177f8694745fc8f2a93264c7801d0bb6c2b1c46d31b0f828b63cc56a072ce0d8b783d9fc6273bd8a25f67287d7d6dcc392ad412f6713d70add1f4a4b483ceadc6bbeb4a9f64446a510c905fedc08d27bfade2be48fb7671586461d3b6a9b7605c389b4871f78aee2e5917979a4d477ef487b077c416c6cf3a78f1134cd6706c280429c6f97ddb9f0b51fa62366a7e85ef4e7039c7e6867a20a0c1fa2335b48835d25723b61ddee5f2702ec906a16f3a620b63839e975b93ef7ca61739b9f2e3571b08f01c78011ff3bb318bfa30706a4130e0e42681036b9fd2f7d66fd25521fef9bcc174d2656b7907a6e5d6fd1075c855f9d4cd8b17a9077569fa32199667b44a48e840f3ab007d8866077e9effa91a42e60581f617262765f7e0607a44ff499c5c53494be77e3f80d862919e01f87c8619aa4803875af3f2887c779d23240c7af2a829a8a534a2068696e46b995a6287eba5135a82794dd4352b13ef93ed24f28e0e4058068fff33290c29d5dace2e64c9a8b819bcea90bb3f93bf5c87825ebb6641b19b02f804f5dba3e27fbdd9a30ef5b2695018690b44028258ef24164cc1202973da883f961b7b1a81a0036f92e9709deac33e06d1f90c07e342c7a4d18424a96ea76a46e2c7fb654bcf8e0bcf41a2fccf4e728333b9ab21b4c65771f07e7d535b614ee486fb4cdefaa5b3fb7d5ea447f6971b7d5a4f2456a7b5ca6629d12d20aeccd1cde0ef3f2b7d25a158d4f2c7f6ea29e8e2d5b0deb4fde0cbce2e4ef1a6730e39b1368ea058670948960779be159153d02484a9a365dd464f86d6556a05039baf4a5b863f261faea8254f866dbefc494a8fd18d5ca40b778c3ac26ae122fb1fe9bd1c6420bd3ce4ab0018414961294fea81f3cb99c97ef7e366465bf49fdff3f25f3a07d3ad011d18b0ad22de6cc2ff0ba0c9f99a9027b11d84958e498526adca7965aba3f042d616d3c42f7f7914fa4bd0a407ef21b439106fa83e31e29575a15c6ff990a6553ac1cc3c920be8b0256694cfd3db384bbc3ba60ff9189c7aaadd7dd52e2be18c334c36b060a83539d1eb7f9558f57014af2de9ddc4726a65c57d1ded79083b0816e02c719d64cbb7fa50c14a870668e560090873dde2d47eeb49dcae074cc8e57e4b1cff1f3318378679d9843e65103abc2b378fb43b22e7f6cf592c2b8f7a52fdbc17ecd03a27902b44a6cfc580714fa6166c7f987ebeb2a749c8184794cb32fb10a67db8606329123601230454812771e3f49c649492ad00ce2a12dc3e2b6780f05fec50064c93675ee641b2744b4a3431153bafcaf8156823bda740908f0bc11b700c81335cefb917084d9ad6b7efe6c33bd6523dcfc12b7a4b13cd1419079f074ec471e6f9fc425042079f9d4ff2ecbd1087a2d3bd83c32d6b8aab87cda80995eea505bb71fc9303e8c1e7b074c0b0598907e09a2c1fc211718b10737720281ec0d34e625d2d93dc5f16f980fb7dcfcbc1b09636c3731241338945fc4238637bd84a16dab222e16e7d964939018f3cf03b9b7c628e89867b00d4d10d5fb5eeb79896340c31ca03641998508227201d63e5e909f0d8f461e92595fee10d96e10eeb5f379f58d89b8a2f88e6fc82ac0ec94ee56f6ee37162c36c9fc36cbb8a6017eb6e4a8a35e68d2552c3b6320b61a707d6b5566509d842a1aa7c80e893f9f269809b996ec7315ff8054af3f49bf697fbddeafdb43e7cd976237c6e48039c8af6db7d1fb3571fbbad7e06ad968310eaf54daac901b6edfea19a49eb4cae6d1bad6a33560f96ac9f63e765253bbf8ec58e2b7cfe9ad21fb70c799465d8035ad7941da88759af166ba2b5797a3227b04087c6ff0520f7c2def03c48a79fd6264f9bf863cc8ef6e8d9b70117648e47fe64198bc162b3455d006f33abc22ab544db73b0ac33b1ac5064f60059da51120ed3d8855d089e61f747215192a08b8a4e1049d5835dd5b8d3453333bc9c67d66dafe972c9321c0e3412782826c5bfd200e72bc85e18879669fb3c579af4d39767a5a7979fa97d722ca5d6518e432085092dcef4a6ef8df5252cf9716ffcf2283a005ed9290a48116e8b28004cdfcf2797173e79964b60dd40a2da9937c0ff6f85807f834011a26067ddd5b04a34d8fe04013ae1ada105a51e4ce4f34cce3696d2ae30d90a0e4e150ed05d1b37f5a437709a458abca05b8a9b36cf4a047b1db7ea1e036a7fe6472ada90a6b6828d9339c6b78f5c38e5ff2d4a231107dbe5f792b2e35013ab477a02ba064531bc9f3236418442ce917cd4afd860f9311b5c46fb759e548b91366fc16e61e67110cd41714a2da4abc3bf65cc05c396384b13ac095a09d20a6bba1148db1478bc89a8de9049e978339993e43eff92801e616fd74f1ef122b734b097111cd4fc1138a85489862f4e3ddbabdb377590cf7eb2007a50a26d13b80e97c872671e428f70510a990938fbae10b86320bce8aaa0f749626b36505613e8f53ee230041f7a5c948c89df9d6bedddca4798ed8d30a9767c404aa51bd7e03802aaede7cfe75174255220893c3ecc6268d58f74f6e5981f2c91aacf7c78208860dec854015a3bb85c8eba42e0f9708a334d56e6780ebd641910a424bc052a254a9cdd2bebbd6ae3188464ae504d9379aade26a22dfdaa66e84eb0fbcfbfbfbd3c5ef466e4da8da6f35f91c309bc0d02fae5762d01276ffb52f4f1c1d1e493a0f4b738ab060feeefeaf9d248e60235c6eab10a228225802107e0cd04537549a64ce9414f6ed62be09c251c1a92a1cefae66cf77602e555eb89ca536d5ea49b467a0dd27ea6e2622f3d8ac860fc329705d440abb79a520f1bd8376838f2bbb4e03cb697332510d176a71b73426218a43c609b98dd7c5baa7f203be42f77350b975b3c643ec3eebefca701596874107edfb5f7c00ae141575e764d8c30d81557d6aa8a341a9d073277de5428b20de61e7be93e2f6b3eaa91fcb7cc143ac26439922c93a534cc3848e23d1724a55f9da2cb3aefbb2a00df0a2919bf6702df2947a1b7bfdd06ff4935a01b2fcf5b415a6c6008b6ea2b262eeef8c4bb49bfd6743bf34a25b006c3b7b9fd8e9cbbb9412e2d799011f15bcc0ddbc4d78dacb5a909ad7d40fd7b0067c3e22f534e3251472206b67afcb1b2389ff", 0x1000, 0x2}], 0x10, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000002600)) 2018/04/10 12:54:36 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000ffffffff0008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:36 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x100000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:37 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], 0x1}, 0x5}, 0x1c) [ 948.831100] binder: 29050 RLIMIT_NICE not set [ 948.838934] binder: BINDER_SET_CONTEXT_MGR already set [ 948.844622] binder: 29048:29050 ioctl c0306201 20004000 returned -14 [ 948.851686] binder: 29048:29099 ioctl 40046207 0 returned -16 [ 948.862442] binder_alloc: 29048: binder_alloc_buf, no vma [ 948.868101] binder: 29048:29099 transaction failed 29189/-3, size 0-0 line 2963 [ 948.973324] binder: undelivered TRANSACTION_ERROR: 29189 [ 948.979364] binder: release 29048:29050 transaction 539 in, still active [ 948.986285] binder: send failed reply for transaction 539 to 29048:29099 [ 948.993216] binder: undelivered TRANSACTION_COMPLETE [ 948.998382] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:37 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400300]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:37 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x1000000, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:37 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000003000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:37 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:37 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xa4ffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:37 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}}, 0x14) 2018/04/10 12:54:37 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x10}) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f0000000480)={0x0, 0x70, "a38b4f4e40ac41675c81f6224e086284f649efbbf6d40a2ad5e2426249ef2c7c73ad753f1e2346a108fc21b67aefb6515a7864a6d675204fde3af2eb59b723c35e6cadc7ded853eab4813484fec3fde8e586e96343c9fb053e1bbcd6157d4f57e11fb854f8b8d28f9419a884ddf0f718"}, &(0x7f0000000540)=0x78) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000300)="c16a00012e260f01ca0f300f350f20e06635000100000f22e066b8ef0000000f23c80f21f866350c00e0000f23f80f21976766c7442400a56c05676766c7442402af3f00006766c744240600000000670f011424b8f1008ee80faeaf0100", 0x5e}], 0x1, 0x0, &(0x7f0000000100), 0x0) setsockopt$RDS_GET_MR(0xffffffffffffffff, 0x114, 0x2, &(0x7f0000000100)={{&(0x7f0000000040)=""/38, 0x26}, &(0x7f0000000080)}, 0x20) sendmsg$key(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000182000)={&(0x7f00000001c0)={0x2, 0x4000000000000d, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@multicast1=0xe0000001}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}}, @sadb_lifetime={0x4, 0x3, 0x4}]}, 0xa0}, 0x1}, 0x0) chroot(&(0x7f0000000140)='./file0\x00') r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000380)={0x3, 0x0, [{0x80000019, 0x800, 0x8001, 0x8, 0x3015}, {0x0, 0x7fff, 0x954, 0x7, 0x7fff}, {0xc0000001, 0x1, 0x100, 0x4, 0x4}]}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00000002c0)=0x14) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2018/04/10 12:54:37 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2ff], 0x1}, 0x5}, 0x1c) [ 949.105829] binder: 29115 RLIMIT_NICE not set 2018/04/10 12:54:37 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000003000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:37 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x14000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:38 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:38 executing program 7: r0 = perf_event_open(&(0x7f000002ef88)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000040)=""/8, 0x8}, {&(0x7f0000000080)}, {&(0x7f00000000c0)=""/178, 0xb2}], 0x3) 2018/04/10 12:54:38 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000000c0)=@pic={0x9, 0x0, 0x5, 0x5, 0xa7, 0x0, 0x0, 0x3, 0x2, 0x100, 0x4, 0x522f, 0x7ff, 0x6, 0x7, 0x1}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/qat_adf_ctl\x00', 0x101000, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x40000, 0x0) r4 = syz_open_dev$vcsa(&(0x7f0000000240)='/dev/vcsa#\x00', 0x5, 0xbf4dae679e8fd9fc) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000280)={r3, r4}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000180)=ANY=[@ANYBLOB]) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r1, 0x4008ae48, &(0x7f0000000000)) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x2, 0x0) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r6, 0x111, 0x5, 0x1000, 0x4) 2018/04/10 12:54:38 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:38 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000ff3f0000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 949.324359] QAT: Invalid ioctl [ 949.342516] QAT: Invalid ioctl [ 949.906561] binder: 29115 RLIMIT_NICE not set [ 949.912891] binder: 29113:29115 ioctl c0306201 20004000 returned -14 [ 949.913094] binder: BINDER_SET_CONTEXT_MGR already set [ 949.924958] binder: 29113:29155 ioctl 40046207 0 returned -16 [ 949.935786] binder_alloc: 29113: binder_alloc_buf, no vma [ 949.941435] binder: 29113:29155 transaction failed 29189/-3, size 0-0 line 2963 [ 950.049743] binder: undelivered TRANSACTION_ERROR: 29189 [ 950.055391] binder: release 29113:29115 transaction 542 in, still active [ 950.062320] binder: send failed reply for transaction 542 to 29113:29155 [ 950.069223] binder: undelivered TRANSACTION_COMPLETE [ 950.074377] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:38 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:38 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0963104000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:38 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x2000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:38 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff02], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:38 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(xeta)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000052000)="21130000000000000000000000000000", 0x10) r1 = accept$alg(r0, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write(r1, &(0x7f00000003c0)="44180c5030827edcf6bf39b97527f6f21443881bb2a1f64db2727897a0d1f3a55d000100007667b83ce7046eb086be4413b96bb4d6bc226737336a656cba4e5fa6a03d222835d12356b961885d6a5d93d15d9c5165522024", 0x58) r2 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x10000, 0x4000) ioctl$PIO_CMAP(r2, 0x4b71, &(0x7f0000000180)={0x3, 0x9, 0x2fc, 0x7, 0x37b}) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f00000000c0)={{0x88, @empty, 0x4e22, 0x4, 'sed\x00', 0x4, 0x10000, 0x48}, {@rand_addr=0x6, 0x4e23, 0x0, 0x5, 0x4, 0x100000001}}, 0x44) readv(r1, &(0x7f00006e8ff0)=[{&(0x7f000070bf52)=""/174, 0xfffffde9}], 0x1) socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000000140)) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r3, 0x40045402, &(0x7f0000000040)) socket$nl_netfilter(0x10, 0x3, 0xc) 2018/04/10 12:54:38 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}}, 0x14) 2018/04/10 12:54:38 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000340000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 950.168491] binder: 29166 RLIMIT_NICE not set 2018/04/10 12:54:39 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x600], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:39 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000020000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:39 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xd00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:39 executing program 7: r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = dup3(r0, r0, 0x80000) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0xb1, 0x7, 0x8, 0x100000000}, {0x1ff, 0x7, 0x1, 0xaddd}, {0x10000, 0x1fffffffc00, 0x4, 0x2d4}, {0xff, 0x5, 0x7ff, 0x8}, {0x8, 0xf36, 0x4d356d09, 0xffffffffffff7fff}]}, 0x10) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) 2018/04/10 12:54:39 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:39 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000ffffffef0008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:39 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xd000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:39 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000003fff000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 950.969496] binder: 29166 RLIMIT_NICE not set [ 950.974388] binder: 29163:29166 BC_ACQUIRE_DONE u0000000000000000 node 544 cookie mismatch 0000200004400000 != 0000000000000000 [ 950.986139] binder: 29163:29166 unknown command 0 [ 950.991150] binder: 29163:29166 ioctl c0306201 20000340 returned -22 [ 950.999441] binder: 29163:29166 ioctl c0306201 20004000 returned -14 [ 950.999471] binder: BINDER_SET_CONTEXT_MGR already set [ 951.011605] binder: 29163:29218 ioctl 40046207 0 returned -16 [ 951.021210] binder_alloc: 29163: binder_alloc_buf, no vma [ 951.021551] binder: 29163:29221 BC_ACQUIRE_DONE u0000000000000000 no match [ 951.026911] binder: 29163:29218 transaction failed 29189/-3, size 0-0 line 2963 [ 951.033930] binder: 29163:29221 unknown command 0 [ 951.046328] binder: 29163:29221 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:40 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:40 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0763044000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:40 executing program 7: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000140)) mmap(&(0x7f0000048000/0x1000)=nil, 0x1000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f000001d000/0x2000)=nil, 0x2000, 0x3, 0x31, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, &(0x7f000000b000)={0x77359400, 0x1}, &(0x7f000001d000), 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x8, 0x42000) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f0000000040)={0xa, 0x0, [{0xb9c, 0x0, 0x1}, {0xbff, 0x0, 0x80}, {0x37a, 0x0, 0x1ff}, {0xb75, 0x0, 0x4}, {0x39f, 0x0, 0x8}, {0xbff, 0x0, 0x7}, {0x40000493, 0x0, 0x8}, {0x0, 0x0, 0x7}, {0x7db, 0x0, 0x8}, {0x8c3, 0x0, 0x2}]}) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f000000d000), &(0x7f0000048000), 0x0) 2018/04/10 12:54:40 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:40 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000004018000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:40 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}}, 0x14) 2018/04/10 12:54:40 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xff000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 951.163758] binder: undelivered TRANSACTION_ERROR: 29189 [ 951.169560] binder: release 29163:29166 transaction 545 in, still active [ 951.176525] binder: send failed reply for transaction 545 to 29163:29218 [ 951.183454] binder: undelivered TRANSACTION_COMPLETE [ 951.188630] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:40 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:40 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000005000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 951.259972] binder: 29238 RLIMIT_NICE not set 2018/04/10 12:54:40 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0xfeffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:40 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:40 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000007fffffff0008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:40 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xffffffa4}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:40 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:40 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000003fff0008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 952.054584] binder: 29238 RLIMIT_NICE not set [ 952.057785] binder: 29226:29276 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 952.067011] binder: 29226:29276 unknown command 0 [ 952.072315] binder: 29226:29276 ioctl c0306201 20000340 returned -22 [ 952.081225] binder: BINDER_SET_CONTEXT_MGR already set [ 952.085158] binder: 29226:29238 ioctl c0306201 20004000 returned -14 [ 952.086730] binder: 29226:29276 ioctl 40046207 0 returned -16 [ 952.103840] binder_alloc: 29226: binder_alloc_buf, no vma [ 952.104170] binder: 29226:29279 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 952.109542] binder: 29226:29276 transaction failed 29189/-3, size 0-0 line 2963 [ 952.117240] binder: 29226:29279 unknown command 0 [ 952.117754] binder: 29226:29279 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:41 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:41 executing program 7: socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'vcan0\x00', 0x0}) bind(r0, &(0x7f0000000580)=@hci={0x1f, r1}, 0x80) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) socketpair(0xf, 0x800, 0x100020, &(0x7f0000000180)) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000200)={r3}, 0xc) syz_emit_ethernet(0xfed1, &(0x7f0000000240)=ANY=[@ANYBLOB="ffe0bf0300ffffff0affffff08004500004e000000cb9032554edb4318086c3f2cae8290151d8dfe2cff607e0db2d6d790d64a1c12195108236fc4d855c7d209"], 0x0) unlink(&(0x7f0000000140)='./file0\x00') 2018/04/10 12:54:41 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:41 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xff000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:41 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:41 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000400300000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:41 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}}, 0x14) [ 952.239839] binder: undelivered TRANSACTION_ERROR: 29189 [ 952.246228] binder: release 29226:29238 transaction 548 in, still active [ 952.253170] binder: send failed reply for transaction 548 to 29226:29276 [ 952.260079] binder: undelivered TRANSACTION_COMPLETE [ 952.265224] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:41 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff0000], 0x1}, 0x5}, 0x1c) [ 952.332450] binder: 29296 RLIMIT_NICE not set 2018/04/10 12:54:41 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000030008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:41 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000180)="660f017100660f6fb3b0000fc7afd1070fc76c0036cd38ea997ce300baf80c66b8a48d878c66efbafc0c66b8858d000066ef0f00d0640fe475d4d07aa2", 0x3d}], 0x1, 0x0, &(0x7f0000000540), 0xb95024bcdeb65d74) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x800000000000000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000decfe0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ifreq(r3, 0x897f, &(0x7f0000000280)={'syzkaller1\x00', @ifru_data=&(0x7f0000000240)="7dfd64317501bac6d241329c221dd3fa14372d299d4c508738bd28c8b6ee7299"}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='pids.events\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f00000001c0)="640f6785008000000f01c80f015800c4e1fe707be300b8230000000f23c00f21f835000006000f23f8f20f32660f388227b9420a0000b807000000ba000000000f3066baf80cb81201b780ef66bafc0c66ed676565f26467650f225a", 0x5c}], 0x1, 0x0, &(0x7f0000000040), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000000)={0x80001}) 2018/04/10 12:54:41 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xa4ffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:41 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:41 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000200000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:41 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x2000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:41 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000000100)=[{0x80}, {0x6}]}, 0x10) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000003c0)={0x0}, &(0x7f0000000400)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000440)=0x0) tgkill(0x0, 0x0, 0x0) r3 = accept4$ax25(0xffffffffffffff9c, &(0x7f00000004c0), &(0x7f00000005c0)=0x602, 0x800) fcntl$getown(r3, 0x9) r4 = syz_open_procfs(0x0, &(0x7f0000000040)="2f65786500000000000090d8b75e67e16b394342abb5158df87ea8984e79c93df7498b2b34796068700e29fbd789f9a031f23e16c96e30baed2961953b057f7a3222943acc4b8cfa4de553f8276731ddeb811efd44ea011e1a0db9074a28a826c88566b89c57cc3cca4aec41d37fa27c8daa19030d03139d0aea71d509d9a20ba7deceb656cc1308d9d1f111b6bd1595486f55e229923be4ed8cbfb78e86280b4cacf386bfa8840afb312a4c520a03b27f805d181bd09ea208931a36e888060a2d") fcntl$setlease(r0, 0x400, 0x2) getpeername(r3, &(0x7f0000002940)=@can={0x0, 0x0}, &(0x7f00000029c0)=0x80) connect$packet(r4, &(0x7f0000002a00)={0x11, 0x7, r5, 0x1, 0x4, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}, 0x14) fstat(0xffffffffffffffff, &(0x7f0000000040)) r6 = perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6}, r2, 0x0, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$dspn(&(0x7f0000000540)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r7, 0x800000c004500a, &(0x7f0000000640)) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000000040), 0x1) write$selinux_access(r7, &(0x7f00000009c0)=ANY=[], 0xffffffffffffffea) close(r7) syncfs(0xffffffffffffffff) semctl$IPC_STAT(0x0, 0x0, 0x2, &(0x7f0000000280)=""/198) ioctl$PERF_EVENT_IOC_DISABLE(r6, 0x2401, 0x8000) r8 = syz_open_procfs(r1, &(0x7f0000000300)='sched\x00') fsetxattr(r4, &(0x7f0000000140)=@known='user.syz\x00', &(0x7f0000000180)="363c51940180ebe7753205aff0fa0447a66dafe9356a7523588002a93724a0e1fe2d1192f3e19aec4d078b2ab1bb0365360f1339aa1b80de79356570d0a6b7a6025c471e7b8514989fa1e6746581add1157d812fd9ef438b5cd74178ad1fa3bb6cff15a3ede5d306b4f8d977fd65146e99d0c2b2c1d5f2c62577c3c094b374cc50eafec5b0a349c4b04ad425b5dd4d51856e426f359338dbcbe939c9da32b8ffb1f84e3df8dca651656e7818d949b14b5560d71c92335881a988a06f5c2b798dad13916946e32139ede4df933f525428b81464aea9a3c66c410bc4718ba27dab77cee9c682d9dcba6fdd36e36057a6bda603998e69e4aa516c825653071d26d991b749e7b19c2f076a0dc8f0240aabfae82984f0ee5172a6d18e0de0c1f674e57e4a71c0093db907000000000000000000000000000000", 0x137, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r8, 0x84, 0xa, &(0x7f0000000600)={0x1f, 0x100000001, 0x5, 0x6, 0x4, 0x3da, 0x0, 0xfffffffc, 0x0}, &(0x7f00000007c0)=0x20) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000800)={0x7fff, 0xa, 0xf33, 0xe51c, r9}, 0x10) fremovexattr(r4, &(0x7f0000000000)=@known='user.syz\x00') ioctl$VHOST_SET_VRING_ADDR(r8, 0x4028af11, &(0x7f0000000480)={0x0, 0x1, &(0x7f0000000840)=""/247, &(0x7f0000000680)=""/150, &(0x7f0000000380)=""/9, 0x5000}) ioctl$DRM_IOCTL_GET_CAP(r4, 0xc010640c, &(0x7f0000000340)={0x9}) connect(r3, &(0x7f0000000740)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha512\x00'}, 0x80) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') [ 953.127215] binder: 29296 RLIMIT_NICE not set [ 953.133709] binder: BINDER_SET_CONTEXT_MGR already set [ 953.137109] binder: 29289:29296 ioctl c0306201 20004000 returned -14 [ 953.146241] binder: 29289:29340 ioctl 40046207 0 returned -16 [ 953.156376] binder_alloc: 29289: binder_alloc_buf, no vma [ 953.161999] binder_alloc: 29289: binder_alloc_buf, no vma [ 953.162059] binder: 29289:29343 transaction failed 29189/-3, size 0-0 line 2963 [ 953.167632] binder: 29289:29340 transaction failed 29189/-3, size 0-0 line 2963 [ 953.287246] binder: undelivered TRANSACTION_ERROR: 29189 [ 953.292807] binder: undelivered TRANSACTION_ERROR: 29189 [ 953.302247] binder: release 29289:29296 transaction 552 out, still active [ 953.309299] binder: release 29289:29296 transaction 551 in, still active [ 953.316216] binder: undelivered TRANSACTION_COMPLETE [ 953.321371] binder: release 29289:29340 transaction 551 out, still active [ 953.328343] binder: undelivered TRANSACTION_COMPLETE [ 953.333468] binder: send failed reply for transaction 552, target dead [ 953.340166] binder: send failed reply for transaction 551, target dead 2018/04/10 12:54:42 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:42 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0863104000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:42 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:42 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xd}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:42 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000050008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:42 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00000000000000]}}, 0x14) 2018/04/10 12:54:42 executing program 7: mmap(&(0x7f0000000000/0xca9000)=nil, 0xca9000, 0x5, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000100)=0xfffffffffffffffd, 0x4) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000140), &(0x7f0000000180)=0x4) getsockopt$sock_int(r0, 0x1, 0x22, &(0x7f0000000000), &(0x7f00000000c0)=0x4) r1 = socket(0xa, 0x7, 0x6) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000280)=0xfe, 0x4) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 953.443535] binder: 29359 RLIMIT_NICE not set 2018/04/10 12:54:42 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000004000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:42 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x1400000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:42 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:42 executing program 7: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000500)='/dev/vcs\x00', 0x14000, 0x0) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000540)) r1 = perf_event_open(&(0x7f0000271000)={0x0, 0x70, 0x49, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000600)='/dev/loop-control\x00', 0x0, 0x0) timer_create(0x0, &(0x7f0000000040)={0x0, 0xb, 0x1}, &(0x7f00000001c0)=0x0) timer_gettime(r3, &(0x7f0000000200)) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) socket$inet(0x2, 0x5, 0x0) r4 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x2, 0x600800) fcntl$setstatus(r0, 0x4, 0x2000) r5 = syz_open_procfs(0x0, &(0x7f0000001f00)="2f657865000000000000d50fef7afaf807e3c2f98d0d02812e3ca05fc31e623a2a051fc20fa5a02d84267a0067ac78b8ed1ee48d8097f99d3188a59818771e21974fc3d02efdabd0512782c2474e0a8c17538091e53bdc54aa574b0615a98c9046beb56b8bb5744fcc54b400dec854d2da9efbbdf5e4c75fae864cc0fce7514c133f17a1b93b735d3d5b3e10b683128034ec6e19ed879a810a401f95b9860b41b3b8683ac1b6f21c21769cbd07a9b0f2ab9711ecaaf67a7a74beef377c60b435f3eee826d174ca7516e89abcebd589104d80402accdc8d7ae101c57bbc26c33df519152ef8daf388b20fbc8c55cdb7d471a822531e7d7b88bbb269d72051d9f92d569935ce2b387f9e30fabf336e53827a8bdd4f7c3fba515ade98e68d965b0a52ec80d74eebb4c2904be489d2d473dab9f302545f6fd2973979092a404bdee5aad5d3eb20cb69f2e8c01eab7fbf98463fcdeb034f041dbd1cd779e40828d9db22f3e839a3f58a0e6ac2312fb1f95ffb6e97c6cc55353b7301984f08f9ca247456b5628692d5e443455794a27c4b194226b60a3b19bf09a2595e1d5aa5eb62934533af467d7de9c30c5f7b4db1f048c64587b71b2be65c78") fgetxattr(r5, &(0x7f0000000240)=@known='user.syz\x00', &(0x7f00000002c0)=""/159, 0xffbb) fgetxattr(r5, &(0x7f0000000080)=@known='system.posix_acl_access\x00', &(0x7f00000000c0)=""/249, 0xf9) r6 = syz_open_dev$sndpcmp(&(0x7f0000000380)='/dev/snd/pcmC#D#p\x00', 0x40, 0x0) ioctl$DRM_IOCTL_AUTH_MAGIC(r6, 0x40046411, &(0x7f00000003c0)=0xff) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x0) dup3(0xffffffffffffffff, r2, 0x0) readahead(r5, 0x2, 0x4) getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000400), &(0x7f0000000440)=0x4) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x101000, 0x0) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000480)={'mangle\x00', 0x4, [{}, {}, {}, {}]}, 0x68) fchdir(r7) mkdir(&(0x7f0000efa000)='./file0\x00', 0x0) 2018/04/10 12:54:42 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57e], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:42 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x200000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:42 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000034000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:42 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000], 0x1}, 0x5}, 0x1c) [ 954.239821] binder: 29359 RLIMIT_NICE not set [ 954.245909] binder: 29357:29359 BC_INCREFS_DONE u0000000000000000 node 555 cookie mismatch 0000200004400000 != 0000000000000000 [ 954.257677] binder: 29357:29359 unknown command 0 [ 954.262623] binder: 29357:29359 ioctl c0306201 20000340 returned -22 [ 954.269638] binder: BINDER_SET_CONTEXT_MGR already set [ 954.271917] binder: 29357:29359 ioctl c0306201 20004000 returned -14 [ 954.275058] binder: 29357:29405 ioctl 40046207 0 returned -16 [ 954.292385] binder: 29357:29407 BC_INCREFS_DONE u0000000000000000 no match [ 954.292393] binder_alloc: 29357: binder_alloc_buf, no vma [ 954.292418] binder: 29357:29405 transaction failed 29189/-3, size 0-0 line 2963 [ 954.299513] binder: 29357:29407 unknown command 0 [ 954.299616] binder: 29357:29407 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:43 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:43 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0263044000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:43 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x14000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:43 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffa4]}}, 0x14) 2018/04/10 12:54:43 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000001000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:43 executing program 7: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ff40ffe90009149b00f99b", 0x12, 0x0, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001a00)={&(0x7f0000000000)=@kern={0x10}, 0xc, &(0x7f0000000180)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="d50000000000010027bd8a00000058c0a72f2cfc5ac412e85321c420fa4f0000e4bbfff681615a293f1bca8f51fa63ffb4a76dfce65f4a1e458d207572fc171980c979f7"], 0x10}], 0x1, &(0x7f00000019c0)}, 0x0) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000100)=0x133, 0x4) recvmmsg(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f000072a000)=[{&(0x7f0000000380)=""/236, 0xec}, {&(0x7f0000de6000)=""/4096, 0x1000}], 0x2, &(0x7f0000fd0000)=""/100, 0x64}}], 0x292, 0x0, &(0x7f0000fd0000)={0x77359400}) 2018/04/10 12:54:43 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000], 0x1}, 0x5}, 0x1c) [ 954.428445] binder: undelivered TRANSACTION_ERROR: 29189 [ 954.434785] binder: release 29357:29359 transaction 556 in, still active [ 954.441696] binder: send failed reply for transaction 556 to 29357:29405 [ 954.448621] binder: undelivered TRANSACTION_COMPLETE [ 954.453756] binder: undelivered TRANSACTION_ERROR: 29189 [ 954.515311] binder: 29416 RLIMIT_NICE not set 2018/04/10 12:54:43 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x1000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:43 executing program 7: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x3b, &(0x7f0000000180)="5811000100000000000000a7d174332b71f8ff6c872c8beda162e01408f28109ed7dff6f6d0b7d4ba96c08625038a4193ee19953d30af8b8977e82f49bbef88e97fd2c221b3e483c752c1227d9760cb9af321ccd170a49d55f9198e25527fd9e2e28f385a9d0a19ffb6cf54282b3c7e62a8f2584651b6e3c7764ae753c126b2a5301f97357dd6581b5b4d1adf3afb0535643715d2b69282bb1596690515bd9242b89cee909a01447f186fa0f342ecb62a5d704ae94782f68379e39ec321d017b835f8ce08ddd8f48b7", 0xc9) 2018/04/10 12:54:43 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:43 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000040180000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:43 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000]}}, 0x14) 2018/04/10 12:54:43 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xfeffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:43 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x400, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x3f, &(0x7f0000000040)=""/249, &(0x7f0000000140)=0xf9) connect(r1, &(0x7f0000000180)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x3, 0x3, 0x3, 0x1, {0xa, 0x4e20, 0x100000001, @loopback={0x0, 0x1}, 0x5}}}, 0x80) bind$inet(r0, &(0x7f0000b9bff0)={0x2, 0x4e21, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000fa0fff), 0xffffffffffffffbb, 0x20020003, &(0x7f0000385ff0)={0x2, 0x4e21, @loopback=0x7f000001}, 0x10) 2018/04/10 12:54:43 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000], 0x1}, 0x5}, 0x1c) [ 955.305353] binder: 29416 RLIMIT_NICE not set [ 955.309524] binder: BC_ACQUIRE_RESULT not supported [ 955.314996] binder: 29414:29463 ioctl c0306201 20000340 returned -22 [ 955.324448] binder: BINDER_SET_CONTEXT_MGR already set [ 955.329407] binder: 29414:29416 ioctl c0306201 20004000 returned -14 [ 955.333918] binder: 29414:29463 ioctl 40046207 0 returned -16 [ 955.347301] binder_alloc: 29414: binder_alloc_buf, no vma [ 955.349750] binder: BC_ACQUIRE_RESULT not supported [ 955.352960] binder: 29414:29463 transaction failed 29189/-3, size 0-0 line 2963 [ 955.358059] binder: 29414:29467 ioctl c0306201 20000340 returned -22 [ 955.482595] binder: undelivered TRANSACTION_ERROR: 29189 [ 955.488193] binder: release 29414:29416 transaction 559 in, still active [ 955.495123] binder: send failed reply for transaction 559 to 29414:29463 [ 955.502071] binder: undelivered TRANSACTION_COMPLETE [ 955.507247] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:44 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbb8]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:44 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='\fc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:44 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000030000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:44 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x2}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:44 executing program 7: r0 = perf_event_open(&(0x7f00003a8000)={0x2, 0x70, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000040)="63707526303c21b8d009000000000000007878b2fe44897367ffa75134df22ad89c805000000d72272e82ad3283800619edfba1ae1f24c64a61d513e3e502945c2db00000000000000050fb902ae9f2109333b00e30335ecfd7e89bff18829cb97541bd006bf3dcf376e93a15906083ba783fa3e7318893c26819bee569f728184be5efc06cc650d421908182b69c3730e559e2b6ca237f264987ed574e36cd3efd745ead1044fd7e8377f65b71c79a18e2e601929cf8ccab2eadac54d1c3e7dae98996be67c10d7c236cde0355ab2fb01000000000000004db1b927234daae71562f2c40fa04b9a926799a176640bfbbb8761db49122d12fa7dd435f436eb52f1b72b5a63647145b26ac18c7892c002f59a6e92f49c1d56c78f5d8e442eb8392793a4d5e465f243af7ec58aee2c29edc4be7470c170ee3b73b03bc6edca93bb83d65940259a05a99a887365e9fec7facd7b25e5d270bc7c6e0700000000") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000380)='/dev/rfkill\x00', 0x1040000000010080, 0x0) getsockopt$netrom_NETROM_IDLE(r1, 0x103, 0x7, &(0x7f00000001c0)=0x78225e7b, &(0x7f0000000240)=0x4) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000280)={{0xa, 0x4e21, 0xffffffff7fffffff, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7fff}, {0xa, 0x4e20, 0x8, @dev={0xfe, 0x80, [], 0xbe}, 0x293}, 0x2, [0xcceb7708000, 0x7fff, 0xfab, 0x7f, 0x4, 0x10001, 0x3, 0xffff]}, 0x5c) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000200)=""/25) 2018/04/10 12:54:44 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:44 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}}, 0x14) [ 955.590807] binder: 29478 RLIMIT_NICE not set 2018/04/10 12:54:44 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa6050000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:44 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000004000000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:44 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000017000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0xfffffffffffffffc, 0x3) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000358fe0)={r2, 0x0, 0x0, r2}) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000018000)={r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3}) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) 2018/04/10 12:54:44 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xd00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:44 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:44 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000ffffffef000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:44 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xd000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:44 executing program 7: pipe(&(0x7f0000000140)={0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0}, &(0x7f0000000040)=0xc) fcntl$lock(r1, 0x5, &(0x7f0000000100)={0x2, 0x7, 0x7fffffff, 0x6, r2}) write$rdma_cm(r1, &(0x7f0000000980)=@notify={0xf, 0x8, 0xfa00}, 0x10) [ 956.386374] binder: 29478 RLIMIT_NICE not set [ 956.391274] binder: 29476:29526 unknown command 0 [ 956.396724] binder: 29476:29526 ioctl c0306201 20000340 returned -22 [ 956.405268] binder: 29476:29478 ioctl c0306201 20004000 returned -14 [ 956.413049] binder: BINDER_SET_CONTEXT_MGR already set [ 956.419429] binder: 29476:29526 ioctl 40046207 0 returned -16 [ 956.429280] binder_alloc: 29476: binder_alloc_buf, no vma [ 956.433213] binder: 29476:29530 unknown command 0 [ 956.434969] binder: 29476:29526 transaction failed 29189/-3, size 0-0 line 2963 [ 956.440244] binder: 29476:29530 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:45 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb80b000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:45 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0363084000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:45 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:45 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x1400}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:45 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000005000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:45 executing program 7: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000012000)={0x2, 0x70, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ppoll(&(0x7f00000000c0)=[{r1, 0x10000000004000}, {r0, 0x6144}, {r0, 0x102}, {r0, 0x20}], 0xbb, &(0x7f0000000100)={r2, r3+10000000}, &(0x7f0000000080), 0x8) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x0) r4 = dup2(r1, r0) ioctl$KVM_S390_INTERRUPT_CPU(r4, 0x4010ae94, &(0x7f0000000140)={0x69, 0x3ff, 0x6}) 2018/04/10 12:54:45 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x14) [ 956.564721] binder: undelivered TRANSACTION_ERROR: 29189 [ 956.570387] binder: release 29476:29478 transaction 562 in, still active [ 956.577360] binder: send failed reply for transaction 562 to 29476:29526 [ 956.584279] binder: undelivered TRANSACTION_COMPLETE [ 956.589447] binder: undelivered TRANSACTION_ERROR: 29189 [ 956.669917] binder: 29540 RLIMIT_NICE not set 2018/04/10 12:54:45 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:45 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x14}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:45 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000050000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:45 executing program 7: msgrcv(0x0, &(0x7f0000000000)={0x0, ""/79}, 0x57, 0x0, 0xa4a3ad41a879dde0) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x80) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f00000000c0)=[0x5, 0x80]) 2018/04/10 12:54:45 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xff00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:45 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:45 executing program 7: r0 = socket$inet6(0xa, 0x40080003, 0x9) read(r0, &(0x7f0000004f45)=""/187, 0xbb) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f00000000c0)=0x40004, 0x6f) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) 2018/04/10 12:54:45 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000003fff0000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 957.457197] binder: 29540 RLIMIT_NICE not set [ 957.463167] binder: 29534:29540 BC_FREE_BUFFER u0000000000000000 no match [ 957.470189] binder: 29534:29540 unknown command 71303168 [ 957.476091] binder: 29534:29540 ioctl c0306201 20000340 returned -22 [ 957.483698] binder: 29534:29540 ioctl c0306201 20004000 returned -14 [ 957.483863] binder: BINDER_SET_CONTEXT_MGR already set [ 957.495921] binder: 29534:29586 ioctl 40046207 0 returned -16 [ 957.507512] binder_alloc: 29534: binder_alloc_buf, no vma [ 957.508620] binder: 29534:29589 BC_FREE_BUFFER u0000000000000000 no match [ 957.513202] binder: 29534:29586 transaction failed 29189/-3, size 0-0 line 2963 [ 957.520129] binder: 29534:29589 unknown command 71303168 [ 957.520213] binder: 29534:29589 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:46 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:46 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0f630c4000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:46 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8030000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:46 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xa4ffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:46 executing program 7: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) connect$rds(r0, &(0x7f0000000000)={0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r1 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt(r1, 0x800000010d, 0x80000000000b, &(0x7f00001a8ffc)='\x00\x00\x00\x00', 0x4) 2018/04/10 12:54:46 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000200008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:46 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}}, 0x14) [ 957.643310] binder: undelivered TRANSACTION_ERROR: 29189 [ 957.652209] binder: release 29534:29540 transaction 565 in, still active [ 957.659196] binder: send failed reply for transaction 565 to 29534:29586 [ 957.666113] binder: undelivered TRANSACTION_COMPLETE [ 957.671245] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:46 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803], 0x1}, 0x5}, 0x1c) [ 957.750621] binder: 29605 RLIMIT_NICE not set 2018/04/10 12:54:46 executing program 7: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x400000, 0x8) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"d202b999cf85000000000088f301e710", 0x100000102}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000100)={'vhan0\x00', 0x400}) r2 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000180)={0x20000034, &(0x7f0000000140)=[{}]}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) 2018/04/10 12:54:46 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x100000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:46 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000010008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:46 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa605], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:46 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xfeffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:46 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000020008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:46 executing program 7: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer\x00', 0x301800, 0x0) getsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00000004c0)=""/147, &(0x7f0000000580)=0x93) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e23, 0x6, @ipv4={[], [0xff, 0xff]}, 0xdf7d}}, [0x6, 0x10001, 0x59, 0x7, 0x7ff, 0x9, 0x1, 0x1, 0xc, 0x3, 0x0, 0x4b, 0x8, 0x77b479d6, 0x2]}, &(0x7f0000000380)=0x100) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000003c0)={r1, @in={{0x2, 0x4e20, @broadcast=0xffffffff}}}, &(0x7f0000000480)=0x84) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x200002, 0x0) socketpair$inet(0x2, 0x4, 0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) shmget$private(0x0, 0x4000, 0x10, &(0x7f0000ffc000/0x4000)=nil) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f00000005c0)=0x3, 0x4) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000100)={{{@in=@rand_addr, @in=@local}}, {{}, 0x0, @in=@broadcast}}, &(0x7f0000000200)=0xe8) r4 = openat$cgroup_int(r2, &(0x7f0000000000)='io.max\x00', 0x2, 0x0) write$cgroup_int(r4, &(0x7f0000000640)=ANY=[@ANYBLOB="393a340da0a4b25097231c04e50700000000000000ba3d38d354132faff6719e7e563bed1fedd8291bdeb1c9801509b9292c41e065ff38d900000000000000000000000000000000"], 0x13) socket$alg(0x26, 0x5, 0x0) [ 958.544660] binder: 29605 RLIMIT_NICE not set [ 958.548096] binder: 29594:29651 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 958.556225] binder: 29594:29651 unknown command 8192 [ 958.561619] binder: 29594:29651 ioctl c0306201 20000340 returned -22 [ 958.570479] binder: BINDER_SET_CONTEXT_MGR already set [ 958.570704] binder: 29594:29605 ioctl c0306201 20004000 returned -14 [ 958.576597] binder: 29594:29651 ioctl 40046207 0 returned -16 [ 958.596989] binder_alloc: 29594: binder_alloc_buf, no vma [ 958.601316] binder: 29594:29655 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 958.602711] binder: 29594:29651 transaction failed 29189/-3, size 0-0 line 2963 [ 958.609614] binder: 29594:29655 unknown command 8192 [ 958.622706] binder: 29594:29655 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='\vc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:47 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:47 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:47 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000040000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f4], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:47 executing program 7: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000100)={0x0, @loopback, @rand_addr}, &(0x7f0000000280)=0xc) connect$packet(r0, &(0x7f00000002c0)={0x11, 0xb, r1, 0x1, 0x4, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000000)=0x1e, 0x4) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) flock(r2, 0x2) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000140)=""/246) ioctl$EVIOCGREP(r2, 0x40047451, &(0x7f0000000000)=""/174) 2018/04/10 12:54:47 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}}, 0x14) 2018/04/10 12:54:47 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xd00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 958.732345] binder: undelivered TRANSACTION_ERROR: 29189 [ 958.758144] binder: release 29594:29605 transaction 568 in, still active [ 958.765171] binder: send failed reply for transaction 568 to 29594:29651 [ 958.772129] binder: undelivered TRANSACTION_COMPLETE [ 958.777334] binder: undelivered TRANSACTION_ERROR: 29189 [ 958.779720] binder: 29671 RLIMIT_NICE not set 2018/04/10 12:54:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20001ffe], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:47 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000050000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:47 executing program 7: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fe1000)={0x5, 0x83, 0x80, 0x1000000000000f}, 0x2c) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x1, 0x5, 0x9}, 0x14) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x80, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0xc, 0x4, 0x4, 0x100000001, 0x0, r1}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f0000fed000)={0x1, 0x6, &(0x7f0000fedf90)=@raw=[@map={0x18, 0x0, 0x1, 0x0, r0}, @map={0x18, 0x0, 0x1, 0x0, r3}, @map={0x18, 0x0, 0x1, 0x0, r1}], &(0x7f0000919ff6)='syzkaller\x00', 0x7ff, 0xe1, &(0x7f0000440f63)=""/225}, 0x48) fdatasync(r2) signalfd4(r2, &(0x7f0000000040)={0x4}, 0x8, 0x0) 2018/04/10 12:54:47 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xff00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:47 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000184000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:47 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@mcast1}}, {{@in6}, 0x0, @in=@multicast2}}, &(0x7f00000001c0)=0xe8) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x4e20, @rand_addr}, {0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0xfffffffffffffffc, {0x2, 0x4e20, @local={0xac, 0x14, 0x14, 0xaa}}, 'vcan0\x00'}) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x7f) 2018/04/10 12:54:47 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0xfffffffe}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 959.582492] binder: 29671 RLIMIT_NICE not set [ 959.588852] binder: 29670:29671 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER [ 959.596987] binder: 29670:29671 unknown command 0 [ 959.601877] binder: 29670:29671 ioctl c0306201 20000340 returned -22 [ 959.608855] binder: 29670:29671 ioctl c0306201 20004000 returned -14 [ 959.611087] binder: BINDER_SET_CONTEXT_MGR already set [ 959.620802] binder: 29670:29713 ioctl 40046207 0 returned -16 [ 959.631463] binder_alloc: 29670: binder_alloc_buf, no vma [ 959.631703] binder: 29670:29714 ERROR: BC_REGISTER_LOOPER called without request [ 959.637128] binder: 29670:29713 transaction failed 29189/-3, size 0-0 line 2963 [ 959.644697] binder: 29670:29714 unknown command 0 [ 959.644795] binder: 29670:29714 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='\rc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:48 executing program 7: r0 = socket$inet(0x2, 0x4000000805, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x4e21, 0x20, @mcast2={0xff, 0x2, [], 0x1}, 0x5c}}, 0x8001, 0x5, 0x2, "c304ec76ba20b862c7a6fa37d4205df1dfb34c83a9c00f9e0b3bdcadcca0a77a5cc8592e2f78f73dd7f7d797e04e9d1fd453f9f21cc1fd799be4790780f7393a4fb80d026945c35e4207967fd2d223cd"}, 0xd8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x0, @dev={0xac, 0x14, 0x14}}]}, &(0x7f0000000140)=0x10) 2018/04/10 12:54:48 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000108001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:48 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:48 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xfffffffe}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:48 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}, 0x14) 2018/04/10 12:54:48 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:48 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) [ 959.767206] binder: undelivered TRANSACTION_ERROR: 29189 [ 959.772927] binder: release 29670:29671 transaction 571 in, still active [ 959.779880] binder: send failed reply for transaction 571 to 29670:29713 [ 959.786785] binder: undelivered TRANSACTION_COMPLETE [ 959.791958] binder: undelivered TRANSACTION_ERROR: 29189 [ 959.825949] binder: 29725 RLIMIT_NICE not set 2018/04/10 12:54:48 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:48 executing program 7: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x400100, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000040)={0x2, [0x0, 0x0]}, &(0x7f0000000080)=0xc) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000100)={{0x9, 0x7, 0x5118, 0x4, "aa37981bc0e1ef5cc4fe3a3e692b14800b6ee204286e0b743692f8aadedc5530cacf5c239b5951c8f2ee8690", 0xc577}, 0x3, [0x8000, 0x5, 0xffffffffffffbd2c, 0x1, 0x5, 0x1, 0x3, 0x8, 0x1000, 0x7, 0x52b2, 0x0, 0x88c, 0x1ff, 0x7, 0x0, 0x8, 0x0, 0x5, 0x800, 0x4, 0x400, 0x3f, 0x20, 0x1f, 0x2, 0x60000, 0x4, 0x8b, 0x6, 0x96, 0x0, 0x3f, 0x40, 0x7, 0x80000001, 0x3f, 0x4, 0x3, 0xffffffff, 0x8, 0x0, 0x2, 0x5628, 0x80000000, 0x4, 0xa1, 0xa8, 0x1, 0x2, 0x1, 0x4, 0xa0000000000000, 0x1f, 0xd67, 0x347, 0x6, 0x1, 0x9, 0x6, 0x1, 0x4, 0x4f3, 0x3, 0x4, 0x7, 0x5, 0x7, 0x3, 0xc5a, 0x3, 0x3, 0x3, 0x7fff, 0x7, 0x53a, 0x1, 0x9, 0x8000, 0xfffffffffffffffe, 0x81, 0x2, 0x6, 0x5, 0x9c50, 0x10000, 0x12e, 0x100000001, 0x400, 0x4, 0x2, 0xfffffffffffffff8, 0x6, 0x2, 0x9, 0x100, 0x81, 0xf53e, 0x6cf2, 0xe03, 0x8, 0x3, 0x7, 0xfff, 0x2c, 0x4, 0x10001, 0x2, 0xfffffffffffffff7, 0x28d36e5e, 0x1ff, 0xa0, 0x4, 0x7, 0x4, 0x5, 0x3, 0x400, 0x1, 0x6, 0xff, 0x9, 0x6, 0x7, 0x0, 0x9, 0x5, 0x2], {r2, r3+10000000}}) connect$vsock_dgram(r0, &(0x7f0000000600)={0x28, 0x0, 0x2710, @my=0x1}, 0x10) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000640)={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x17}}, {0x307, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x4a, {0x2, 0x4e24, @rand_addr}, 'bond0\x00'}) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000006c0)=0x0) wait4(r4, &(0x7f0000000700), 0x0, 0x0) pipe2(&(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) syz_mount_image$xfs(&(0x7f0000000780)='xfs\x00', &(0x7f00000007c0)='./file0\x00', 0xb0b, 0x6, &(0x7f0000002b00)=[{&(0x7f0000000800)="b6fe6d5b7ee1bbcceaab1295ab3a9c6b170df5c1229d2247d239f82a4c3a31cf1fd7360e01011c3f99175e72982b3c2365721e871bc7d7a1addb28090586b7246f1b07bdf2d9e616970f393a041324413621051875973df45318da5471fbbf5b29992f89641cec73cd021a37d34268eceeb6ed5c961a59afed7647a759bd46a89c67410ea7be556fd2d2b0e55a2b864095a8cf03b34e7d94955ec0c16c14466cb0fb6294b64c543c214599a79b7bccacb81b5aae2eb6f1992ea7dd431d17152415bea91d1f53cfb9d1a2b1f28523384b811c6da7707253a4e8", 0xd9, 0x9}, {&(0x7f0000000900)="65b84ba8b29ad19838fe4a4e272335d47f45c0d68d93a11688605fac6c234b8023bf7e737512ce9e3c933c55792b0bd34aee725a25b4ea2f2abda354a6828ce67ffa8a224c725b5f9240779cf35988deb6a296b180a1d8a4630957e7d7d45c121fc1259a90b57046626ed4b871259ea1b5cb50e3e78d77caf9324c13a3a0ae57c45aa2d33af9f23d0a2f262048974ff35a6779178850f6b932d179bbd998d9dfedd3983443aad4e61aec1dea49e0a91fbd9e477dcf564210180161b28fae29b28207db3841aba2a50f93e0a59cb2c5791db924c18d4240dabfd44c929080fc11924270aa41616155e33b61b0735039337c57e73af8b42505cdfe23c04d27dd4ea7d9a8b1c3b6a215bb50accb1656ccb330a5518f93432eb0f1795d75f29815a10c91ea2ae77577ffb8ee39b6d1182515d0453d07c9686a756e888f6abdbc01b86fe6a2cf2ad9a732f65f38820c1153408d2463007a0260670a7c39690147659aef50cee3d5c4659331bf2317697d465513ae922c93222f0793f6e01ad982bd7757b338ab62c84844b5a544e2bedd3d1a6ed15064f5d71c39104328506d83c81e13319d8719896c35524a2feb5305d5fd4460f220500b817694f51427efcf97ce8fd9a6046fa83d58a8283a9bb6a2d36be9a40cf3add9e896f8286d3517977120a2b7e8ad26a92eb4a8c1ee8465d3e8e800482fcc405bba10435982090a3096e2d0e498f6e2b70994d8a0ae081b79ad1de350a9ab65123337ab19106e382a9d38642b07e545df986bd1371205116e65c15928ec99589d66112d60cb7cd4e82d4a2b8eef5a261c382347103982efe0f54d398b544a3f9d2c4b1bbe3f8ec279b4b8f9d8cc159a4c9a996655ca618d361ce5e0b0275b7677daedf3916b8f3bb5fe69149121083f62c06c9bd04b5a45e4550866c90e5e5f4cf7720158faea644bc3bc14f9f49dd65136af7a88e01ca9f6627ec1a9e31e29f22ed03eaa3106bfaf18f4bf69fa82d6c051e4e469ae864d8d714d99dfbc8d92e673368af53cdd3c64fa97c58c7746eda016f3c61e48b6cc668bcc871bcf70fe1c626186217dc81d3fb2d5bc987d73761542d5fd6143cbe9b35054811762684d24c8229539523eb7442c3024bf88ea5607b743ca8cbeac20fda3baf189ed942786b9573f1ecaa3850d80f704c9d22dfabaf2494c8f103fcd0e1caaa112c8e70f4b2206216bd187a9cd2e9d26e23d1800e2b3e89bc78a55e58e2de45d4a676059c9fc8c13c4cabcf9a2d82877cada0ed1ee7692db2d473da761caceaf5198ea71a9d82ff42a3a0816479dc5ef08983937077eeed239da06fcb78c50e078f96fa037b9412bb4f1e1630f9151cf8f8db9e28e855f8f62c29b8405052ba252968ea405c8e5dac58487090b05c800d28a1e55da2a29dccfd7fbbb797f696916f06d1e0ad92637ef6fb63994859efd25a3e8fa6b51b5abb50cd0cdf23cf635aeb9cd7ef88bd7cb1288329b8181df2e271cd1118a7c704bd0d409e18aaf16d431b336c33f9eaf6b38c1d644921d4672da37133e563b62192ea32f776df6804033961389b5ca36a2cf991a7063f0ec8f3a09ab9e19e0faa6d073ec0057ea12eed08da32a34195e01ac35c28082c69210652fad3ff135cec426c9dc2b5f643150636333ab37ffa3f3a7aa1c26d5abf65d9eacbf07aacd1f3f2dac2ae90c94d7514453d8d6645299ad11c89d7fb0708528ad8d94bb3bd02096f6157e177ff57102f6eb0430bd7c79f1fbf2fd50826f19bdc45bd5f1657263b5261fc96c5e136c920f30ea6b4d4c2c81d6ba3c477e3693625db3c6bf55b954af170b19ac9c134648e143cdda293c905fddbccc80e5e7fc6030318f8ecfdc70407998d6c00cce1bbeeab5aeb885c1076687ae106edb2175a24c77a0d6da3365ceb4ee8d3dcf5ea562414b3530a1b7c18396f6c16f2943b319bda70c28cc8bc898e59b83cec0b87203f1a256cf673b7533f80f2b302d880fd176bbe4aae278e4eac05956c0243db81bfefa5734f94975ed8ec94feaab5668fb23905eed9e804b3303e7772a42804d082585bb0b29b0ef8a10b556f718a9bbb98e5c53ba894cee613767ad2bad95ced0900de75eb8c7e3e461b30f20efa86c3bdc05bcf2a64f58a639399a5f1b511e6b56aecc7fc994668eef2f36110a2402752a4868f1e93c1f665cdcb6f4d3cf160b5bcd54fe7996e508a0f86f283dede3d6d59a265b5f89ccf2217841d285118a4ef6bfd69556b5b635c401a1e1c5d5cfed48090b88e3ae9dd73d82698aed448b8c93b996aab0016b543d6a2822c36e5cca052946a1815762779067c4b4ab207962d28b2505b4a356da201836044f9fe69a20c3b3e14cd786460802f0b5e0435c4084ad7e244992e31cab969de9de6aaf93531138ad6f5b62a391be40bde02b979c91361a13b8d5231acd1e57da1b2e108712d024d4eb2456c0fefcb5aee22b978c47318788d3e84e9a97fae72ff23fa633003e4dd893868c09ae3ede6e8521f9d09f0fb1f4f14a430050555f6f0b11aebc1815b6764ce8d4943b1a1842a6e17547c8021fcc4483e9302ef95c676459f7c499f0888fce992ddb1e1e10ef1eaeefd9c2d9cae3d8d97ac7e41fc9c3419fce4ea9cbb03c07ba6bdd548e6d00f53267de1e337459d50f2f74917acae8c081a7e9405a79eb6404b083605617c43509b63d0dd2036fdd12b640335de7aa9ba880aa936219f5e124e4d072f7d842d36b5ed14fcf7b38a2533e0ef41970ccd756e5a8b825835957ae60970a39d46d4883ccf0de8941da6431dff99a522d6a00934454439e5fe69e806d09b550ec17938e32022969a08b1061574fcf292de236f1fc0e472bdc6a00b7d20ef3edba0b6caa5ba42e5772462108731bd3fd2889c5ed1d1c61fefd4f743c7d46e7c780a1f0581ad442d420df273c73e449911130eb629b03a31cbda91932e42098dc2409fc332988d1804e4057b27e8f8e2d3f00978aeaccdf7fcb7033317fb3017e7fe415600a24fc764b7ad16e485b0c8ba07824f8a7922786245e95f4758b50486e9db7d78d03b69458f281490c507ccf7f55b219e08cd7332e63f8a904d8b8742f6cbb25f676696af770aa9859a9d114d89e17a258a6db5a585ee6402b7c915da35e1162e378624ed0345ac3039e02335b97dca44dd11a252ac331c7a86f605e07d98a79f517e068a31389f55a8e21ec553cb6792853c5dd4aec6397a76051bfdf0e25933181bbc55025fce4d37ea591d798761c3daeb56705e2a284ac05d914ba08b45d89ae537b12b52498574b653ea29bd001df2ca566a80b037dfc71e1ff40f35b83eee2352aa4909167cd7b1a800b1748a36729c61e59e1c7e3bc2ccd6c9cc421915b8adc9073bdba7631d00960ee8af6c41c2239b2ec9863a503837524cd4759993f7094465368e17e25a485adafd3f7af9b26f33f23268caf242b6f8cbe9d04a2f2a365a217073c7371e9f88238710c89739f421aa6ff2b1675ae373f15ced07f8176d950b42d6e16b4bcf65b4563dfb84b23d3db3934380b4663f41af891a192e25aa41e9408d5e808dccd4709a3810b248979fa5e85376ec5cd85fa2f28a7144b78224016ed40a1a59b79c28bb7650b3be9a73f1fa8d45d7cdeb779fe1f1c420d1c37f7416a13827d4657077ebb9cf9b1cd4cb362b13592a10d9b5155362a0303099645f2b96c5bcccb9b0fe277e45891350e1295a5486476c169d58c78c1a447958139657bea3bfe8f2af5f662b23eaebc88d9e0e8f938bd18988902dfe210985ef65a9213d4d68a4d158755b9a9f49de28c52f06d9bc69ebd80aab6ac0621376da7427f7ad90a3fb358ae8d5628ef6fd22331124a38bc26726877664ed116ae70158e94786d73718139d8b739c67811a8fdfeae4922e4a2050465f8fd3a6cbb02b72bcdbb7d455bc232736faaaa821fba8ed3828db1dac1c051fcb4c4c978818df4716b091e911797e15e9947cbffbb26d37a9ffd2d6b1d36f91c209c1a48849e387773796bd8fb7e121311dbc46914274162ba7232bbf2dda55fe1093592119235f0c7eca68f20c2faf18d0caf5257c8e6e032555014bb1e8b7a1d070a16da4dfb5e3791891ce31c52416e0295ff52fdfc871b08009640d8a3e4feabbf3ced02389a8e0580518322563b25d3e0c23d3dc59f669691d1486c4c567bb03c98d7d30d31e382d46842b93e8cc1ff4f6d4bfe8c0123475e95360c20f573aee783794b6297eeccc1698d2fd257025d12ee39e8230226f81d70f7e7a6061f11d305e8a6ef516790c7488827b3b438f0acd593af41db525a6ba270cb4ef111734d9d25845ca6dabe0023c4b9438a6ec14e3d17c4a89b70961f943f4fd7f72c69c64c76957787a80d13e22813913f7f0055666b577971abab84b13bef990aa5b26da7c4b945d66a905b3a98bf25ae026314591b8b8c9476fe5a6c5da5bd29193521fbca7a09fccd72f6f6af35e01732831346ff828c1a060cee06fb9b9651608a45a21c8af43ef12f8a7ddd98e0229f9aa471093ab59a4bc397215f1f73ac714fd7e3cbd383b759d3f15d9ce37b2ecd5f09cecde5e5a2d72be74b29ac8fca0583a39702cc38f17d0e825d246002165726ed95400224427fe8057e8125b8d536e56eab4d3042b516fbcea8be0d6efbc0c90670e875f8e0be0257660609d269613f11e4423bf1c1562b64aa55c879dc473962bc6f48b66ff0137b27952c31aad83fd7fcad2d523d13de0a911678278f30f3e2d7f5749425d0cbf1b6e82d798a3cba6c11682383472d28f0e0746e6308b54f348c61538cc7631c6a1cfbe9bcda73cbdb96e70ffcf79d948f71043f045670e534dd219df5a8f9fbde142da95101b34ccb97e537f9009472e5ea850daea72c25f459ca5dedafb123eb7d5b82f7c12bd52cb6033f2a7c86f253b7e4591001b820a12eacb1b4b50daae7ad7c275e9936d876e41cc9441d346148ca677cedfecd9a82f694ff5354fa7da4c236c84501c11762db97789cb348003a88a0d860dea816a7abe912d0a84ca7cc17140a63e9acfd61dd44f6a6db62936b992044959369b0ac5ce3ce3c1508b4c19bb775beed8a2ebddc07d2dfa53cb17c085668833407eb2d11e4d1307935304f0178bc7f47a004f8cb7de5c5fbb697147ade9be1b17be98f00c0a9ffd5a198ca61abc35f757c02ed5a11bef96786643f2fd63e732a9bc208f35b8faa6d8ebc28cfc0db3630c03632ab7298249db60dde0628bfe8d10109b237ef5ea9a5ac192420da1e18545a9accb812103357400c5e833c8131f925402e484190d3a07be05eb15da1832a36da1c6ca8b5ae822704a097e35d3e901c4a1f7566a8e34a2923674365fdcd4d88123d9f80883d458385fa815a16eae59b66886b154c12e876df229aa81484d12d7ffa737f6cca2a7c3e0569fa90393149b5cb2ec229987d0749df9545af0f9b160d48af291bc0b9238b12e6fbb98c161378c3fede2c155f8d4130fe2d0f3eb91975967a422786467504d90d0ee6b83f10a775e14075c584fd0efd1a83b00542f18ccdd23bb16a55010643202a259fa7afdfbf5da3c82dea7a028bd55b08e84c6973beb621adccbd4c984d3e47e86b6724a20d282007bef469a7c3c733a149258b6e1a1b5a72a6d7cd9dfa988f3e26cda38f272e0c9fd89774ab28596df85ba5c500d615583e8870350b5262f061f8f30f6bb73d099e5da87e0518cd40355ef2dde8e204ad5fa978bd0f0dec5114a5fa727d6b07fc6d38ee696f02560452d816bac81c8caa40c999daca9607f3b8163cf2cfaea625", 0x1000, 0x5}, {&(0x7f0000001900)="8291582a700abf9ae7f80646cdde4f14461133addc359903dcaf7d6fbb37c74d48ae41ba4d2d75545b767bdf5d60c8cad1d68eede6d0c1217f8d13d0d2ee411bee1772d0643c7284b9d7e651271769a71d5f19446ff39de9b0a178c7730ac2a1fa95e8132ad56dbbc630826d699cf70ae13edf3cef389785a387512701ee9b99c5fbc6300c6b1c6e8a0de502758c7d22a1631553c50e1b6edac45948487098fea65befb3a3d091e939ec05075efbb4daff97e123f767cdf431a402ac162d5dda133e2692b82942172ad62e3b14b55c0c408c290660fb901fd16357045591e130e70b6968ff943f367e1730", 0xeb, 0x1}, {&(0x7f0000001a00)="d7354bfd56e9115e1c7de1447a397bf3a976e24d170e3b575bd3b649db74fbcfdfd0e946ba2a350090db5170f046937944df8136ee72388464ecc2f3403149", 0x3f, 0x1}, {&(0x7f0000001a40)="b6e16aa78963563c826272e65b5f1b66ca34a0ec573d4c10f4ab167e51a4191a08a047e270645871f6feedcd6eb45a7c3b4d12cc6232eafe1ca89db422fe27a3996b99f346e2fbabccf538f17c995565cf12c7cb0e989c06c8a8a8acb30640b3e0feae00d26a00838998a55268584451dbeeaa8c2faf494eb3b928cbfa9762828fef8c011aef816186893507802e8d6a258315df70c0f8ae7a9c22fca98db65b376a37319523a5bc792440e2d64f92ce16ab7a44", 0xb4, 0xf3f}, {&(0x7f0000001b00)="360c8ebc6d421eefc739232320603832da10fe2dfe699da5ee1750cc9b6c54a16af2b8ce4c45f5b97b344ff3423c043dc2c72f9c2ee3603a540f7ffd32e48eead9f4b35a7a35f29ddb2b6242874dfa37afe11fd0428cab71233e21d38a562bfc9852eb147159d50d2e11b0fc763c6fa8c1aed8b4f0994e283d43a7853d0f217b4beaf47f18fd903c1d69b24c6457de6f6f2b9cf7f4e215d2a342c3759dccc7df636916864fa0db9be186de21b6c01b7c1743b23799d59551fa81692ba7f7bf96d74ce23b8c8f2353a2b90cefae4f10df246ccf3d561f0f6e848b786c68c81443706624f0c90b660772af94484097e92cb5f8d2c9c2771d340baf23de1a8755359b5dae3df06fd48c529f6bf032d5afd8d5069e78f55948254ec2eefd23b8415b2a41def25fa36b49bb1b752adfda92e6599434d0f8237431cd31915b34cf660b9dbe574e6e923a658fe6f0afe43d4df7ea6e33ead99165b715d6f355825f83463505ca302f5f0a8db69d779cc733cd0e49af60266ccc2c8b560a86abcc550c58ef7bd80eb481759f992d893aff82efa2b23a5d2d037ce9522f5d9bfbf4c3f005c523e27e629c6b7828e0c526e7832727fac9344a263bf718e8f17b89383411bf96324b537f7b45faa96b786819756673f15487304d58f1563ea0d5b48c62710f06c7063bd74965f16a2f586ea55944ad99d53537b89419ffa378783cf0ed4bef6d69d9d177c34a87348e38bb836df0ad7aed399ce87d9e83d6a0532418fecf463b57968d04f67438a7af4878332a396fe8956762073e132c426a96114ddb83209cb4cb9f072ab997d689aab59b17a6b59e6cd502c9b29b693781726a6f096f8404782aa02cf8812cf138fa14b6ba915d573432c899cc04f8a4066912091bd43700027dac6c6186a8c0a5fec9e8d093cf201e1707f114bbc9ae182abb1f8d6cc8966594d763f61ac57e92a02349effb9fe6e4f4240a0d0d8fb649b44f7c1380bf79e5dda6a4fc48262a98eef1c6a7ddd36d6fe63cedcda4833d51f0b6773af0b15ee6d39f2ddd940ebff0ec390c6bd1e03ba3bffa1dec1b09332da4f63a6c38a817af5b84d79330fa86829a2efd0b69633220a072a60d1445099ebae0b34303c8f95c28c52b0bd1403ce28f017329ddf4b30b95ecad1465f8c4201bb040476ea9d60d85316d6e4686dcd6b2d6a9360839186f7e8e17255ec446fa67c53df14c42134ca9c5729d3fee09a372a43f1fe2448ba2f11ffa741dcfeee0361dccf815bc9f3626916b0516c013193149ec9b022ecb35d376d0e09254d9520133984edc308e776d85992c7a4baf9fc80ff96d845637c9506e69c8ae2f9b71e82282cc3630a5b1142384149ac42c2de67b824921c96ed90c4a72d1879e30b044bb46d300cc4e467d9bbd626d3eb0c68cef3866dca2ecbb13d71c1730c46c5bece1fcfc7097041d212197896544eaf9538c79619333714cfa82c0cfac18ec010bd2630fcbff957e7420eeec07beb08106d3551ab6f51c818c761e1d610fe111971c64e438e3bcb9466d351205cf281c8ec00985f5077e0c443dc5866de9ff5413a3c3f42675a2f141f55161ac92537fb5eb322d9ec62f4ce891431120168e5cc88ba30f651e9c212ff6166facc57f375869480567fd5107982ed07f31592aa92b7e2570bb9fe397d5daa0897769dd84089c4a3f037a9d637a36383596b2cc2209371969f288cf616a7c67eaf49f6895869edc142a8e65d77aaef0880d3fca9640ef97578122cceb8679abf97948442f792c8bd9a220ea664d6fb0792b1c57db82ac7da42f7208819276cd37dcaf570c7e35d1f79c577cf9412b2ea5181c8e9e48d09ff9210c194ff29e7e08f6d6b0dbf2d27a40e2386e7cba61ed936f4410a1377e0d45cb14dbf021ba54b22b21ffcd4ba38735c573867bb46359501c39fdcc12c92d422d0db7d9911cd1f580f46b9a8211af2d5759954364e70266a6b5310d5f692e36f598235812149c14525df81e5d3cb480031929310ddc0a7b6770e59ae798b1b6af3e0ad638069d16060e2fdd80d4b52da9d40f6125ec00fe4dbe644549458e978117c64629edd478239f553fc74956fcae7d2bc08165f185b9e3809eb25296f2d0c9c48b69e5b307492059fbdf2d8b99864d579f61565a3e4d539a4562127b670a319858ece79b2ac4dbbb1fea7c1902fb673c58effc3f7b6677213f2e010107284108901dc540c969444a7519cb19c0c38fe62699657005a72686f59639a57a0c317fec1878c35bd11f0b9d916fe5eae8b7d0eec73ed18477977cebae47a0f8cdca90a89c4becbf95063250598c2bc0769e5ab25b51ec7d0e6df5776de6217a2dedd8096352d40a25573737e1b483e52b121aafce3131fe23336e903ac220ec64bfd26f9e42ef0f4a8f8d735bf11da7be2d4a4f14fe8d0b000662438044c9dba34cc65057774dac91a13d19317c722c5db063afd86cfff58eb1fc1dca6a58bc1a4a9f5bb697d49e4a381ad807fa58feef22d15dba3a65e56073ca847a059e47396ae42c7a02e0d1a82bd8a2e2ac517fe2a794138f241c32dc91fdc55703e50b8bcac9a7d456e6341bce0ca7de0b152b958d19823f0d4e4d0933da8a65b1239be2907b6ca0445ee94eec5600212112489bf797cd5bc8f1ee7728fb8d490f14155df03863659575ad34cea4fb20803f3c4f49c3d2d4cbf005db23a57b21f9854ccd90ee4c51d95ae253be48e74ae72603b39c69926a51e6434e35f96eb6eefa4ffa06023c6a23e35d1f2301b934c2f7e660eb3a87d3f8930b49485c9f3c89344bb47606dc6ce5f40dff6ca0e5542f712035388f2b385addf462c2ae9c8360b268c5810976c47581515287d05a5a7eea5cd5437bac38c1133c0e2fd30270b8b1073dfaf80a6357516cf38f504b593033481c48cc0a197a002e900c7021e87043d296a9eebd01639c3fd232d0c40eaeff9389b68b4a0cc6dba0189b6dbffa75fde6f55a198368f214976e622fbab8f04aa9e83a30ddc3fa83ac3de931b8129d891d79335083b4f7f3b6c93247e50a6212107c9948285fa511dc24550ed2fc2287687e57dae098149559492598be463ab949dcb3b787b2c1df0108dab3de21ef6132353288810b2dacb76359d28bde9bd8e207caf5ca7a3ba85bf59b0eb001d5bac5b1f193d7d2c0b729127c98b62b674aabea0f29622d5862027af4e40dcc75aa9f0d0d42f27e0c64024c99fa90510646dd7ae031d7a7f673a485c0170b1c7a6b4f1ca8b31aef27d15ecc9ca32ff48e607035884a0d09f063527256d3d18f220cd694e2992381662791cfcd26a29d5b9da183fa58c72a00582af1ce509b2e676b1ade281142e2e06426d8337374ba5374ed08c6b8d4bdced8740b39e7aac056378413cc67aadfa3cc2bd7158c1364631c6cc50d46dfa8d029d047c7f89fe9ef6d9ddb45411d7f45d92cab31fdecde124d1df697da19eee7629e8d24b0fd7069d69cda572057cc11ab2ded5edad5ff3437fc2accffe44afd1c23df5ee71c9bf3b035d3402d5b5ff0e8dc2999962f3041120a0e74c368a2c3c5934cb7f7b9afb1b4173bd85b7a3b873ab6c1c2dc2ef5f2795d3b77a0ac44644fb3384608b07e4b5540e47d1c9bfa8b5393c8867a4ccd1461cc3a572f871383331aa6283bdfb928da14e73b64b6f2fdfe62be133c28000143410f230dd17e5e5b89547e69a90250c362228c701d3cab51abb2c128aa1919c4405d5ad54a03f61c7355ac35e42d6c5bb2e801d01b2c0f3acb045c8540daf39f53cddfd68025e0d15c3747377483a836b315b4cb48434510fb03188b074de983f75466904de35be5f1c818f1f762dcf842780f1a420b027ed101bddf68eeba13bed70a35e35150bde9171f17ec738951b1307a50b4db3eb3e5562743f17ead032ccf1b688c0070cc0d31376c9351b7aa9061e8555c7c381d0fb8e5763ef469fb90caf2600e3c1b89439075a1fd1e5725ae90c4f9acdaf01bb30c0ad2e64b572e5c0bd94796d6a3e6492ed6367c2188d912bdcd2e0247caac46963fdf674703d4c423109d910e55007956a220089daaa0504f51168bdde261a8224e0ebaaf482d3e4253641813af50d66cc9cc44258568e0e91174c572d454e90ff8dc2a738ddd903a320eda0c8f61ad22d72d1463e6ca3336660358e74d71a1295de9d5cf2049b9ad6e7bf6489b7001c953b3ba6fb803611f66a9732e4881be253c8dab4ad7c9010930e4d810e3778a0ae9679fbf263f278a3fb515871d7b94ffa3327b508ff517be7759f984040ffaad4ec62de1ec4adf721039e8d2da9d773f2f244ba59fd5a0273c014343dfd6aa3368e2e6a8ca05d5e8eb492d1fe74977a16b4ba03156534f7b90a843a9f614fb11f4266ddafc8d019d3835a687be7f10e2c50666be3492e7878135d1c60d5df9fd8ef98e19fb1a0f9d7f8bd919480cc13c32d116fb1708dcc8effd5af02d9599ef2bfe8d06058812bb5fee5fa46643185de6169a598751a23719988748a5effb114bd895524da2c4cb9ee901d70bf11fc05fff2e16a628d956443881b643d6c61f9207ec2593836c451e8bb7a29a4622c3f2fecdd333f960bbf4b0ac694bbbd76b5a21bb18a589b203da4c10e74baf7ce68f2a41935e7a0c0661bfdbf55979b3dc3617b62486420acc8abf9c3f950012123856141665e39f46025e1d44b8cc6690302687279ee14db0427e0d46c2b0d86712d1d0a1bb88dde01dcf9b7ddcd16096b957be2a830784cacc4483825cdc6a2255e6a51ade295c1d06c5361753ccb1474f59571e68c4f4cfdcddb209e31c16de74ccedf7158ce502fd8ec7f4a28b9c37dd30ef6d20c698a0c19bd84a0be0a2a4c1124ae4346294ec03f5c4028ab071ef9363382332990f70651be052f5ec863af1b220982611c6d46930f856d88547c2e1679dd9b7f7772a6cd0166417ebf9142e4db73453d1c6bfaa369e67f370b2ec903723523b13e37230b92281be34cad047849449f536c3e511b4589f48f9d25414a48d285d91b0730abaa72867faa211c60ce6d76e40f07847800738af97ca65c5f2c5cd19c70205ef768c65c676f1a31ddc715ff0a0eb7d941a8ff1bd4dbbc1cfb191f7e0e2131c953356b8f871d003c835a84d209ac6fb24c5c988915789b9e982c89265bd9b6d57ee9810b5cb0be06c9afef7f308eb30d1202192e08d4f7ec15a75b8fdeb74d04c2aadae3d192d07827e6146c0704128480545ce5e06f296cb2fec467135ffcd21a97d83819a9337f6fa216cb51a2190a637e1eeb0eeea14337fcc1cb336af465f434940639ac17a94f762b5e193bf6728c7c044f9b0db2412bb53bcbd658d25ae09da05aa0bce99032b90aaa4de4afc0bb802c870b94615a9dcd7e1ecb90262ce138c649068ba315342bb335037e8f5ac8c70eaff2d1a3518b2317a5bda860e04ff23a17fd25abc6492c6f8c67a82f7b59cdfd7219de14cc4d8f417e8a3a3c5c9a401dba13a334beb1045ef71ede975dc7128b032ac4d071a7f592e902b6651bac1045e88a36ac20ffd992d7504039ecc743250dd1b5b3b06f4c19cd841b92dafde66e443b8f5625092fc3041dacb919fe7a78a7f9db0e65f40a9e44d453a0d6ccc87a1abc929487d7049cb6fce53059257c1d14f32e2e2904d188930aae9fd6e5940c50ac6cd5ee12177e2a89839acd42737ecccffd19faa8465837b793381020011cc249c559c365d9f881f5151901b720b65b51cfb61fd3b4ec344b44eb018ec0af8b4f6f437c8c975fef3b38e6b92c66a64e9d82b9b99f11b722bc86255c6", 0x1000, 0x7}], 0x20, &(0x7f0000002bc0)={'nouuid,', {[{@discard='discard', 0x2c}, {@noquota='noquota', 0x2c}, {@noattr2='noattr2', 0x2c}, {@usrquota='usrquota', 0x2c}, {@bsdgroups='bsdgroups', 0x2c}, {@pquota='pquota', 0x2c}, {@logdev={'logdev', 0x3d, './file0'}, 0x2c}, {@noikeep='noikeep', 0x2c}, {@mtpt='mtpt', 0x2c}, {@uquota='uquota', 0x2c}]}}) getsockopt$IP_VS_SO_GET_VERSION(r6, 0x0, 0x480, &(0x7f0000002c40), &(0x7f0000002c80)=0x40) clock_gettime(0x0, &(0x7f0000002cc0)) write$evdev(r5, &(0x7f0000002d00)=[{{0x77359400}, 0x9, 0x7, 0xff}], 0x18) r7 = syz_open_dev$vcsn(&(0x7f0000002d40)='/dev/vcs#\x00', 0x4, 0x40) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000002d80)={r1, 0x8, 0x79, "177853b23cc4bf4d473fd02431ff7ac414e189dc1355f661c4f6a0a0fb50a1791c078ec97f14405ed3355418f9348212cb4502af890a3caaf42b68769c5b134f7d8f450c921cdbbb1d90eb20535a448eb856da74cd1c6885d782d57506fa07531e0cca26f3bda17c8648ce70d2173320cb23a311be1f1e733a"}, 0x81) getrusage(0x0, &(0x7f0000002e40)) getsockopt$inet_mreqsrc(r0, 0x0, 0x2d, &(0x7f0000002f00)={@loopback, @empty, @broadcast}, &(0x7f0000002f40)=0xc) ioctl$EVIOCGMASK(r5, 0x80104592, &(0x7f0000002fc0)={0x17, 0x6, &(0x7f0000002f80)="ea39b21d5403"}) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000003000)={r1, 0x1c0, 0x4, 0x8, 0x1, 0xffffffff}, 0x14) ioctl$TIOCSWINSZ(r6, 0x5414, &(0x7f0000003040)={0x70, 0x2, 0x0, 0x52}) getsockopt$inet_sctp_SCTP_MAXSEG(r7, 0x84, 0xd, &(0x7f0000003080)=@assoc_value={r1, 0x5}, &(0x7f00000030c0)=0x8) write$eventfd(r6, &(0x7f0000003100)=0x6, 0x8) timer_create(0x1, &(0x7f0000003240)={0x0, 0x2c, 0x3, @thr={&(0x7f0000003140)="d894dcbb63f69210647278b48ca9081f277b4592f8971a433f2c1d4d4b498a", &(0x7f0000003180)="742fd948bd9520b5871b4e98ae086d7f0c5513b6e16794c7f1186b2dcb0e480dea7a3afb5fb09015ee13e01125b1cafc6a46bfe32be53f74a8d9aec663b34e28bfe581b4fded492d778ec06e4fce14e6c8d4cdd04bfe43f87f2276396c328a2e522b868e4e54b2a25facf63c6a63ba44855d2e1e42c9fd6547773e2f07bee475ac55854c"}}, &(0x7f0000003280)=0x0) clock_gettime(0x0, &(0x7f00000032c0)={0x0, 0x0}) timer_settime(r8, 0x1, &(0x7f0000003300)={{0x0, 0x1c9c380}, {r9, r10+10000000}}, &(0x7f0000003340)) fcntl$setown(r5, 0x8, r4) ioctl$KDDELIO(r0, 0x4b35, 0x2) clock_gettime(0x0, &(0x7f0000003380)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r5, 0x4040534e, &(0x7f00000033c0)={0x80, @time={r11, r12+10000000}, 0x400, {0x1, 0x1}, 0x7, 0x1, 0xf402}) syz_open_dev$sg(&(0x7f0000003440)='/dev/sg#\x00', 0x8001, 0x80) 2018/04/10 12:54:48 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x14}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:48 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000ffffffef08001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:48 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeffdffff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:48 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x1400000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:48 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4-generic)\x00'}, 0x58) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000280)={0x3, 0x6, 0x3faa, 0x9, 0x2}) r2 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000240)="d3", 0x1) write(r2, &(0x7f0000000040)="791f", 0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000180), &(0x7f00000001c0)=0x14) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x400000, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r4, 0x40045542, &(0x7f0000000140)=0x400) recvmsg(r2, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/10 12:54:48 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000208001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 960.629186] binder: 29725 RLIMIT_NICE not set [ 960.635214] binder: 29718:29725 unknown command 0 [ 960.640212] binder: 29718:29725 ioctl c0306201 20000340 returned -22 [ 960.647872] binder: BINDER_SET_CONTEXT_MGR already set [ 960.651208] binder: 29718:29725 ioctl c0306201 20004000 returned -14 [ 960.653261] binder: 29718:29781 ioctl 40046207 0 returned -16 [ 960.662596] binder_alloc: 29718: binder_alloc_buf, no vma [ 960.665949] binder: 29718:29785 unknown command 0 [ 960.671384] binder: 29718:29784 transaction failed 29189/-3, size 0-0 line 2963 [ 960.683942] binder: 29718:29785 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1263484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:49 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:49 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xfeffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:49 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000003400008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:49 executing program 7: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$KDGKBLED(r0, 0x80045104, &(0x7f0000000040)) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x838) 2018/04/10 12:54:49 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}}, 0x14) 2018/04/10 12:54:49 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:49 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) [ 960.800951] binder: undelivered TRANSACTION_ERROR: 29189 [ 960.806551] binder: release 29718:29725 transaction 574 in, still active [ 960.813461] binder: send failed reply for transaction 574 to 29718:29781 [ 960.820334] binder: undelivered TRANSACTION_COMPLETE [ 960.825483] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:49 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x1}, 0x5}, 0x1c) [ 960.905069] binder: 29805 RLIMIT_NICE not set 2018/04/10 12:54:49 executing program 7: r0 = socket$inet6_sctp(0xa, 0x80040000000001, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}], 0x1c) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000107ff8)={0x0, 0x10040000}, 0x8) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xa0000, 0x0) bind$bt_l2cap(r1, &(0x7f00000000c0)={0x1f, 0x1f, {0x9a23, 0x80000000, 0xfffffffffffffffd, 0x7, 0x5, 0x6}, 0x44, 0x2}, 0xe) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x58, &(0x7f0000000100)=[@in6={0xa, 0x4e23, 0x2, @loopback={0x0, 0x1}, 0x18b}, @in={0x2, 0x4e24, @multicast2=0xe0000002}, @in6={0xa, 0x4e24, 0xffffffffffff7fff, @dev={0xfe, 0x80, [], 0x1b}, 0x8}, @in={0x2, 0x4e20, @broadcast=0xffffffff}]}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000200)={r3, 0x36a30}, &(0x7f0000000240)=0x8) mq_notify(r1, &(0x7f0000000080)={0x0, 0x20, 0x2, @tid=r2}) connect$inet6(r0, &(0x7f00008c0000)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f000081e000), 0x8) 2018/04/10 12:54:49 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000ff3f00000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:49 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x14000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:49 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:49 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) close(r0) r1 = socket$alg(0x26, 0x5, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0xdd, 0x420080) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f00000000c0)={0x3, 0x5}, 0x2) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000bbfe8)="ad56b6c5820faeb995298992ea54c7beef9f5d56534c90c2", 0x18) r3 = accept$alg(r0, 0x0, 0x0) io_setup(0x1, &(0x7f0000e4b000)=0x0) io_submit(r4, 0x1, &(0x7f0000bd9fe0)=[&(0x7f0000617fc0)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f000007d000)="b3", 0x1}]) 2018/04/10 12:54:49 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000308001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:49 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e05000000000000], 0x1}, 0x5}, 0x1c) [ 961.691872] binder: 29805 RLIMIT_NICE not set [ 961.699514] binder: 29805 RLIMIT_NICE not set [ 961.704758] binder: 29796:29805 ioctl c0306201 20004000 returned -14 [ 961.704842] binder: BINDER_SET_CONTEXT_MGR already set [ 961.716710] binder: 29796:29840 ioctl 40046207 0 returned -16 [ 961.728671] binder_alloc: 29796: binder_alloc_buf, no vma [ 961.730144] binder: 29796:29844 got reply transaction with no transaction stack [ 961.734345] binder: 29796:29840 transaction failed 29189/-3, size 0-0 line 2963 [ 961.741811] binder: 29796:29844 transaction failed 29201/-71, size 0-0 line 2763 [ 961.851921] binder: undelivered TRANSACTION_ERROR: 29189 [ 961.857497] binder: undelivered TRANSACTION_ERROR: 29201 [ 961.863341] binder: undelivered TRANSACTION_COMPLETE [ 961.868540] binder: undelivered TRANSACTION_COMPLETE [ 961.873715] binder: undelivered transaction 578, process died. 2018/04/10 12:54:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0163404000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:50 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xd00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:50 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000308000)='/dev/snd/controlC#\x00', 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000065b38)={{0x6, 0x0, 0x0, 0x0, "dda52a8bfb30cc12936b8da3effa922ab208de0b3960eadc49fe526638ddffed947db68402df32de3aee7163"}, 0x0, [], {0x0, 0x989680}}) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x0) execve(&(0x7f0000000400)='./file0\x00', &(0x7f0000000740)=[&(0x7f0000000440)='port1\x00', &(0x7f0000000480)='port1\x00', &(0x7f00000004c0)='ppp1\'system\x00', &(0x7f0000000540)='proceth0/(+\x00', &(0x7f0000000580)='\x00', &(0x7f0000000700)='keyring\x00'], &(0x7f0000000a80)=[&(0x7f0000000780)='em0mime_typecpusetlo*\x00', &(0x7f00000007c0)='vboxnet0\x00', &(0x7f00000009c0)='-}&\x00', &(0x7f0000000a00)='em0\x00', &(0x7f0000000a40)='/dev/dmmidi#\x00']) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000100)=ANY=[@ANYBLOB="703b47abb187b737049889a198dc480aca0e482899ebfd95319620f785f6f3001d000000ef9c98e7f5a0f3e9eae2ad0887"]) 2018/04/10 12:54:50 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}}, 0x14) 2018/04/10 12:54:50 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000020000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:50 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:50 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:50 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) [ 961.964949] binder: 29859 RLIMIT_NICE not set 2018/04/10 12:54:50 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:50 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xff00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:50 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000000000003fff08001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:50 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:50 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000003fff0000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:50 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xd}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:50 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2800000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:50 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000ffffffef0000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 962.766396] binder: 29859 RLIMIT_NICE not set [ 962.772786] binder: 29859 RLIMIT_NICE not set [ 962.781343] binder: BINDER_SET_CONTEXT_MGR already set [ 962.786181] binder: 29857:29859 ioctl c0306201 20004000 returned -14 [ 962.786942] binder: 29857:29897 ioctl 40046207 0 returned -16 [ 962.806271] binder_alloc: 29857: binder_alloc_buf, no vma [ 962.806472] binder: 29857:29902 got reply transaction with no transaction stack [ 962.811950] binder: 29857:29897 transaction failed 29189/-3, size 0-0 line 2963 [ 962.819411] binder: 29857:29902 transaction failed 29201/-71, size 0-0 line 2763 [ 962.932547] binder: undelivered TRANSACTION_ERROR: 29189 [ 962.938125] binder: undelivered TRANSACTION_ERROR: 29201 [ 962.943908] binder: undelivered TRANSACTION_COMPLETE [ 962.949117] binder: undelivered TRANSACTION_COMPLETE [ 962.954311] binder: undelivered transaction 583, process died. 2018/04/10 12:54:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0e630c4000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:51 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:51 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000308000)='/dev/snd/controlC#\x00', 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000065b38)={{0x6, 0x0, 0x0, 0x0, "dda52a8bfb30cc12936b8da3effa922ab208de0b3960eadc49fe526638ddffed947db68402df32de3aee7163"}, 0x0, [], {0x0, 0x989680}}) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x0) execve(&(0x7f0000000400)='./file0\x00', &(0x7f0000000740)=[&(0x7f0000000440)='port1\x00', &(0x7f0000000480)='port1\x00', &(0x7f00000004c0)='ppp1\'system\x00', &(0x7f0000000540)='proceth0/(+\x00', &(0x7f0000000580)='\x00', &(0x7f0000000700)='keyring\x00'], &(0x7f0000000a80)=[&(0x7f0000000780)='em0mime_typecpusetlo*\x00', &(0x7f00000007c0)='vboxnet0\x00', &(0x7f00000009c0)='-}&\x00', &(0x7f0000000a00)='em0\x00', &(0x7f0000000a40)='/dev/dmmidi#\x00']) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000100)=ANY=[@ANYBLOB="703b47abb187b737049889a198dc480aca0e482899ebfd95319620f785f6f3001d000000ef9c98e7f5a0f3e9eae2ad0887"]) 2018/04/10 12:54:51 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:51 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x1400}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:51 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5]}}, 0x14) 2018/04/10 12:54:51 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000500000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:51 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401000000000000]}, 0x10) shutdown(r0, 0x1) [ 963.146660] binder: 29913 RLIMIT_NICE not set 2018/04/10 12:54:51 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff02000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:52 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000007fffffff0000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:52 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xffffffa4}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:52 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x14) 2018/04/10 12:54:52 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:52 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000efffffff0000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:52 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xd00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:52 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe1f0020], 0x1}, 0x5}, 0x1c) [ 963.949646] binder: 29913 RLIMIT_NICE not set [ 963.954278] binder: 29912:29960 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 963.961554] binder: 29912:29960 unknown command 8192 [ 963.966942] binder: 29912:29960 ioctl c0306201 20000340 returned -22 [ 963.976443] binder: BINDER_SET_CONTEXT_MGR already set [ 963.976636] binder: 29912:29913 ioctl c0306201 20004000 returned -14 [ 963.981923] binder: 29912:29960 ioctl 40046207 0 returned -16 [ 964.001223] binder_alloc: 29912: binder_alloc_buf, no vma [ 964.003111] binder: 29912:29964 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 964.006902] binder: 29912:29960 transaction failed 29189/-3, size 0-0 line 2963 [ 964.014043] binder: 29912:29964 unknown command 8192 [ 964.026710] binder: 29912:29964 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='\nc\b@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:53 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000308000)='/dev/snd/controlC#\x00', 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000065b38)={{0x6, 0x0, 0x0, 0x0, "dda52a8bfb30cc12936b8da3effa922ab208de0b3960eadc49fe526638ddffed947db68402df32de3aee7163"}, 0x0, [], {0x0, 0x989680}}) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x0) execve(&(0x7f0000000400)='./file0\x00', &(0x7f0000000740)=[&(0x7f0000000440)='port1\x00', &(0x7f0000000480)='port1\x00', &(0x7f00000004c0)='ppp1\'system\x00', &(0x7f0000000540)='proceth0/(+\x00', &(0x7f0000000580)='\x00', &(0x7f0000000700)='keyring\x00'], &(0x7f0000000a80)=[&(0x7f0000000780)='em0mime_typecpusetlo*\x00', &(0x7f00000007c0)='vboxnet0\x00', &(0x7f00000009c0)='-}&\x00', &(0x7f0000000a00)='em0\x00', &(0x7f0000000a40)='/dev/dmmidi#\x00']) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000100)=ANY=[@ANYBLOB="703b47abb187b737049889a198dc480aca0e482899ebfd95319620f785f6f3001d000000ef9c98e7f5a0f3e9eae2ad0887"]) 2018/04/10 12:54:53 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4010000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:53 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000ffffffff08001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:53 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xa4ffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:53 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000]}}, 0x14) 2018/04/10 12:54:53 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd4000000]}, 0x10) shutdown(r0, 0x1) [ 964.141142] binder: undelivered TRANSACTION_ERROR: 29189 [ 964.146721] binder: release 29912:29913 transaction 587 in, still active [ 964.153644] binder: send failed reply for transaction 587 to 29912:29960 [ 964.160547] binder: undelivered TRANSACTION_COMPLETE [ 964.165692] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:53 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:53 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x1}, 0x5}, 0x1c) [ 964.242689] binder: 29976 RLIMIT_NICE not set 2018/04/10 12:54:53 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x2000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:53 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000401808001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:53 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:53 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x2}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:53 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000040000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:53 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:53 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000]}}, 0x14) [ 965.036564] binder: 29976 RLIMIT_NICE not set [ 965.039910] binder: BC_ATTEMPT_ACQUIRE not supported [ 965.046378] binder: 29975:30023 ioctl c0306201 20000340 returned -22 [ 965.054888] binder: BINDER_SET_CONTEXT_MGR already set [ 965.056143] binder: 29975:29976 ioctl c0306201 20004000 returned -14 [ 965.060243] binder: 29975:30023 ioctl 40046207 0 returned -16 [ 965.074228] binder_alloc: 29975: binder_alloc_buf, no vma [ 965.074647] binder: BC_ATTEMPT_ACQUIRE not supported [ 965.079897] binder: 29975:29976 transaction failed 29189/-3, size 0-0 line 2963 [ 965.091062] binder: 29975:30027 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0463044000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:54 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:54 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000308000)='/dev/snd/controlC#\x00', 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000065b38)={{0x6, 0x0, 0x0, 0x0, "dda52a8bfb30cc12936b8da3effa922ab208de0b3960eadc49fe526638ddffed947db68402df32de3aee7163"}, 0x0, [], {0x0, 0x989680}}) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x0) execve(&(0x7f0000000400)='./file0\x00', &(0x7f0000000740)=[&(0x7f0000000440)='port1\x00', &(0x7f0000000480)='port1\x00', &(0x7f00000004c0)='ppp1\'system\x00', &(0x7f0000000540)='proceth0/(+\x00', &(0x7f0000000580)='\x00', &(0x7f0000000700)='keyring\x00'], &(0x7f0000000a80)=[&(0x7f0000000780)='em0mime_typecpusetlo*\x00', &(0x7f00000007c0)='vboxnet0\x00', &(0x7f00000009c0)='-}&\x00', &(0x7f0000000a00)='em0\x00', &(0x7f0000000a40)='/dev/dmmidi#\x00']) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000100)=ANY=[@ANYBLOB="703b47abb187b737049889a198dc480aca0e482899ebfd95319620f785f6f3001d000000ef9c98e7f5a0f3e9eae2ad0887"]) 2018/04/10 12:54:54 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x200000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:54 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000030000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:54 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:54 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}}, 0x14) 2018/04/10 12:54:54 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000]}, 0x10) shutdown(r0, 0x1) [ 965.209814] binder: undelivered TRANSACTION_ERROR: 29189 [ 965.215613] binder: release 29975:29976 transaction 590 in, still active [ 965.222638] binder: send failed reply for transaction 590 to 29975:30023 [ 965.229522] binder: undelivered TRANSACTION_COMPLETE [ 965.234689] binder: undelivered TRANSACTION_ERROR: 29189 [ 965.313556] binder: 30046 RLIMIT_NICE not set 2018/04/10 12:54:54 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000010000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:54 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:54 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xff00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:54 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:54 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000040180000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:54 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xfeffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:54 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:54 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000401800000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 966.107802] binder: 30046 RLIMIT_NICE not set [ 966.114666] binder: 30044:30046 unknown command 0 [ 966.119787] binder: 30044:30046 ioctl c0306201 20000340 returned -22 [ 966.127269] binder: 30044:30046 ioctl c0306201 20004000 returned -14 [ 966.128094] binder: BINDER_SET_CONTEXT_MGR already set [ 966.139189] binder: 30044:30087 ioctl 40046207 0 returned -16 [ 966.149233] binder_alloc: 30044: binder_alloc_buf, no vma [ 966.149436] binder: 30044:30092 unknown command 0 [ 966.154935] binder: 30044:30087 transaction failed 29189/-3, size 0-0 line 2963 [ 966.159871] binder: 30044:30092 ioctl c0306201 20000340 returned -22 [ 966.286382] binder: undelivered TRANSACTION_ERROR: 29189 [ 966.292531] binder: release 30044:30046 transaction 593 in, still active [ 966.299476] binder: send failed reply for transaction 593 to 30044:30087 [ 966.306423] binder: undelivered TRANSACTION_COMPLETE [ 966.311586] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1063084000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:55 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:55 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000308000)='/dev/snd/controlC#\x00', 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000065b38)={{0x6, 0x0, 0x0, 0x0, "dda52a8bfb30cc12936b8da3effa922ab208de0b3960eadc49fe526638ddffed947db68402df32de3aee7163"}, 0x0, [], {0x0, 0x989680}}) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x0) execve(&(0x7f0000000400)='./file0\x00', &(0x7f0000000740)=[&(0x7f0000000440)='port1\x00', &(0x7f0000000480)='port1\x00', &(0x7f00000004c0)='ppp1\'system\x00', &(0x7f0000000540)='proceth0/(+\x00', &(0x7f0000000580)='\x00', &(0x7f0000000700)='keyring\x00'], &(0x7f0000000a80)=[&(0x7f0000000780)='em0mime_typecpusetlo*\x00', &(0x7f00000007c0)='vboxnet0\x00', &(0x7f00000009c0)='-}&\x00', &(0x7f0000000a00)='em0\x00', &(0x7f0000000a40)='/dev/dmmidi#\x00']) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) 2018/04/10 12:54:55 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xa4ffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:55 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000002008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:55 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}}, 0x14) 2018/04/10 12:54:55 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x10) shutdown(r0, 0x1) [ 966.390809] binder: 30106 RLIMIT_NICE not set 2018/04/10 12:54:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:55 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000200000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:55 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x100000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff020000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:55 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000300000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:55 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xff000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:55 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000030000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 967.191741] binder: 30106 RLIMIT_NICE not set [ 967.196401] binder: 30105:30149 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 967.203860] binder: 30105:30149 unknown command 71303168 [ 967.209623] binder: 30105:30149 ioctl c0306201 20000340 returned -22 [ 967.218319] binder: 30105:30106 ioctl c0306201 20004000 returned -14 [ 967.222182] binder: BINDER_SET_CONTEXT_MGR already set [ 967.230722] binder: 30105:30149 ioctl 40046207 0 returned -16 [ 967.242250] binder_alloc: 30105: binder_alloc_buf, no vma [ 967.246247] binder: 30105:30155 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 967.247941] binder: 30105:30149 transaction failed 29189/-3, size 0-0 line 2963 [ 967.255293] binder: 30105:30155 unknown command 71303168 [ 967.268564] binder: 30105:30155 ioctl c0306201 20000340 returned -22 2018/04/10 12:54:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840fffffdfd000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:56 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:56 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000308000)='/dev/snd/controlC#\x00', 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000065b38)={{0x6, 0x0, 0x0, 0x0, "dda52a8bfb30cc12936b8da3effa922ab208de0b3960eadc49fe526638ddffed947db68402df32de3aee7163"}, 0x0, [], {0x0, 0x989680}}) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x0) execve(&(0x7f0000000400)='./file0\x00', &(0x7f0000000740)=[&(0x7f0000000440)='port1\x00', &(0x7f0000000480)='port1\x00', &(0x7f00000004c0)='ppp1\'system\x00', &(0x7f0000000540)='proceth0/(+\x00', &(0x7f0000000580)='\x00', &(0x7f0000000700)='keyring\x00'], &(0x7f0000000a80)=[&(0x7f0000000780)='em0mime_typecpusetlo*\x00', &(0x7f00000007c0)='vboxnet0\x00', &(0x7f00000009c0)='-}&\x00', &(0x7f0000000a00)='em0\x00', &(0x7f0000000a40)='/dev/dmmidi#\x00']) 2018/04/10 12:54:56 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:56 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x1000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:56 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff]}}, 0x14) 2018/04/10 12:54:56 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000408001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:56 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34000]}, 0x10) shutdown(r0, 0x1) [ 967.381563] binder: undelivered TRANSACTION_ERROR: 29189 [ 967.387438] binder: release 30105:30106 transaction 598 in, still active [ 967.394398] binder: send failed reply for transaction 598 to 30105:30149 [ 967.401312] binder: undelivered TRANSACTION_COMPLETE [ 967.406477] binder: undelivered TRANSACTION_ERROR: 29189 [ 967.470566] binder: 30167 RLIMIT_NICE not set 2018/04/10 12:54:56 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:56 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0xd000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:56 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000508001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:56 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a6], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:56 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xff000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:56 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000020000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:56 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2ff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:56 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}, 0x14) [ 968.267731] binder: 30167 RLIMIT_NICE not set [ 968.277506] binder: 30165:30167 got transaction to invalid handle [ 968.283902] binder: 30165:30167 transaction failed 29201/-22, size 0-0 line 2848 [ 968.292596] binder: 30165:30167 ioctl c0306201 20004000 returned -14 [ 968.292600] binder: BINDER_SET_CONTEXT_MGR already set [ 968.292616] binder: 30165:30211 ioctl 40046207 0 returned -16 [ 968.314543] binder: 30165:30216 got transaction to invalid handle [ 968.314559] binder_alloc: 30165: binder_alloc_buf, no vma [ 968.320886] binder: 30165:30216 transaction failed 29201/-22, size 0-0 line 2848 [ 968.335348] binder: 30165:30211 transaction failed 29189/-3, size 0-0 line 2963 [ 968.438174] binder: undelivered TRANSACTION_ERROR: 29189 [ 968.443765] binder: undelivered TRANSACTION_ERROR: 29201 [ 968.449543] binder: release 30165:30167 transaction 601 in, still active [ 968.456474] binder: send failed reply for transaction 601 to 30165:30211 [ 968.463396] binder: undelivered TRANSACTION_ERROR: 29201 [ 968.468914] binder: undelivered TRANSACTION_COMPLETE [ 968.474089] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840fdfdffff000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:57 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000308000)='/dev/snd/controlC#\x00', 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000065b38)={{0x6, 0x0, 0x0, 0x0, "dda52a8bfb30cc12936b8da3effa922ab208de0b3960eadc49fe526638ddffed947db68402df32de3aee7163"}, 0x0, [], {0x0, 0x989680}}) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x0) 2018/04/10 12:54:57 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:54:57 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000340000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:57 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:57 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x14}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:57 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}}, 0x14) 2018/04/10 12:54:57 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:57 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x1}, 0x5}, 0x1c) [ 968.615595] binder: 30234 RLIMIT_NICE not set 2018/04/10 12:54:57 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:57 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000004003000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:57 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:57 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:57 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:57 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000007fffffff08001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:57 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa605000000000000], 0x1}, 0x5}, 0x1c) [ 969.407983] binder: 30234 RLIMIT_NICE not set [ 969.413826] binder: 30226:30234 got transaction to invalid handle [ 969.420164] binder: 30226:30234 transaction failed 29201/-22, size 0-0 line 2848 [ 969.428967] binder: BINDER_SET_CONTEXT_MGR already set [ 969.434386] binder: 30226:30234 ioctl c0306201 20004000 returned -14 [ 969.441316] binder: 30226:30276 ioctl 40046207 0 returned -16 [ 969.452064] binder_alloc: 30226: binder_alloc_buf, no vma [ 969.452453] binder: 30226:30278 got transaction to invalid handle [ 969.457711] binder: 30226:30276 transaction failed 29189/-3, size 0-0 line 2963 [ 969.471490] binder: 30226:30278 transaction failed 29201/-22, size 0-0 line 2848 [ 969.589689] binder: undelivered TRANSACTION_ERROR: 29189 [ 969.595252] binder: undelivered TRANSACTION_ERROR: 29201 [ 969.601063] binder: release 30226:30234 transaction 606 in, still active [ 969.607982] binder: send failed reply for transaction 606 to 30226:30276 [ 969.614895] binder: undelivered TRANSACTION_ERROR: 29201 [ 969.620390] binder: undelivered TRANSACTION_COMPLETE [ 969.625560] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000f0ffffff7f00000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:58 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000308000)='/dev/snd/controlC#\x00', 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000065b38)={{0x6, 0x0, 0x0, 0x0, "dda52a8bfb30cc12936b8da3effa922ab208de0b3960eadc49fe526638ddffed947db68402df32de3aee7163"}, 0x0, [], {0x0, 0x989680}}) 2018/04/10 12:54:58 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x2000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:58 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0xf}], 0x1, 0x0) 2018/04/10 12:54:58 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeffdffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:58 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffa4]}}, 0x14) 2018/04/10 12:54:58 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000050000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:58 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000]}, 0x10) shutdown(r0, 0x1) [ 969.775768] binder: 30299 RLIMIT_NICE not set 2018/04/10 12:54:58 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:58 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:58 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000002000000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:58 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e050000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:58 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:58 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000003fff00000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:58 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:58 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000200000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 970.571925] binder: 30299 RLIMIT_NICE not set [ 970.577762] binder: 30289:30299 got transaction to invalid handle [ 970.584209] binder: 30289:30299 transaction failed 29201/-22, size 0-0 line 2848 [ 970.592705] binder: BINDER_SET_CONTEXT_MGR already set [ 970.592715] binder: 30289:30299 ioctl c0306201 20004000 returned -14 [ 970.604840] binder: 30289:30338 ioctl 40046207 0 returned -16 [ 970.616161] binder_alloc: 30289: binder_alloc_buf, no vma [ 970.616540] binder: 30289:30341 got transaction to invalid handle [ 970.621870] binder: 30289:30338 transaction failed 29189/-3, size 0-0 line 2963 [ 970.628228] binder: 30289:30341 transaction failed 29201/-22, size 0-0 line 2848 [ 970.739583] binder: undelivered TRANSACTION_ERROR: 29189 [ 970.745182] binder: undelivered TRANSACTION_ERROR: 29201 [ 970.751593] binder: release 30289:30299 transaction 611 in, still active [ 970.758557] binder: send failed reply for transaction 611 to 30289:30338 [ 970.765476] binder: undelivered TRANSACTION_ERROR: 29201 [ 970.770966] binder: undelivered TRANSACTION_COMPLETE [ 970.776131] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:54:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000010000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:54:59 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff00000000]}}, 0x14) 2018/04/10 12:54:59 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xd000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:59 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2800], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:59 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:54:59 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000ff3f000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:59 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$sndctrl(&(0x7f0000308000)='/dev/snd/controlC#\x00', 0x1, 0x0) 2018/04/10 12:54:59 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0x11}], 0x1, 0x0) [ 970.933261] binder: 30362 RLIMIT_NICE not set 2018/04/10 12:54:59 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e05], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:59 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:59 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000ffffffef00000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:59 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff02], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:59 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x14000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:54:59 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000500000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:54:59 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:54:59 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 971.731637] binder: 30362 RLIMIT_NICE not set [ 971.740546] binder: BINDER_SET_CONTEXT_MGR already set [ 971.744633] binder: 30360:30362 ioctl c0306201 20004000 returned -14 [ 971.746761] binder: 30360:30403 ioctl 40046207 0 returned -16 [ 971.764595] binder_alloc: 30360: binder_alloc_buf, no vma [ 971.770414] binder_alloc: 30360: binder_alloc_buf, no vma [ 971.770427] binder: 30360:30403 transaction failed 29189/-3, size 0-0 line 2963 [ 971.783704] binder: 30360:30406 transaction failed 29189/-3, size 0-0 line 2963 [ 971.901257] binder: undelivered TRANSACTION_ERROR: 29189 [ 971.906915] binder: undelivered TRANSACTION_ERROR: 29189 [ 971.913551] binder: release 30360:30362 transaction 617 out, still active [ 971.920574] binder: release 30360:30362 transaction 616 in, still active [ 971.927488] binder: undelivered TRANSACTION_COMPLETE [ 971.932660] binder: release 30360:30403 transaction 616 out, still active [ 971.939644] binder: undelivered TRANSACTION_COMPLETE [ 971.944822] binder: send failed reply for transaction 617, target dead [ 971.951557] binder: send failed reply for transaction 616, target dead 2018/04/10 12:55:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000fffffdfd0000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:00 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 2018/04/10 12:55:00 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0x100000000000000}], 0x1, 0x0) 2018/04/10 12:55:00 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000400000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:00 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:00 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}}, 0x14) 2018/04/10 12:55:00 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}, 0x10) shutdown(r0, 0x1) [ 972.078241] binder: 30424 RLIMIT_NICE not set 2018/04/10 12:55:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:00 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:00 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000007fffffff00000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:01 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:01 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xffffffa4}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:01 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000], 0x1}, 0x5}, 0x1c) [ 972.881250] binder: 30424 RLIMIT_NICE not set [ 972.888983] binder: BINDER_SET_CONTEXT_MGR already set [ 972.891116] binder: 30421:30424 ioctl c0306201 20004000 returned -14 [ 972.898789] binder: 30421:30463 ioctl 40046207 0 returned -16 [ 972.911943] binder_alloc: 30421: binder_alloc_buf, no vma [ 972.917602] binder_alloc: 30421: binder_alloc_buf, no vma [ 972.917624] binder: 30421:30463 transaction failed 29189/-3, size 0-0 line 2963 [ 972.923203] binder: 30421:30467 transaction failed 29189/-3, size 0-0 line 2963 [ 973.047682] binder: undelivered TRANSACTION_ERROR: 29189 [ 973.053261] binder: undelivered TRANSACTION_ERROR: 29189 [ 973.059392] binder: release 30421:30424 transaction 622 out, still active [ 973.066453] binder: release 30421:30424 transaction 621 in, still active [ 973.073362] binder: undelivered TRANSACTION_COMPLETE [ 973.078585] binder: release 30421:30463 transaction 621 out, still active [ 973.085542] binder: undelivered TRANSACTION_COMPLETE [ 973.090685] binder: send failed reply for transaction 622, target dead [ 973.097396] binder: send failed reply for transaction 621, target dead 2018/04/10 12:55:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000007ffffffff0000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:02 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000340)) 2018/04/10 12:55:02 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0x200000000000000}], 0x1, 0x0) 2018/04/10 12:55:02 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:02 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000400000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:02 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:02 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}}, 0x14) 2018/04/10 12:55:02 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:02 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500], 0x1}, 0x5}, 0x1c) [ 973.260198] binder: 30491 RLIMIT_NICE not set 2018/04/10 12:55:02 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000300000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:02 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:02 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:02 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000018001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:02 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xff00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:02 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xd00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:02 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc0], 0x1}, 0x5}, 0x1c) [ 974.050620] binder: 30491 RLIMIT_NICE not set [ 974.055558] binder: 30477:30491 got transaction to invalid handle [ 974.062019] binder: 30477:30491 transaction failed 29201/-22, size 0-0 line 2848 [ 974.072591] binder: BINDER_SET_CONTEXT_MGR already set [ 974.078174] binder: 30477:30491 ioctl c0306201 20004000 returned -14 [ 974.084876] binder: 30477:30526 ioctl 40046207 0 returned -16 [ 974.096166] binder_alloc: 30477: binder_alloc_buf, no vma [ 974.101872] binder: 30477:30526 transaction failed 29189/-3, size 0-0 line 2963 [ 974.102154] binder: 30477:30531 got transaction to invalid handle [ 974.115780] binder: 30477:30531 transaction failed 29201/-22, size 0-0 line 2848 [ 974.232283] binder: undelivered TRANSACTION_ERROR: 29189 [ 974.237867] binder: undelivered TRANSACTION_ERROR: 29201 [ 974.243710] binder: release 30477:30491 transaction 626 in, still active [ 974.250840] binder: send failed reply for transaction 626 to 30477:30526 [ 974.257835] binder: undelivered TRANSACTION_ERROR: 29201 [ 974.263356] binder: undelivered TRANSACTION_COMPLETE [ 974.268501] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000001000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:03 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)=0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000bc0)={0x2, 0x70, 0x8001, 0x2, 0x2, 0x1, 0x0, 0x5d9, 0x0, 0x2, 0xa2, 0x9, 0x200, 0x7f, 0x1, 0x4, 0xffffffff, 0x10001, 0x401, 0x5, 0xffffffff, 0x7, 0x8, 0x81, 0xfffffffffffffffe, 0x3, 0x0, 0xcb13, 0x180000, 0x7ff, 0x6, 0x3, 0x2, 0x10001, 0x5, 0x3f, 0x1, 0x4, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000b80)}, 0x4000, 0x5, 0xfffffffffffffff8, 0x0, 0xffffffff, 0x7, 0x100000001}, r5, 0xc, r6, 0x1) 2018/04/10 12:55:03 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0x1000000}], 0x1, 0x0) 2018/04/10 12:55:03 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000efffffff00000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:03 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x14) 2018/04/10 12:55:03 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xd}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:03 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:03 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:03 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdef], 0x1}, 0x5}, 0x1c) [ 974.394263] binder: 30551 RLIMIT_NICE not set 2018/04/10 12:55:03 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000040030000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:03 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xd00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:03 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:03 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000]}}, 0x14) 2018/04/10 12:55:03 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000401800000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:03 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe1f002000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:03 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 975.187495] binder: 30551 RLIMIT_NICE not set [ 975.194938] binder: 30549:30551 got transaction to invalid handle [ 975.201324] binder: 30549:30551 transaction failed 29201/-22, size 0-0 line 2848 [ 975.209954] binder: BINDER_SET_CONTEXT_MGR already set [ 975.215098] binder: 30549:30551 ioctl c0306201 20004000 returned -14 [ 975.215758] binder: 30549:30589 ioctl 40046207 0 returned -16 [ 975.232488] binder_alloc: 30549: binder_alloc_buf, no vma [ 975.238125] binder: 30549:30589 transaction failed 29189/-3, size 0-0 line 2963 [ 975.243954] binder: 30549:30592 got transaction to invalid handle [ 975.251888] binder: 30549:30592 transaction failed 29201/-22, size 0-0 line 2848 [ 975.369474] binder: undelivered TRANSACTION_ERROR: 29189 [ 975.375050] binder: undelivered TRANSACTION_ERROR: 29201 [ 975.380840] binder: release 30549:30551 transaction 631 in, still active [ 975.387758] binder: send failed reply for transaction 631 to 30549:30589 [ 975.394668] binder: undelivered TRANSACTION_ERROR: 29201 [ 975.400149] binder: undelivered TRANSACTION_COMPLETE [ 975.405279] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000100", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:04 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000c80)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) 2018/04/10 12:55:04 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0xa}], 0x1, 0x0) 2018/04/10 12:55:04 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:04 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}}, 0x14) 2018/04/10 12:55:04 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000003fff000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:04 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd400000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:04 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x1400}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:04 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000], 0x1}, 0x5}, 0x1c) [ 975.483121] binder: 30610 RLIMIT_NICE not set 2018/04/10 12:55:04 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000000000000e001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:04 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:04 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:04 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:04 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000100000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:04 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}}, 0x14) 2018/04/10 12:55:04 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000], 0x1}, 0x5}, 0x1c) [ 976.278289] binder: 30610 RLIMIT_NICE not set [ 976.285301] binder: BINDER_SET_CONTEXT_MGR already set [ 976.287122] binder: 30609:30610 ioctl c0306201 20004000 returned -14 [ 976.294769] binder: 30609:30650 ioctl 40046207 0 returned -16 [ 976.308733] binder_alloc: 30609: binder_alloc_buf, no vma [ 976.314471] binder: 30609:30650 transaction failed 29189/-3, size 0-0 line 2963 [ 976.315239] binder_alloc: 30609: binder_alloc_buf, no vma [ 976.327633] binder: 30609:30654 transaction failed 29189/-3, size 0-0 line 2963 [ 976.445271] binder: undelivered TRANSACTION_ERROR: 29189 [ 976.450826] binder: undelivered TRANSACTION_ERROR: 29189 [ 976.456571] binder: release 30609:30610 transaction 637 out, still active [ 976.463556] binder: release 30609:30610 transaction 636 in, still active [ 976.470461] binder: undelivered TRANSACTION_COMPLETE [ 976.475616] binder: release 30609:30650 transaction 636 out, still active [ 976.482576] binder: undelivered TRANSACTION_COMPLETE [ 976.487703] binder: send failed reply for transaction 637, target dead 2018/04/10 12:55:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000000000fffffdfd00", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:05 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000c40)) 2018/04/10 12:55:05 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0x1100000000000000}], 0x1, 0x0) 2018/04/10 12:55:05 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:05 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000020000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:05 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}}, 0x14) 2018/04/10 12:55:05 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:05 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff], 0x1}, 0x5}, 0x1c) [ 976.494396] binder: send failed reply for transaction 636, target dead [ 976.556147] binder: 30672 RLIMIT_NICE not set 2018/04/10 12:55:05 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:05 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:05 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000003400000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:05 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:05 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000001840000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:05 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:05 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e8], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:05 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000200000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 977.358781] binder: 30672 RLIMIT_NICE not set [ 977.365150] binder: BINDER_SET_CONTEXT_MGR already set [ 977.368781] binder: 30670:30672 ioctl c0306201 20004000 returned -14 [ 977.370949] binder: 30670:30712 ioctl 40046207 0 returned -16 [ 977.389938] binder_alloc: 30670: binder_alloc_buf, no vma [ 977.395692] binder_alloc: 30670: binder_alloc_buf, no vma [ 977.395705] binder: 30670:30716 transaction failed 29189/-3, size 0-0 line 2963 [ 977.408990] binder: 30670:30712 transaction failed 29189/-3, size 0-0 line 2963 [ 977.506563] binder: undelivered TRANSACTION_ERROR: 29189 [ 977.512114] binder: undelivered TRANSACTION_ERROR: 29189 [ 977.517917] binder: release 30670:30672 transaction 642 out, still active [ 977.524918] binder: release 30670:30672 transaction 641 in, still active [ 977.531823] binder: undelivered TRANSACTION_COMPLETE [ 977.536978] binder: release 30670:30712 transaction 641 out, still active [ 977.543959] binder: undelivered TRANSACTION_COMPLETE [ 977.549118] binder: send failed reply for transaction 642, target dead [ 977.555832] binder: send failed reply for transaction 641, target dead 2018/04/10 12:55:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000010000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:06 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000000), &(0x7f0000000380)=0x4) 2018/04/10 12:55:06 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0xf00000000000000}], 0x1, 0x0) 2018/04/10 12:55:06 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:06 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:06 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff]}}, 0x14) 2018/04/10 12:55:06 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000005000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:06 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8030000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:06 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000], 0x1}, 0x5}, 0x1c) [ 977.659177] binder: 30736 RLIMIT_NICE not set 2018/04/10 12:55:06 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:06 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000500000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:06 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000]}}, 0x14) 2018/04/10 12:55:06 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:06 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000002000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:06 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:06 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000], 0x1}, 0x5}, 0x1c) [ 978.455172] binder: 30736 RLIMIT_NICE not set [ 978.460840] binder: 30735:30736 ioctl c0306201 20004000 returned -14 [ 978.460889] binder: BINDER_SET_CONTEXT_MGR already set [ 978.472789] binder: 30735:30775 ioctl 40046207 0 returned -16 [ 978.483769] binder_alloc: 30735: binder_alloc_buf, no vma [ 978.489447] binder_alloc: 30735: binder_alloc_buf, no vma [ 978.489459] binder: 30735:30776 transaction failed 29189/-3, size 0-0 line 2963 [ 978.502606] binder: 30735:30775 transaction failed 29189/-3, size 0-0 line 2963 [ 978.599805] binder: undelivered TRANSACTION_ERROR: 29189 [ 978.605338] binder: undelivered TRANSACTION_ERROR: 29189 [ 978.611366] binder: release 30735:30736 transaction 647 out, still active [ 978.618379] binder: release 30735:30736 transaction 646 in, still active [ 978.625268] binder: undelivered TRANSACTION_COMPLETE [ 978.630421] binder: release 30735:30775 transaction 646 out, still active [ 978.637379] binder: undelivered TRANSACTION_COMPLETE [ 978.642514] binder: send failed reply for transaction 647, target dead [ 978.649205] binder: send failed reply for transaction 646, target dead 2018/04/10 12:55:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000fffffdfd0000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:07 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000ec6fb0)={{0xfffffffffffffffd}, {0x80, 0xfffffffffffffffe}}) 2018/04/10 12:55:07 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0xf000000}], 0x1, 0x0) 2018/04/10 12:55:07 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:07 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000]}}, 0x14) 2018/04/10 12:55:07 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:07 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000003fff00000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:07 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, 0x10) shutdown(r0, 0x1) [ 978.757273] binder: 30788 RLIMIT_NICE not set 2018/04/10 12:55:07 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:07 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:07 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000300000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:07 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:07 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:07 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000004018000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:07 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:07 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 979.548148] binder: 30788 RLIMIT_NICE not set [ 979.554109] binder: 30787:30788 got transaction to invalid handle [ 979.560416] binder: 30787:30788 transaction failed 29201/-22, size 0-0 line 2848 [ 979.569238] binder: 30787:30788 ioctl c0306201 20004000 returned -14 [ 979.570369] binder: BINDER_SET_CONTEXT_MGR already set [ 979.581210] binder: 30787:30836 ioctl 40046207 0 returned -16 [ 979.594510] binder_alloc: 30787: binder_alloc_buf, no vma [ 979.600123] binder: 30787:30836 transaction failed 29189/-3, size 0-0 line 2963 [ 979.601166] binder: 30787:30840 got transaction to invalid handle [ 979.613977] binder: 30787:30840 transaction failed 29201/-22, size 0-0 line 2848 [ 979.731598] binder: undelivered TRANSACTION_ERROR: 29189 [ 979.737129] binder: undelivered TRANSACTION_ERROR: 29201 [ 979.746401] binder: release 30787:30788 transaction 651 in, still active [ 979.753335] binder: send failed reply for transaction 651 to 30787:30836 [ 979.760226] binder: undelivered TRANSACTION_ERROR: 29201 [ 979.765714] binder: undelivered TRANSACTION_COMPLETE [ 979.770851] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000fdfdffff0000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:08 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) r4 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000005c0)=""/13) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:08 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0x2}], 0x1, 0x0) 2018/04/10 12:55:08 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:08 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}}, 0x14) 2018/04/10 12:55:08 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000003000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:08 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:08 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803000000000000]}, 0x10) shutdown(r0, 0x1) [ 979.843299] binder: 30854 RLIMIT_NICE not set 2018/04/10 12:55:08 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:08 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000001001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:08 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffa4}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:08 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000004000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:08 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:08 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:08 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000ff3f0000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:08 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000], 0x1}, 0x5}, 0x1c) [ 980.640011] binder: 30854 RLIMIT_NICE not set [ 980.643409] binder: 30851:30897 got transaction to invalid handle [ 980.650923] binder: 30851:30897 transaction failed 29201/-22, size 0-0 line 2848 [ 980.661578] binder: BINDER_SET_CONTEXT_MGR already set [ 980.667343] binder: 30851:30854 ioctl c0306201 20004000 returned -14 [ 980.674058] binder: 30851:30897 ioctl 40046207 0 returned -16 [ 980.684851] binder_alloc: 30851: binder_alloc_buf, no vma [ 980.690476] binder: 30851:30897 transaction failed 29189/-3, size 0-0 line 2963 [ 980.691119] binder: 30851:30901 got transaction to invalid handle [ 980.704312] binder: 30851:30901 transaction failed 29201/-22, size 0-0 line 2848 2018/04/10 12:55:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000f0ffffff7f000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:09 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast1, @in6=@ipv4}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@rand_addr}}, &(0x7f0000000140)=0xe8) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:09 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0xa00000000000000}], 0x1, 0x0) 2018/04/10 12:55:09 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:09 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x14) 2018/04/10 12:55:09 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa605], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:09 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000efffffff000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:09 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0]}, 0x10) shutdown(r0, 0x1) [ 980.823145] binder: undelivered TRANSACTION_ERROR: 29189 [ 980.828658] binder: undelivered TRANSACTION_ERROR: 29201 [ 980.834535] binder: release 30851:30854 transaction 656 in, still active [ 980.841438] binder: send failed reply for transaction 656 to 30851:30897 [ 980.849453] binder: undelivered TRANSACTION_COMPLETE [ 980.854592] binder: undelivered TRANSACTION_ERROR: 29201 [ 980.860082] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:09 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc0], 0x1}, 0x5}, 0x1c) [ 980.923962] binder: 30923 RLIMIT_NICE not set 2018/04/10 12:55:09 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000034000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:09 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:09 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:09 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:09 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000002000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:09 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:09 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 981.725862] binder: 30923 RLIMIT_NICE not set [ 981.734938] binder: 30916:30923 got transaction to invalid handle [ 981.741338] binder: 30916:30923 transaction failed 29201/-22, size 0-0 line 2848 [ 981.749731] binder: 30916:30923 ioctl c0306201 20004000 returned -14 [ 981.750134] binder: BINDER_SET_CONTEXT_MGR already set [ 981.763113] binder: 30916:30960 ioctl 40046207 0 returned -16 [ 981.774476] binder_alloc: 30916: binder_alloc_buf, no vma [ 981.774719] binder: 30916:30963 got transaction to invalid handle [ 981.780139] binder: 30916:30960 transaction failed 29189/-3, size 0-0 line 2963 [ 981.786434] binder: 30916:30963 transaction failed 29201/-22, size 0-0 line 2848 2018/04/10 12:55:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000007ffffffff00000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:10 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x80000001, 0x400000) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:10 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0x11000000}], 0x1, 0x0) 2018/04/10 12:55:10 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000003fff000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:10 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}, 0x14) 2018/04/10 12:55:10 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:10 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:10 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb80b]}, 0x10) shutdown(r0, 0x1) [ 981.912702] binder: undelivered TRANSACTION_ERROR: 29189 [ 981.918292] binder: undelivered TRANSACTION_ERROR: 29201 [ 981.924515] binder: release 30916:30923 transaction 661 in, still active [ 981.931473] binder: send failed reply for transaction 661 to 30916:30960 [ 981.938375] binder: undelivered TRANSACTION_ERROR: 29201 [ 981.943866] binder: undelivered TRANSACTION_COMPLETE [ 981.949051] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:10 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x1}, 0x5}, 0x1c) [ 982.002691] binder: 30982 RLIMIT_NICE not set 2018/04/10 12:55:10 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:10 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000400300000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:10 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:10 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:10 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000018400000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:10 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:11 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000030000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 982.806645] binder: 30982 RLIMIT_NICE not set [ 982.812802] binder: 30981:30982 got transaction to invalid handle [ 982.819176] binder: 30981:30982 transaction failed 29201/-22, size 0-0 line 2848 [ 982.827885] binder: BINDER_SET_CONTEXT_MGR already set [ 982.827969] binder: 30981:30982 ioctl c0306201 20004000 returned -14 [ 982.834550] binder: 30981:31020 ioctl 40046207 0 returned -16 [ 982.850818] binder_alloc: 30981: binder_alloc_buf, no vma [ 982.851125] binder: 30981:31024 got transaction to invalid handle [ 982.856514] binder: 30981:31020 transaction failed 29189/-3, size 0-0 line 2963 [ 982.862711] binder: 30981:31024 transaction failed 29201/-22, size 0-0 line 2848 2018/04/10 12:55:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000001", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:11 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0xf00}], 0x1, 0x0) 2018/04/10 12:55:11 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000300)={r3, 0x1c9}, 0x8) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:11 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:11 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:11 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}}, 0x14) 2018/04/10 12:55:11 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000200000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:11 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb80b0000]}, 0x10) shutdown(r0, 0x1) [ 982.973205] binder: undelivered TRANSACTION_ERROR: 29189 [ 982.978777] binder: undelivered TRANSACTION_ERROR: 29201 [ 982.985275] binder: release 30981:30982 transaction 666 in, still active [ 982.992222] binder: send failed reply for transaction 666 to 30981:31020 [ 982.999139] binder: undelivered TRANSACTION_ERROR: 29201 [ 983.004615] binder: undelivered TRANSACTION_COMPLETE [ 983.009767] binder: undelivered TRANSACTION_ERROR: 29189 [ 983.067994] binder: 31037 RLIMIT_NICE not set 2018/04/10 12:55:11 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe1f0020], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:11 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000001000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:11 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:11 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff0000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:11 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000003000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:12 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:12 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:12 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000003fff0000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 983.863886] binder: 31037 RLIMIT_NICE not set [ 983.870256] binder: 31033:31037 ioctl c0306201 20004000 returned -14 [ 983.870259] binder: BINDER_SET_CONTEXT_MGR already set [ 983.870273] binder: 31033:31080 ioctl 40046207 0 returned -16 [ 983.892812] binder_alloc: 31033: binder_alloc_buf, no vma [ 983.898490] binder: 31033:31080 transaction failed 29189/-3, size 0-0 line 2963 [ 983.898496] binder_alloc: 31033: binder_alloc_buf, no vma [ 983.898524] binder: 31033:31084 transaction failed 29189/-3, size 0-0 line 2963 [ 984.032550] binder: undelivered TRANSACTION_ERROR: 29189 [ 984.038139] binder: undelivered TRANSACTION_ERROR: 29189 [ 984.044419] binder: release 31033:31037 transaction 672 out, still active [ 984.051462] binder: release 31033:31037 transaction 671 in, still active [ 984.058360] binder: undelivered TRANSACTION_COMPLETE [ 984.063510] binder: release 31033:31080 transaction 671 out, still active [ 984.070484] binder: undelivered TRANSACTION_COMPLETE [ 984.075631] binder: send failed reply for transaction 672, target dead [ 984.082356] binder: send failed reply for transaction 671, target dead 2018/04/10 12:55:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840000000000000fffffdfd", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:12 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0xa00}], 0x1, 0x0) 2018/04/10 12:55:12 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, &(0x7f00000002c0)=0x84) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:12 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:12 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2ff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:12 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000040180000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:12 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}}, 0x14) 2018/04/10 12:55:12 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:13 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdef], 0x1}, 0x5}, 0x1c) [ 984.191062] binder: 31102 RLIMIT_NICE not set 2018/04/10 12:55:13 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000005000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:13 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:13 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:13 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:13 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000004018000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:13 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:13 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa605000000000000], 0x1}, 0x5}, 0x1c) [ 984.987188] binder: 31102 RLIMIT_NICE not set [ 984.995385] binder: BINDER_SET_CONTEXT_MGR already set [ 985.001195] binder: 31100:31102 ioctl c0306201 20004000 returned -14 [ 985.004082] binder: 31100:31141 ioctl 40046207 0 returned -16 [ 985.018929] binder_alloc: 31100: binder_alloc_buf, no vma [ 985.024608] binder_alloc: 31100: binder_alloc_buf, no vma [ 985.024620] binder: 31100:31141 transaction failed 29189/-3, size 0-0 line 2963 [ 985.037752] binder: 31100:31145 transaction failed 29189/-3, size 0-0 line 2963 [ 985.156235] binder: undelivered TRANSACTION_ERROR: 29189 [ 985.161816] binder: undelivered TRANSACTION_ERROR: 29189 [ 985.167424] binder: release 31100:31102 transaction 677 out, still active [ 985.174444] binder: release 31100:31102 transaction 676 in, still active [ 985.181373] binder: undelivered TRANSACTION_COMPLETE [ 985.186550] binder: release 31100:31141 transaction 676 out, still active [ 985.193521] binder: undelivered TRANSACTION_COMPLETE [ 985.198680] binder: send failed reply for transaction 677, target dead 2018/04/10 12:55:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840000000007ffffffff000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:14 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000ffffffef000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:14 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:14 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:14 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}, 0x14) 2018/04/10 12:55:14 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:14 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f0000000180)=0x80) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:14 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0x1100}], 0x1, 0x0) [ 985.205397] binder: send failed reply for transaction 676, target dead 2018/04/10 12:55:14 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x1}, 0x5}, 0x1c) [ 985.273213] binder: 31166 RLIMIT_NICE not set 2018/04/10 12:55:14 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000004000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:14 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:14 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:14 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000007fffffff000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:14 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:14 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:14 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 986.075119] binder: 31166 RLIMIT_NICE not set [ 986.078569] binder: 31157:31205 got new transaction with bad transaction stack, transaction 681 has target 31157:0 [ 986.090283] binder: 31157:31205 transaction failed 29201/-71, size 0-0 line 2875 [ 986.099884] binder: 31157:31166 ioctl c0306201 20004000 returned -14 [ 986.099894] binder: BINDER_SET_CONTEXT_MGR already set [ 986.111833] binder: 31157:31205 ioctl 40046207 0 returned -16 [ 986.122497] binder_alloc: 31157: binder_alloc_buf, no vma [ 986.128170] binder_alloc: 31157: binder_alloc_buf, no vma [ 986.128181] binder: 31157:31205 transaction failed 29189/-3, size 0-0 line 2963 [ 986.141312] binder: 31157:31207 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:55:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000100000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:15 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000020000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:15 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e05000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:15 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:15 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}}, 0x14) 2018/04/10 12:55:15 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:15 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000ac0)={{0x3ff}, 'port0\x00', 0x20, 0x181015, 0x7, 0x0, 0x3, 0xfffffffffffff001, 0x1, 0x0, 0x5, 0x37}) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:15 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0xffffff7f00000000}], 0x1, 0x0) [ 986.261810] binder: undelivered TRANSACTION_ERROR: 29189 [ 986.267385] binder: undelivered TRANSACTION_ERROR: 29189 [ 986.273550] binder: release 31157:31166 transaction 681 in, still active [ 986.280481] binder: send failed reply for transaction 681 to 31157:31205 [ 986.287396] binder: undelivered TRANSACTION_COMPLETE [ 986.292547] binder: undelivered TRANSACTION_ERROR: 29201 [ 986.298075] binder: undelivered TRANSACTION_ERROR: 29189 [ 986.335267] binder: 31222 RLIMIT_NICE not set 2018/04/10 12:55:15 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:15 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000005000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:15 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:15 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000050000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:15 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2800], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:15 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:15 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:15 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000002000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 987.137985] binder: 31222 RLIMIT_NICE not set [ 987.141470] binder: 31220:31262 got new transaction with bad transaction stack, transaction 686 has target 31220:0 [ 987.153142] binder: 31220:31262 transaction failed 29201/-71, size 0-0 line 2875 [ 987.173656] binder: 31220:31222 ioctl c0306201 20004000 returned -14 [ 987.177991] binder: BINDER_SET_CONTEXT_MGR already set [ 987.187158] binder: 31220:31262 ioctl 40046207 0 returned -16 [ 987.198062] binder_alloc: 31220: binder_alloc_buf, no vma [ 987.203713] binder_alloc: 31220: binder_alloc_buf, no vma [ 987.203724] binder: 31220:31262 transaction failed 29189/-3, size 0-0 line 2963 [ 987.217358] binder: 31220:31268 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:55:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000fffffdfd00000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:16 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:16 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:16 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5]}}, 0x14) 2018/04/10 12:55:16 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000003000000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:16 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:16 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1}) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:16 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0x2000000}], 0x1, 0x0) [ 987.339332] binder: undelivered TRANSACTION_ERROR: 29189 [ 987.344885] binder: undelivered TRANSACTION_ERROR: 29189 [ 987.354167] binder: release 31220:31222 transaction 686 in, still active [ 987.361122] binder: send failed reply for transaction 686 to 31220:31262 [ 987.368061] binder: undelivered TRANSACTION_COMPLETE [ 987.373204] binder: undelivered TRANSACTION_ERROR: 29201 [ 987.378669] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:16 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa6050000], 0x1}, 0x5}, 0x1c) [ 987.437641] binder: 31285 RLIMIT_NICE not set 2018/04/10 12:55:16 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000300000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:16 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:16 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a6], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:16 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:16 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000020000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:16 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f4], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:16 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 988.240720] binder: 31285 RLIMIT_NICE not set [ 988.246597] binder: 31283:31285 got transaction to invalid handle [ 988.252925] binder: 31283:31285 transaction failed 29201/-22, size 0-0 line 2848 [ 988.261356] binder: 31283:31285 ioctl c0306201 20004000 returned -14 [ 988.261382] binder: BINDER_SET_CONTEXT_MGR already set [ 988.273303] binder: 31283:31326 ioctl 40046207 0 returned -16 [ 988.284105] binder_alloc: 31283: binder_alloc_buf, no vma [ 988.284310] binder: 31283:31330 got transaction to invalid handle [ 988.289785] binder: 31283:31326 transaction failed 29189/-3, size 0-0 line 2963 [ 988.296063] binder: 31283:31330 transaction failed 29201/-22, size 0-0 line 2848 2018/04/10 12:55:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840000000f0ffffff7f0000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:17 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000050000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:17 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20001ffe], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:17 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:17 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00000000000000]}}, 0x14) 2018/04/10 12:55:17 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:17 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:17 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0xffffff7f}], 0x1, 0x0) [ 988.411793] binder: undelivered TRANSACTION_ERROR: 29189 [ 988.417343] binder: undelivered TRANSACTION_ERROR: 29201 [ 988.423112] binder: release 31283:31285 transaction 691 in, still active [ 988.430123] binder: send failed reply for transaction 691 to 31283:31326 [ 988.437054] binder: undelivered TRANSACTION_ERROR: 29201 [ 988.442551] binder: undelivered TRANSACTION_COMPLETE [ 988.447701] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:17 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 988.483593] binder: 31345 RLIMIT_NICE not set 2018/04/10 12:55:17 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:17 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000050008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:17 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:17 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffa4}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:17 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000340000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:17 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:17 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 989.286653] binder: 31345 RLIMIT_NICE not set [ 989.293457] binder: 31343:31345 got transaction to invalid handle [ 989.299961] binder: 31343:31345 transaction failed 29201/-22, size 0-0 line 2848 [ 989.308435] binder: BINDER_SET_CONTEXT_MGR already set [ 989.313839] binder: 31343:31345 ioctl c0306201 20004000 returned -14 [ 989.319112] binder: 31343:31385 ioctl 40046207 0 returned -16 [ 989.330362] binder_alloc: 31343: binder_alloc_buf, no vma [ 989.330599] binder: 31343:31390 got transaction to invalid handle [ 989.336190] binder: 31343:31385 transaction failed 29189/-3, size 0-0 line 2963 [ 989.342467] binder: 31343:31390 transaction failed 29201/-22, size 0-0 line 2848 2018/04/10 12:55:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000fdfdffff00000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:18 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:18 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000003fff00000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:18 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:18 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}}, 0x14) 2018/04/10 12:55:18 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:18 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:18 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}, 0xa000000}], 0x1, 0x0) [ 989.467676] binder: undelivered TRANSACTION_ERROR: 29189 [ 989.473246] binder: undelivered TRANSACTION_ERROR: 29201 [ 989.482306] binder: release 31343:31345 transaction 696 in, still active [ 989.489273] binder: send failed reply for transaction 696 to 31343:31385 [ 989.496197] binder: undelivered TRANSACTION_ERROR: 29201 [ 989.501692] binder: undelivered TRANSACTION_COMPLETE [ 989.506869] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:18 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000], 0x1}, 0x5}, 0x1c) [ 989.572923] binder: 31407 RLIMIT_NICE not set 2018/04/10 12:55:18 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000efffffff0008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:18 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:18 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000030000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:18 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:18 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:18 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x14) 2018/04/10 12:55:18 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000007fffffff0008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 990.371696] binder: 31407 RLIMIT_NICE not set [ 990.379489] binder: 31404:31407 got transaction to invalid handle [ 990.385968] binder: 31404:31407 transaction failed 29201/-22, size 0-0 line 2848 [ 990.394201] binder: 31404:31407 ioctl c0306201 20004000 returned -14 [ 990.394400] binder: BINDER_SET_CONTEXT_MGR already set [ 990.406474] binder: 31404:31446 ioctl 40046207 0 returned -16 [ 990.416137] binder_alloc: 31404: binder_alloc_buf, no vma [ 990.416376] binder: 31404:31449 got transaction to invalid handle [ 990.421821] binder: 31404:31446 transaction failed 29189/-3, size 0-0 line 2963 [ 990.428064] binder: 31404:31449 transaction failed 29201/-22, size 0-0 line 2848 [ 990.538149] binder: undelivered TRANSACTION_ERROR: 29189 [ 990.543718] binder: undelivered TRANSACTION_ERROR: 29201 [ 990.549706] binder: release 31404:31407 transaction 701 in, still active [ 990.556653] binder: send failed reply for transaction 701 to 31404:31446 [ 990.563575] binder: undelivered TRANSACTION_ERROR: 29201 [ 990.569091] binder: undelivered TRANSACTION_COMPLETE [ 990.574235] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000fffffd", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:19 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:19 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:19 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000030008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:19 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}}, 0x14) 2018/04/10 12:55:19 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:19 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:19 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:19 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4010000], 0x1}, 0x5}, 0x1c) [ 990.655232] binder: 31465 RLIMIT_NICE not set 2018/04/10 12:55:19 executing program 7: r0 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) pwritev(r0, &(0x7f0000000780), 0x10000000000002c2, 0x0) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:19 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000500000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:19 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:19 executing program 7: syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x8, 0x2) clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:19 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:19 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:19 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000401800000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 991.451316] binder: 31465 RLIMIT_NICE not set [ 991.457860] binder: BINDER_SET_CONTEXT_MGR already set [ 991.463652] binder: 31457:31465 ioctl c0306201 20004000 returned -14 [ 991.464092] binder: 31457:31506 ioctl 40046207 0 returned -16 [ 991.482994] binder_alloc: 31457: binder_alloc_buf, no vma [ 991.488725] binder: 31457:31506 transaction failed 29189/-3, size 0-0 line 2963 [ 991.489268] binder_alloc: 31457: binder_alloc_buf, no vma [ 991.501847] binder: 31457:31509 transaction failed 29189/-3, size 0-0 line 2963 [ 991.618196] binder: undelivered TRANSACTION_ERROR: 29189 [ 991.623814] binder: undelivered TRANSACTION_ERROR: 29189 [ 991.629378] binder: release 31457:31465 transaction 707 out, still active [ 991.636378] binder: release 31457:31465 transaction 706 in, still active [ 991.643288] binder: undelivered TRANSACTION_COMPLETE [ 991.648494] binder: release 31457:31506 transaction 706 out, still active [ 991.655504] binder: undelivered TRANSACTION_COMPLETE [ 991.660641] binder: send failed reply for transaction 707, target dead 2018/04/10 12:55:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000007ffffffff0", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:20 executing program 7: clone(0x2000c100, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:20 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:20 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000184000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:20 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:20 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}}, 0x14) 2018/04/10 12:55:20 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:20 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) [ 991.667350] binder: send failed reply for transaction 706, target dead [ 991.731075] binder: 31524 RLIMIT_NICE not set 2018/04/10 12:55:20 executing program 7: clone(0x0, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:20 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeffdffff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:20 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:20 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000040180008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:20 executing program 7: clone(0x0, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:20 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:20 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:20 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000ffffffef0008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 992.534698] binder: 31524 RLIMIT_NICE not set [ 992.541450] binder: 31522:31524 ioctl c0306201 20004000 returned -14 [ 992.542108] binder: BINDER_SET_CONTEXT_MGR already set [ 992.553591] binder: 31522:31565 ioctl 40046207 0 returned -16 [ 992.564840] binder_alloc: 31522: binder_alloc_buf, no vma [ 992.570539] binder: 31522:31565 transaction failed 29189/-3, size 0-0 line 2963 [ 992.570800] binder_alloc: 31522: binder_alloc_buf, no vma [ 992.583768] binder: 31522:31568 transaction failed 29189/-3, size 0-0 line 2963 [ 992.701195] binder: undelivered TRANSACTION_ERROR: 29189 [ 992.706736] binder: undelivered TRANSACTION_ERROR: 29189 [ 992.712684] binder: release 31522:31524 transaction 712 out, still active [ 992.719694] binder: release 31522:31524 transaction 711 in, still active [ 992.726598] binder: undelivered TRANSACTION_COMPLETE [ 992.731739] binder: release 31522:31565 transaction 711 out, still active [ 992.738792] binder: undelivered TRANSACTION_COMPLETE [ 992.743946] binder: send failed reply for transaction 712, target dead 2018/04/10 12:55:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000001000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:21 executing program 7: clone(0x0, &(0x7f0000000800)="97bb77038add5df9e9d4f9783b82c55fe59e5c0acdbcfc9bcf92ac0e1f1f3c1959c1d25dfabf3849336c7c85be174d7765b47e113632aea54b87e4d3f2c1db09e6aa4040b43d17308fb7e62e808067da2fff3cfd8e4c038c814bbfc6bc49d8ebc8671d8297e2d34dc61f2d194d2dbb8f59b4c853e0714d3d4bb29d1243fac01c86c8c4dd38daedab3c6ad73a72d3f6dd2684aa82e5285eb82452c9848b7beb8bc5", &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:21 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:21 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:21 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000002000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:21 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}}, 0x14) 2018/04/10 12:55:21 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd400]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:21 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) [ 992.750638] binder: send failed reply for transaction 711, target dead [ 992.819594] binder: 31587 RLIMIT_NICE not set 2018/04/10 12:55:21 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:21 executing program 7: clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)="ed6c04412e782fe395f084741e3d9fe469aebde09acc8f8d8d84d1f00f5573b09acba487077ebb904cb1f3fed55f59d677ce24bbd2a7506df8e1e0d0fc709cb8c9f4ab2aeeeebc5ef879742c1f7628f1862c88b5b0da89acbf43ef12e4839405b6a3430d296fea06d2f3a8356c57ec991e44ee72") 2018/04/10 12:55:21 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000010008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:21 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:21 executing program 7: clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:21 executing program 7: 2018/04/10 12:55:21 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000020008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:21 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000], 0x1}, 0x5}, 0x1c) [ 993.627965] binder: 31587 RLIMIT_NICE not set [ 993.634388] binder: 31585:31587 ioctl c0306201 20004000 returned -14 [ 993.634400] binder: BINDER_SET_CONTEXT_MGR already set [ 993.646577] binder: 31585:31624 ioctl 40046207 0 returned -16 [ 993.658095] binder_alloc: 31585: binder_alloc_buf, no vma [ 993.663780] binder: 31585:31624 transaction failed 29189/-3, size 0-0 line 2963 [ 993.665057] binder_alloc: 31585: binder_alloc_buf, no vma [ 993.676925] binder: 31585:31626 transaction failed 29189/-3, size 0-0 line 2963 [ 993.792978] binder: undelivered TRANSACTION_ERROR: 29189 [ 993.798534] binder: undelivered TRANSACTION_ERROR: 29189 [ 993.804247] binder: release 31585:31587 transaction 717 out, still active [ 993.811254] binder: release 31585:31587 transaction 716 in, still active [ 993.818171] binder: undelivered TRANSACTION_COMPLETE [ 993.823409] binder: release 31585:31624 transaction 716 out, still active [ 993.830384] binder: undelivered TRANSACTION_COMPLETE [ 993.835538] binder: send failed reply for transaction 717, target dead 2018/04/10 12:55:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840000000fffffdfd000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:22 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:22 executing program 7: 2018/04/10 12:55:22 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:22 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000040008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:22 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}}, 0x14) 2018/04/10 12:55:22 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:22 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:22 executing program 7: [ 993.842262] binder: send failed reply for transaction 716, target dead [ 993.871486] binder: 31638 RLIMIT_NICE not set 2018/04/10 12:55:22 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff020000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:22 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:22 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000003fff0008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:22 executing program 7: 2018/04/10 12:55:22 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:22 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffa4}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:22 executing program 7: [ 994.671867] binder: 31638 RLIMIT_NICE not set [ 994.676983] binder: 31634:31638 got transaction to invalid handle [ 994.683343] binder: 31634:31638 transaction failed 29201/-22, size 0-0 line 2848 [ 994.691437] binder: BINDER_SET_CONTEXT_MGR already set [ 994.696829] binder: 31634:31638 ioctl c0306201 20004000 returned -14 [ 994.702155] binder: 31634:31675 ioctl 40046207 0 returned -16 [ 994.715182] binder_alloc: 31634: binder_alloc_buf, no vma [ 994.715387] binder: 31634:31679 got transaction to invalid handle [ 994.720908] binder: 31634:31675 transaction failed 29189/-3, size 0-0 line 2963 [ 994.727162] binder: 31634:31679 transaction failed 29201/-22, size 0-0 line 2848 2018/04/10 12:55:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840000000fdfdffff000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:23 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000004003000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:23 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}}, 0x14) 2018/04/10 12:55:23 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:23 executing program 7: 2018/04/10 12:55:23 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:23 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:23 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) [ 994.852258] binder: undelivered TRANSACTION_ERROR: 29189 [ 994.857835] binder: undelivered TRANSACTION_ERROR: 29201 [ 994.866461] binder: release 31634:31638 transaction 721 in, still active [ 994.873429] binder: send failed reply for transaction 721 to 31634:31675 [ 994.880353] binder: undelivered TRANSACTION_ERROR: 29201 [ 994.885839] binder: undelivered TRANSACTION_COMPLETE [ 994.890980] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:23 executing program 7: [ 994.947931] binder: 31692 RLIMIT_NICE not set 2018/04/10 12:55:23 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:23 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:23 executing program 7: 2018/04/10 12:55:23 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000ff3f00000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:23 executing program 7: 2018/04/10 12:55:23 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:23 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 995.751072] binder: 31692 RLIMIT_NICE not set [ 995.757122] binder: 31690:31692 got transaction to invalid handle [ 995.763446] binder: 31690:31692 transaction failed 29201/-22, size 0-0 line 2848 [ 995.772051] binder: BINDER_SET_CONTEXT_MGR already set [ 995.772072] binder: 31690:31692 ioctl c0306201 20004000 returned -14 [ 995.781870] binder: 31690:31728 ioctl 40046207 0 returned -16 [ 995.794255] binder_alloc: 31690: binder_alloc_buf, no vma [ 995.795652] binder: 31690:31731 got transaction to invalid handle [ 995.800078] binder: 31690:31728 transaction failed 29189/-3, size 0-0 line 2963 [ 995.806164] binder: 31690:31731 transaction failed 29201/-22, size 0-0 line 2848 2018/04/10 12:55:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000f0ffffff7f00", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:24 executing program 7: 2018/04/10 12:55:24 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000040000000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:24 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:24 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00000000000000]}}, 0x14) 2018/04/10 12:55:24 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:24 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:24 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) [ 995.930963] binder: undelivered TRANSACTION_ERROR: 29189 [ 995.936577] binder: undelivered TRANSACTION_ERROR: 29201 [ 995.942526] binder: release 31690:31692 transaction 726 in, still active [ 995.949470] binder: send failed reply for transaction 726 to 31690:31728 [ 995.956409] binder: undelivered TRANSACTION_ERROR: 29201 [ 995.961915] binder: undelivered TRANSACTION_COMPLETE [ 995.967064] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:24 executing program 7: [ 996.027319] binder: 31739 RLIMIT_NICE not set 2018/04/10 12:55:24 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:24 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:24 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000200008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:24 executing program 7: 2018/04/10 12:55:24 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2800000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:24 executing program 7: 2018/04/10 12:55:25 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000040030008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 996.821334] binder: 31739 RLIMIT_NICE not set [ 996.827602] binder: 31736:31739 ioctl c0306201 20004000 returned -14 [ 996.827639] binder: BINDER_SET_CONTEXT_MGR already set [ 996.839764] binder: 31736:31778 ioctl 40046207 0 returned -16 [ 996.850846] binder_alloc: 31736: binder_alloc_buf, no vma [ 996.856575] binder: 31736:31778 transaction failed 29189/-3, size 0-0 line 2963 [ 996.856580] binder_alloc: 31736: binder_alloc_buf, no vma [ 996.856606] binder: 31736:31781 transaction failed 29189/-3, size 0-0 line 2963 [ 996.986208] binder: undelivered TRANSACTION_ERROR: 29189 [ 996.991754] binder: undelivered TRANSACTION_ERROR: 29189 [ 996.997973] binder: release 31736:31739 transaction 732 out, still active [ 997.005010] binder: release 31736:31739 transaction 731 in, still active [ 997.011958] binder: undelivered TRANSACTION_COMPLETE [ 997.017151] binder: release 31736:31778 transaction 731 out, still active [ 997.024107] binder: undelivered TRANSACTION_COMPLETE [ 997.029243] binder: send failed reply for transaction 732, target dead 2018/04/10 12:55:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:25 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:25 executing program 7: 2018/04/10 12:55:25 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff02000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:25 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000]}}, 0x14) 2018/04/10 12:55:25 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000ffffffef08001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:25 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:25 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) [ 997.035945] binder: send failed reply for transaction 731, target dead [ 997.090632] binder: 31792 RLIMIT_NICE not set 2018/04/10 12:55:25 executing program 7: 2018/04/10 12:55:25 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:25 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000003000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:25 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:25 executing program 7: 2018/04/10 12:55:26 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:26 executing program 7 (fault-call:0 fault-nth:0): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:26 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000020000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 997.313706] FAULT_INJECTION: forcing a failure. [ 997.313706] name failslab, interval 1, probability 0, space 0, times 0 [ 997.325102] CPU: 0 PID: 31824 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 997.332047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 997.341411] Call Trace: [ 997.344021] dump_stack+0x1b9/0x294 [ 997.347674] ? dump_stack_print_info.cold.2+0x52/0x52 [ 997.352883] ? graph_lock+0x170/0x170 [ 997.356711] should_fail.cold.4+0xa/0x1a [ 997.360788] ? graph_lock+0x170/0x170 [ 997.364607] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 997.369741] ? find_held_lock+0x36/0x1c0 [ 997.373838] ? check_same_owner+0x320/0x320 [ 997.378175] ? rcu_read_lock+0x70/0x70 [ 997.382081] ? rcu_note_context_switch+0x710/0x710 [ 997.387043] __should_failslab+0x124/0x180 [ 997.391293] should_failslab+0x9/0x14 [ 997.395114] kmem_cache_alloc_node+0x272/0x780 [ 997.399710] ? page_add_new_anon_rmap+0x850/0x850 [ 997.404566] ? print_usage_bug+0xc0/0xc0 [ 997.408650] ? print_usage_bug+0xc0/0xc0 [ 997.412724] ? graph_lock+0x170/0x170 [ 997.416519] copy_process.part.38+0x16bf/0x6ee0 [ 997.421179] ? __lock_acquire+0x7f5/0x5130 [ 997.425399] ? lock_acquire+0x1dc/0x520 [ 997.429369] ? alloc_set_pte+0x1077/0x16a0 [ 997.433609] ? print_usage_bug+0xc0/0xc0 [ 997.437672] ? graph_lock+0x170/0x170 [ 997.441474] ? __cleanup_sighand+0x70/0x70 [ 997.445704] ? reacquire_held_locks+0xbc/0x3e0 [ 997.450281] ? alloc_set_pte+0x1077/0x16a0 [ 997.454517] ? print_usage_bug+0xc0/0xc0 [ 997.458563] ? lock_downgrade+0x8e0/0x8e0 [ 997.462701] ? debug_check_no_locks_freed+0x310/0x310 [ 997.467885] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 997.473088] ? print_usage_bug+0xc0/0xc0 [ 997.477147] ? debug_check_no_locks_freed+0x310/0x310 [ 997.482323] ? __lock_acquire+0x7f5/0x5130 [ 997.486558] ? debug_check_no_locks_freed+0x310/0x310 [ 997.491752] ? debug_check_no_locks_freed+0x310/0x310 [ 997.496924] ? print_usage_bug+0xc0/0xc0 [ 997.500983] ? print_usage_bug+0xc0/0xc0 [ 997.505049] ? graph_lock+0x170/0x170 [ 997.508861] ? graph_lock+0x170/0x170 [ 997.512654] ? lock_acquire+0x1dc/0x520 [ 997.516612] ? __fdget_pos+0x1a9/0x1e0 [ 997.520494] ? graph_lock+0x170/0x170 [ 997.524295] ? __lock_acquire+0x7f5/0x5130 [ 997.528524] ? find_held_lock+0x36/0x1c0 [ 997.532571] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 997.538097] ? _parse_integer+0x13b/0x190 [ 997.542245] ? graph_lock+0x170/0x170 [ 997.546051] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 997.551587] ? _kstrtoull+0x180/0x230 [ 997.555383] ? _parse_integer+0x190/0x190 [ 997.559528] ? graph_lock+0x170/0x170 [ 997.563326] ? lock_release+0xa10/0xa10 [ 997.567292] ? check_same_owner+0x320/0x320 [ 997.571604] ? find_held_lock+0x36/0x1c0 [ 997.575653] ? graph_lock+0x170/0x170 [ 997.579455] ? lock_downgrade+0x8e0/0x8e0 [ 997.583593] ? find_held_lock+0x36/0x1c0 [ 997.587655] ? lock_downgrade+0x8e0/0x8e0 [ 997.591792] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 997.597329] ? proc_fail_nth_write+0x96/0x1f0 [ 997.601828] ? proc_cwd_link+0x1d0/0x1d0 [ 997.605888] ? find_held_lock+0x36/0x1c0 [ 997.609944] _do_fork+0x291/0x12a0 [ 997.613478] ? fork_idle+0x1a0/0x1a0 [ 997.617191] ? __lock_is_held+0xb5/0x140 [ 997.621242] ? __sb_end_write+0xac/0xe0 [ 997.625214] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 997.630750] ? fput+0x130/0x1a0 [ 997.634031] ? ksys_write+0x1a6/0x250 [ 997.637833] ? SyS_read+0x30/0x30 [ 997.641279] ? mm_fault_error+0x380/0x380 [ 997.645426] SyS_clone+0x37/0x50 [ 997.648792] ? sys_vfork+0x30/0x30 [ 997.652318] do_syscall_64+0x29e/0x9d0 [ 997.656196] ? vmalloc_sync_all+0x30/0x30 [ 997.660332] ? _raw_spin_unlock_irq+0x27/0x70 [ 997.664824] ? finish_task_switch+0x1ca/0x820 [ 997.669314] ? syscall_return_slowpath+0x5c0/0x5c0 [ 997.674239] ? syscall_return_slowpath+0x30f/0x5c0 [ 997.679159] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 997.684548] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 997.689391] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 997.694567] RIP: 0033:0x455259 [ 997.697745] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 997.705456] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 997.712721] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 997.719973] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 997.727233] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 997.734506] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000000 [ 997.892646] binder: 31792 RLIMIT_NICE not set [ 997.898800] binder: 31788:31792 ioctl c0306201 20004000 returned -14 [ 997.898806] binder: BINDER_SET_CONTEXT_MGR already set [ 997.898820] binder: 31788:31831 ioctl 40046207 0 returned -16 [ 997.922554] binder_alloc: 31788: binder_alloc_buf, no vma [ 997.928283] binder: 31788:31831 transaction failed 29189/-3, size 0-0 line 2963 [ 997.928976] binder_alloc: 31788: binder_alloc_buf, no vma [ 997.941473] binder: 31788:31834 transaction failed 29189/-3, size 0-0 line 2963 [ 998.058513] binder: undelivered TRANSACTION_ERROR: 29189 [ 998.064076] binder: undelivered TRANSACTION_ERROR: 29189 [ 998.072894] binder: release 31788:31792 transaction 737 out, still active [ 998.079943] binder: release 31788:31792 transaction 736 in, still active [ 998.086858] binder: undelivered TRANSACTION_COMPLETE [ 998.092072] binder: release 31788:31831 transaction 736 out, still active [ 998.099055] binder: undelivered TRANSACTION_COMPLETE 2018/04/10 12:55:26 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:26 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x14) 2018/04/10 12:55:26 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeffdffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:26 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:26 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:26 executing program 7 (fault-call:0 fault-nth:1): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000000000000000ffff", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:26 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000005000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 998.104240] binder: send failed reply for transaction 737, target dead [ 998.110975] binder: send failed reply for transaction 736, target dead 2018/04/10 12:55:26 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff], 0x1}, 0x5}, 0x1c) [ 998.178559] FAULT_INJECTION: forcing a failure. [ 998.178559] name failslab, interval 1, probability 0, space 0, times 0 [ 998.189902] CPU: 0 PID: 31844 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 998.196843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 998.204384] binder: 31842 RLIMIT_NICE not set [ 998.206194] Call Trace: [ 998.206220] dump_stack+0x1b9/0x294 [ 998.206241] ? dump_stack_print_info.cold.2+0x52/0x52 [ 998.206263] should_fail.cold.4+0xa/0x1a 2018/04/10 12:55:27 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900], 0x1}, 0x5}, 0x1c) [ 998.206286] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 998.231389] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 998.236524] ? memcg_kmem_charge_memcg+0x74/0x110 [ 998.241389] ? percpu_ref_tryget+0x2b0/0x2b0 [ 998.245822] ? find_held_lock+0x36/0x1c0 [ 998.249923] ? check_same_owner+0x320/0x320 [ 998.254358] ? rcu_note_context_switch+0x710/0x710 [ 998.259313] __should_failslab+0x124/0x180 [ 998.263568] should_failslab+0x9/0x14 [ 998.267386] kmem_cache_alloc+0x2af/0x760 [ 998.271544] ? rcu_is_watching+0x85/0x140 [ 998.275699] ? rcu_pm_notify+0xc0/0xc0 [ 998.279591] prepare_creds+0x78/0x3e0 [ 998.283388] ? abort_creds+0x170/0x170 [ 998.287274] ? __raw_spin_lock_init+0x1c/0x100 [ 998.291849] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 998.296860] copy_creds+0x7b/0x470 [ 998.300385] ? lockdep_init_map+0x9/0x10 [ 998.304433] copy_process.part.38+0xcf9/0x6ee0 [ 998.309006] ? __lock_acquire+0x7f5/0x5130 [ 998.313238] ? lock_acquire+0x1dc/0x520 [ 998.317208] ? alloc_set_pte+0x1077/0x16a0 [ 998.321433] ? print_usage_bug+0xc0/0xc0 [ 998.325491] ? __cleanup_sighand+0x70/0x70 [ 998.329713] ? alloc_set_pte+0x1077/0x16a0 [ 998.333942] ? print_usage_bug+0xc0/0xc0 [ 998.337991] ? lock_downgrade+0x8e0/0x8e0 [ 998.342136] ? debug_check_no_locks_freed+0x310/0x310 [ 998.347406] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 998.352587] ? print_usage_bug+0xc0/0xc0 [ 998.356651] ? debug_check_no_locks_freed+0x310/0x310 [ 998.361828] ? __lock_acquire+0x7f5/0x5130 [ 998.366056] ? debug_check_no_locks_freed+0x310/0x310 [ 998.371243] ? debug_check_no_locks_freed+0x310/0x310 [ 998.376418] ? print_usage_bug+0xc0/0xc0 [ 998.380643] ? print_usage_bug+0xc0/0xc0 [ 998.384693] ? graph_lock+0x170/0x170 [ 998.388485] ? graph_lock+0x170/0x170 [ 998.392272] ? lock_acquire+0x1dc/0x520 [ 998.396232] ? __fdget_pos+0x1a9/0x1e0 [ 998.400107] ? graph_lock+0x170/0x170 [ 998.403900] ? __lock_acquire+0x7f5/0x5130 [ 998.408124] ? find_held_lock+0x36/0x1c0 [ 998.412174] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 998.417700] ? _parse_integer+0x13b/0x190 [ 998.421837] ? graph_lock+0x170/0x170 [ 998.425637] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 998.431159] ? _kstrtoull+0x180/0x230 [ 998.434948] ? _parse_integer+0x190/0x190 [ 998.439094] ? graph_lock+0x170/0x170 [ 998.442879] ? lock_release+0xa10/0xa10 [ 998.446842] ? check_same_owner+0x320/0x320 [ 998.451153] ? find_held_lock+0x36/0x1c0 [ 998.455205] ? graph_lock+0x170/0x170 [ 998.458994] ? lock_downgrade+0x8e0/0x8e0 [ 998.463138] ? find_held_lock+0x36/0x1c0 [ 998.467193] ? lock_downgrade+0x8e0/0x8e0 [ 998.471331] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 998.476855] ? proc_fail_nth_write+0x96/0x1f0 [ 998.481335] ? proc_cwd_link+0x1d0/0x1d0 [ 998.486076] ? find_held_lock+0x36/0x1c0 [ 998.490132] _do_fork+0x291/0x12a0 [ 998.493664] ? fork_idle+0x1a0/0x1a0 [ 998.497367] ? __lock_is_held+0xb5/0x140 [ 998.501429] ? __sb_end_write+0xac/0xe0 [ 998.505395] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 998.510915] ? fput+0x130/0x1a0 [ 998.514182] ? ksys_write+0x1a6/0x250 [ 998.517973] ? SyS_read+0x30/0x30 [ 998.521412] ? mm_fault_error+0x380/0x380 [ 998.525555] SyS_clone+0x37/0x50 [ 998.528910] ? sys_vfork+0x30/0x30 [ 998.532440] do_syscall_64+0x29e/0x9d0 [ 998.536313] ? vmalloc_sync_all+0x30/0x30 [ 998.540449] ? _raw_spin_unlock_irq+0x27/0x70 [ 998.544933] ? finish_task_switch+0x1ca/0x820 [ 998.549415] ? syscall_return_slowpath+0x5c0/0x5c0 [ 998.554334] ? syscall_return_slowpath+0x30f/0x5c0 [ 998.559256] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 998.564616] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 998.569452] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 998.574627] RIP: 0033:0x455259 [ 998.577805] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 998.585503] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 998.592770] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 998.600033] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 998.607292] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 998.614553] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000001 2018/04/10 12:55:27 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:27 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:27 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000408001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:27 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8030000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:27 executing program 7 (fault-call:0 fault-nth:2): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:27 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000500000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 998.788767] FAULT_INJECTION: forcing a failure. [ 998.788767] name failslab, interval 1, probability 0, space 0, times 0 [ 998.800177] CPU: 0 PID: 31877 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 998.807124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 998.816837] Call Trace: [ 998.819447] dump_stack+0x1b9/0x294 [ 998.823103] ? dump_stack_print_info.cold.2+0x52/0x52 [ 998.828310] ? save_stack+0x43/0xd0 [ 998.831950] ? kasan_kmalloc+0xc4/0xe0 [ 998.835851] ? kasan_slab_alloc+0x12/0x20 [ 998.839996] ? kmem_cache_alloc+0x12e/0x760 [ 998.844321] should_fail.cold.4+0xa/0x1a [ 998.848377] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 998.853477] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 998.858658] ? find_held_lock+0x36/0x1c0 [ 998.862727] ? check_same_owner+0x320/0x320 [ 998.867042] ? rcu_is_watching+0x85/0x140 [ 998.871184] ? rcu_note_context_switch+0x710/0x710 [ 998.876101] ? security_prepare_creds+0x94/0xc0 [ 998.880764] __should_failslab+0x124/0x180 [ 998.884988] should_failslab+0x9/0x14 [ 998.888787] kmem_cache_alloc+0x2af/0x760 [ 998.892922] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 998.897935] __delayacct_tsk_init+0x20/0x80 [ 998.902255] copy_process.part.38+0x303e/0x6ee0 [ 998.906917] ? __lock_acquire+0x7f5/0x5130 [ 998.911152] ? zap_class+0x720/0x720 [ 998.914853] ? lock_acquire+0x1dc/0x520 [ 998.918814] ? alloc_set_pte+0x1077/0x16a0 [ 998.923045] ? print_usage_bug+0xc0/0xc0 [ 998.927101] ? __cleanup_sighand+0x70/0x70 [ 998.931411] ? alloc_set_pte+0x1077/0x16a0 [ 998.935655] ? print_usage_bug+0xc0/0xc0 [ 998.939707] ? lock_downgrade+0x8e0/0x8e0 [ 998.943848] ? debug_check_no_locks_freed+0x310/0x310 [ 998.949032] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 998.954222] ? print_usage_bug+0xc0/0xc0 [ 998.958284] ? debug_check_no_locks_freed+0x310/0x310 [ 998.963463] ? __lock_acquire+0x7f5/0x5130 [ 998.967687] ? debug_check_no_locks_freed+0x310/0x310 [ 998.972866] ? perf_trace_lock+0xd6/0x900 [ 998.977012] ? debug_check_no_locks_freed+0x310/0x310 [ 998.982194] ? print_usage_bug+0xc0/0xc0 [ 998.986246] ? zap_class+0x720/0x720 [ 998.989947] ? perf_trace_lock+0xd6/0x900 [ 998.994081] ? perf_trace_lock+0xd6/0x900 [ 998.998216] ? graph_lock+0x170/0x170 [ 999.002009] ? graph_lock+0x170/0x170 [ 999.005800] ? lock_acquire+0x1dc/0x520 [ 999.009763] ? perf_trace_lock+0xd6/0x900 [ 999.013903] ? zap_class+0x720/0x720 [ 999.017603] ? find_held_lock+0x36/0x1c0 [ 999.021654] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 999.027190] ? _parse_integer+0x13b/0x190 [ 999.031326] ? graph_lock+0x170/0x170 [ 999.035113] ? perf_trace_lock+0xd6/0x900 [ 999.039247] ? _kstrtoull+0x180/0x230 [ 999.043038] ? _parse_integer+0x190/0x190 [ 999.047201] ? zap_class+0x720/0x720 [ 999.050904] ? find_held_lock+0x36/0x1c0 [ 999.054953] ? graph_lock+0x170/0x170 [ 999.058752] ? perf_trace_lock+0xd6/0x900 [ 999.062890] ? find_held_lock+0x36/0x1c0 [ 999.066947] ? lock_downgrade+0x8e0/0x8e0 [ 999.071083] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 999.076610] ? proc_fail_nth_write+0x96/0x1f0 [ 999.081101] ? find_held_lock+0x36/0x1c0 [ 999.085150] _do_fork+0x291/0x12a0 [ 999.088687] ? fork_idle+0x1a0/0x1a0 [ 999.092405] ? __sb_end_write+0xac/0xe0 [ 999.096370] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 999.101891] ? fput+0x130/0x1a0 [ 999.105159] ? ksys_write+0x1a6/0x250 [ 999.108961] ? SyS_read+0x30/0x30 [ 999.112402] ? mm_fault_error+0x380/0x380 [ 999.116545] SyS_clone+0x37/0x50 [ 999.119895] ? sys_vfork+0x30/0x30 [ 999.123425] do_syscall_64+0x29e/0x9d0 [ 999.127297] ? vmalloc_sync_all+0x30/0x30 [ 999.131434] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 999.136266] ? syscall_return_slowpath+0x5c0/0x5c0 [ 999.141188] ? syscall_return_slowpath+0x30f/0x5c0 [ 999.146112] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 999.151465] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 999.156304] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 999.161480] RIP: 0033:0x455259 [ 999.164660] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 999.172356] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 999.179612] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 999.186869] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 999.194123] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 999.201378] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000002 2018/04/10 12:55:28 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:28 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:28 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:28 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000fffffdfd0000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:28 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000001840000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:28 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}}, 0x14) 2018/04/10 12:55:28 executing program 7 (fault-call:0 fault-nth:3): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) [ 999.455165] binder: 31899 RLIMIT_NICE not set [ 999.460134] FAULT_INJECTION: forcing a failure. [ 999.460134] name failslab, interval 1, probability 0, space 0, times 0 [ 999.471447] CPU: 0 PID: 31902 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 999.478387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 999.487746] Call Trace: [ 999.490357] dump_stack+0x1b9/0x294 [ 999.494008] ? dump_stack_print_info.cold.2+0x52/0x52 [ 999.499224] ? find_held_lock+0x36/0x1c0 [ 999.503311] should_fail.cold.4+0xa/0x1a [ 999.507400] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 999.512547] ? lock_downgrade+0x8e0/0x8e0 [ 999.517153] ? find_held_lock+0x36/0x1c0 [ 999.521274] ? check_same_owner+0x320/0x320 [ 999.525619] ? debug_mutex_init+0x1c/0x60 [ 999.529788] ? rcu_note_context_switch+0x710/0x710 [ 999.534735] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 999.539774] __should_failslab+0x124/0x180 [ 999.544040] should_failslab+0x9/0x14 [ 999.547877] kmem_cache_alloc+0x2af/0x760 [ 999.552050] ? __mutex_init+0x1ef/0x280 [ 999.556053] ? SyS_membarrier+0x7f0/0x7f0 [ 999.560220] dup_fd+0x114/0xf40 [ 999.563533] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 999.569059] ? audit_alloc+0xea/0x920 [ 999.572854] ? ksys_dup3+0x670/0x670 [ 999.576561] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 999.582087] ? perf_event_init_task+0x1f3/0x8c0 [ 999.586766] ? sched_fork+0x473/0xba0 [ 999.590557] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 999.596082] ? copy_semundo+0xc5/0x350 [ 999.599961] ? SyS_semop+0x30/0x30 [ 999.603501] ? __raw_spin_lock_init+0x1c/0x100 [ 999.608071] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 999.613079] ? __lockdep_init_map+0x105/0x590 [ 999.617566] ? security_task_alloc+0x88/0xb0 [ 999.621965] copy_process.part.38+0x1e4a/0x6ee0 [ 999.626624] ? __lock_acquire+0x7f5/0x5130 [ 999.630850] ? lock_acquire+0x1dc/0x520 [ 999.634811] ? alloc_set_pte+0x1077/0x16a0 [ 999.639050] ? __cleanup_sighand+0x70/0x70 [ 999.643274] ? alloc_set_pte+0x1077/0x16a0 [ 999.647504] ? print_usage_bug+0xc0/0xc0 [ 999.651557] ? lock_downgrade+0x8e0/0x8e0 [ 999.655698] ? debug_check_no_locks_freed+0x310/0x310 [ 999.660875] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 999.666055] ? print_usage_bug+0xc0/0xc0 [ 999.670116] ? debug_check_no_locks_freed+0x310/0x310 [ 999.675297] ? __lock_acquire+0x7f5/0x5130 [ 999.679537] ? debug_check_no_locks_freed+0x310/0x310 [ 999.684722] ? print_usage_bug+0xc0/0xc0 [ 999.688774] ? print_usage_bug+0xc0/0xc0 [ 999.692835] ? graph_lock+0x170/0x170 [ 999.696628] ? lock_acquire+0x1dc/0x520 [ 999.700590] ? __fdget_pos+0x1a9/0x1e0 [ 999.704466] ? graph_lock+0x170/0x170 [ 999.708260] ? __lock_acquire+0x7f5/0x5130 [ 999.712486] ? find_held_lock+0x36/0x1c0 [ 999.716534] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 999.722060] ? _parse_integer+0x13b/0x190 [ 999.726199] ? graph_lock+0x170/0x170 [ 999.729988] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 999.735512] ? _kstrtoull+0x180/0x230 [ 999.739300] ? _parse_integer+0x190/0x190 [ 999.743439] ? graph_lock+0x170/0x170 [ 999.747226] ? lock_release+0xa10/0xa10 [ 999.751186] ? check_same_owner+0x320/0x320 [ 999.755496] ? find_held_lock+0x36/0x1c0 [ 999.759548] ? graph_lock+0x170/0x170 [ 999.763341] ? lock_downgrade+0x8e0/0x8e0 [ 999.767483] ? find_held_lock+0x36/0x1c0 [ 999.771542] ? lock_downgrade+0x8e0/0x8e0 [ 999.775677] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 999.781205] ? proc_fail_nth_write+0x96/0x1f0 [ 999.785696] ? proc_cwd_link+0x1d0/0x1d0 [ 999.789755] ? find_held_lock+0x36/0x1c0 [ 999.793815] _do_fork+0x291/0x12a0 [ 999.797354] ? fork_idle+0x1a0/0x1a0 [ 999.801065] ? __lock_is_held+0xb5/0x140 [ 999.805132] ? retint_kernel+0x10/0x10 [ 999.809016] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 999.814044] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 999.818880] ? retint_kernel+0x10/0x10 [ 999.822755] ? sys_vfork+0x30/0x30 [ 999.826547] SyS_clone+0x37/0x50 [ 999.829899] ? sys_vfork+0x30/0x30 [ 999.833433] do_syscall_64+0x29e/0x9d0 [ 999.837308] ? vmalloc_sync_all+0x30/0x30 [ 999.841447] ? _raw_spin_unlock_irq+0x27/0x70 [ 999.845932] ? finish_task_switch+0x1ca/0x820 [ 999.850441] ? syscall_return_slowpath+0x5c0/0x5c0 [ 999.855360] ? syscall_return_slowpath+0x30f/0x5c0 [ 999.860280] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 999.865634] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 999.870484] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 999.875657] RIP: 0033:0x455259 [ 999.878829] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 999.886524] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 999.893779] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 2018/04/10 12:55:28 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:28 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57e], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:28 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 999.901037] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 999.908290] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 999.915544] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000003 2018/04/10 12:55:28 executing program 7 (fault-call:0 fault-nth:4): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) [ 1000.007776] FAULT_INJECTION: forcing a failure. [ 1000.007776] name failslab, interval 1, probability 0, space 0, times 0 [ 1000.019144] CPU: 0 PID: 31922 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1000.026082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1000.035454] Call Trace: [ 1000.038042] dump_stack+0x1b9/0x294 [ 1000.041664] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1000.046845] ? __kernel_text_address+0xd/0x40 [ 1000.051337] should_fail.cold.4+0xa/0x1a [ 1000.055388] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1000.060480] ? save_stack+0xa9/0xd0 [ 1000.064096] ? zap_class+0x720/0x720 [ 1000.067797] ? copy_process.part.38+0x1e4a/0x6ee0 [ 1000.072623] ? _do_fork+0x291/0x12a0 [ 1000.076322] ? SyS_clone+0x37/0x50 [ 1000.079852] ? do_syscall_64+0x29e/0x9d0 [ 1000.083900] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1000.089252] ? find_held_lock+0x36/0x1c0 [ 1000.093318] ? check_same_owner+0x320/0x320 [ 1000.097629] ? rcu_note_context_switch+0x710/0x710 [ 1000.102551] __should_failslab+0x124/0x180 [ 1000.106776] should_failslab+0x9/0x14 [ 1000.110564] kmem_cache_alloc_trace+0x2cb/0x780 [ 1000.115219] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1000.119629] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1000.124196] ? __lock_is_held+0xb5/0x140 [ 1000.128249] alloc_fdtable+0x89/0x280 [ 1000.132044] dup_fd+0xa60/0xf40 [ 1000.135754] ? ksys_dup3+0x670/0x670 [ 1000.139462] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1000.144997] ? sched_fork+0x473/0xba0 [ 1000.148794] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1000.154318] ? copy_semundo+0xc5/0x350 [ 1000.158212] ? SyS_semop+0x30/0x30 [ 1000.161741] ? __raw_spin_lock_init+0x1c/0x100 [ 1000.166310] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1000.171318] ? __lockdep_init_map+0x105/0x590 [ 1000.175801] ? security_task_alloc+0x88/0xb0 [ 1000.180197] copy_process.part.38+0x1e4a/0x6ee0 [ 1000.184865] ? __lock_acquire+0x7f5/0x5130 [ 1000.189092] ? zap_class+0x720/0x720 [ 1000.192792] ? lock_acquire+0x1dc/0x520 [ 1000.196767] ? alloc_set_pte+0x1077/0x16a0 [ 1000.201001] ? __cleanup_sighand+0x70/0x70 [ 1000.205227] ? alloc_set_pte+0x1077/0x16a0 [ 1000.209457] ? print_usage_bug+0xc0/0xc0 [ 1000.213507] ? lock_downgrade+0x8e0/0x8e0 [ 1000.217648] ? debug_check_no_locks_freed+0x310/0x310 [ 1000.222825] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1000.228005] ? print_usage_bug+0xc0/0xc0 [ 1000.232075] ? debug_check_no_locks_freed+0x310/0x310 [ 1000.237255] ? __lock_acquire+0x7f5/0x5130 [ 1000.241477] ? debug_check_no_locks_freed+0x310/0x310 [ 1000.246654] ? perf_trace_lock+0xd6/0x900 [ 1000.250799] ? print_usage_bug+0xc0/0xc0 [ 1000.254850] ? zap_class+0x720/0x720 [ 1000.258551] ? perf_trace_lock+0xd6/0x900 [ 1000.262683] ? perf_trace_lock+0xd6/0x900 [ 1000.266818] ? graph_lock+0x170/0x170 [ 1000.270613] ? lock_acquire+0x1dc/0x520 [ 1000.274587] ? perf_trace_lock+0xd6/0x900 [ 1000.278727] ? zap_class+0x720/0x720 [ 1000.282428] ? find_held_lock+0x36/0x1c0 [ 1000.286477] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1000.292001] ? _parse_integer+0x13b/0x190 [ 1000.296147] ? graph_lock+0x170/0x170 [ 1000.299937] ? perf_trace_lock+0xd6/0x900 [ 1000.304081] ? _kstrtoull+0x180/0x230 [ 1000.307869] ? _parse_integer+0x190/0x190 [ 1000.312013] ? zap_class+0x720/0x720 [ 1000.315734] ? find_held_lock+0x36/0x1c0 [ 1000.319787] ? graph_lock+0x170/0x170 [ 1000.323584] ? perf_trace_lock+0xd6/0x900 [ 1000.327729] ? find_held_lock+0x36/0x1c0 [ 1000.331783] ? lock_downgrade+0x8e0/0x8e0 [ 1000.335927] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1000.341449] ? proc_fail_nth_write+0x96/0x1f0 [ 1000.345935] ? find_held_lock+0x36/0x1c0 [ 1000.349984] _do_fork+0x291/0x12a0 [ 1000.353516] ? fork_idle+0x1a0/0x1a0 [ 1000.357231] ? __sb_end_write+0xac/0xe0 [ 1000.361202] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1000.366722] ? fput+0x130/0x1a0 [ 1000.369989] ? ksys_write+0x1a6/0x250 [ 1000.373781] ? SyS_read+0x30/0x30 [ 1000.377221] ? mm_fault_error+0x380/0x380 [ 1000.381363] SyS_clone+0x37/0x50 [ 1000.384720] ? sys_vfork+0x30/0x30 [ 1000.388250] do_syscall_64+0x29e/0x9d0 [ 1000.392121] ? vmalloc_sync_all+0x30/0x30 [ 1000.396257] ? _raw_spin_unlock_irq+0x27/0x70 [ 1000.400841] ? finish_task_switch+0x1ca/0x820 [ 1000.405323] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1000.410241] ? syscall_return_slowpath+0x30f/0x5c0 [ 1000.415180] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1000.420546] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1000.425386] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1000.430565] RIP: 0033:0x455259 [ 1000.433740] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1000.441437] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1000.448692] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 2018/04/10 12:55:29 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e8], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:29 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000ff3f000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:29 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, 0x10) shutdown(r0, 0x1) [ 1000.455948] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1000.463213] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1000.470467] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000004 2018/04/10 12:55:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000010000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 1000.569147] binder: 31935 RLIMIT_NICE not set [ 1001.366280] binder: 31935 RLIMIT_NICE not set [ 1001.371682] binder: BINDER_SET_CONTEXT_MGR already set [ 1001.375144] binder: 31933:31935 ioctl c0306201 20004000 returned -14 [ 1001.377075] binder: 31933:31948 ioctl 40046207 0 returned -16 [ 1001.394155] binder_alloc: 31933: binder_alloc_buf, no vma [ 1001.399771] binder: 31933:31948 transaction failed 29189/-3, size 0-0 line 2963 [ 1001.399777] binder_alloc: 31933: binder_alloc_buf, no vma [ 1001.399803] binder: 31933:31949 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:55:30 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000fdfdffff0000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:30 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:30 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:30 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000efffffff08001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:30 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:30 executing program 7 (fault-call:0 fault-nth:5): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:30 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}}, 0x14) [ 1001.529384] binder: undelivered TRANSACTION_ERROR: 29189 [ 1001.534936] binder: undelivered TRANSACTION_ERROR: 29189 [ 1001.550198] FAULT_INJECTION: forcing a failure. [ 1001.550198] name failslab, interval 1, probability 0, space 0, times 0 [ 1001.561543] CPU: 0 PID: 31951 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1001.568477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1001.577839] Call Trace: [ 1001.580445] dump_stack+0x1b9/0x294 [ 1001.583363] binder: BINDER_SET_CONTEXT_MGR already set [ 1001.584084] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1001.584106] ? is_bpf_text_address+0xd7/0x170 [ 1001.599045] ? kernel_text_address+0x79/0xf0 [ 1001.602182] binder: 31959:31960 ioctl 40046207 0 returned -16 [ 1001.603462] ? __unwind_start+0x166/0x330 [ 1001.603486] should_fail.cold.4+0xa/0x1a [ 1001.603502] ? __save_stack_trace+0x7e/0xd0 [ 1001.603521] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1001.627001] ? save_stack+0xa9/0xd0 [ 1001.628930] binder: 31960 RLIMIT_NICE not set [ 1001.630635] ? save_stack+0x43/0xd0 [ 1001.630651] ? kasan_kmalloc+0xc4/0xe0 [ 1001.630664] ? kmem_cache_alloc_trace+0x152/0x780 [ 1001.630681] ? find_held_lock+0x36/0x1c0 [ 1001.630709] ? check_same_owner+0x320/0x320 [ 1001.655876] ? rcu_note_context_switch+0x710/0x710 [ 1001.660831] __should_failslab+0x124/0x180 [ 1001.665082] should_failslab+0x9/0x14 [ 1001.668884] kmem_cache_alloc_node_trace+0x26f/0x770 [ 1001.673988] ? alloc_fdtable+0x89/0x280 [ 1001.677963] __kmalloc_node+0x33/0x70 [ 1001.681761] kvmalloc_node+0x6b/0x100 [ 1001.685550] alloc_fdtable+0xd9/0x280 [ 1001.689343] dup_fd+0xa60/0xf40 [ 1001.692628] ? ksys_dup3+0x670/0x670 [ 1001.696335] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1001.701863] ? sched_fork+0x473/0xba0 [ 1001.705653] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1001.711178] ? copy_semundo+0xc5/0x350 [ 1001.715051] ? SyS_semop+0x30/0x30 [ 1001.718576] ? __raw_spin_lock_init+0x1c/0x100 [ 1001.723148] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1001.728164] ? __lockdep_init_map+0x105/0x590 [ 1001.732644] ? security_task_alloc+0x88/0xb0 [ 1001.737045] copy_process.part.38+0x1e4a/0x6ee0 [ 1001.741707] ? __lock_acquire+0x7f5/0x5130 [ 1001.745934] ? lock_acquire+0x1dc/0x520 [ 1001.749894] ? alloc_set_pte+0x1077/0x16a0 [ 1001.754130] ? __cleanup_sighand+0x70/0x70 [ 1001.758354] ? alloc_set_pte+0x1077/0x16a0 [ 1001.762583] ? print_usage_bug+0xc0/0xc0 [ 1001.766633] ? lock_downgrade+0x8e0/0x8e0 [ 1001.770792] ? debug_check_no_locks_freed+0x310/0x310 [ 1001.775984] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1001.781169] ? print_usage_bug+0xc0/0xc0 [ 1001.785236] ? debug_check_no_locks_freed+0x310/0x310 [ 1001.790419] ? __lock_acquire+0x7f5/0x5130 [ 1001.794657] ? debug_check_no_locks_freed+0x310/0x310 [ 1001.799846] ? print_usage_bug+0xc0/0xc0 [ 1001.803894] ? print_usage_bug+0xc0/0xc0 [ 1001.807945] ? graph_lock+0x170/0x170 [ 1001.811738] ? lock_acquire+0x1dc/0x520 [ 1001.815698] ? __fdget_pos+0x1a9/0x1e0 [ 1001.819582] ? graph_lock+0x170/0x170 [ 1001.823376] ? __lock_acquire+0x7f5/0x5130 [ 1001.827610] ? find_held_lock+0x36/0x1c0 [ 1001.831658] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1001.837184] ? _parse_integer+0x13b/0x190 [ 1001.841322] ? graph_lock+0x170/0x170 [ 1001.845111] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1001.850652] ? _kstrtoull+0x180/0x230 [ 1001.854443] ? _parse_integer+0x190/0x190 [ 1001.858581] ? graph_lock+0x170/0x170 [ 1001.862371] ? lock_release+0xa10/0xa10 [ 1001.866338] ? check_same_owner+0x320/0x320 [ 1001.870648] ? find_held_lock+0x36/0x1c0 [ 1001.874707] ? graph_lock+0x170/0x170 [ 1001.878508] ? lock_downgrade+0x8e0/0x8e0 [ 1001.882649] ? find_held_lock+0x36/0x1c0 [ 1001.886705] ? lock_downgrade+0x8e0/0x8e0 [ 1001.890842] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1001.896367] ? proc_fail_nth_write+0x96/0x1f0 [ 1001.900851] ? proc_cwd_link+0x1d0/0x1d0 [ 1001.904904] ? find_held_lock+0x36/0x1c0 [ 1001.908953] _do_fork+0x291/0x12a0 [ 1001.912485] ? fork_idle+0x1a0/0x1a0 [ 1001.916186] ? __lock_is_held+0xb5/0x140 [ 1001.920251] ? __sb_end_write+0xac/0xe0 [ 1001.924215] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1001.929737] ? fput+0x130/0x1a0 [ 1001.933014] ? ksys_write+0x1a6/0x250 [ 1001.936808] ? SyS_read+0x30/0x30 [ 1001.940251] ? mm_fault_error+0x380/0x380 [ 1001.944390] SyS_clone+0x37/0x50 [ 1001.947742] ? sys_vfork+0x30/0x30 [ 1001.951274] do_syscall_64+0x29e/0x9d0 [ 1001.955155] ? vmalloc_sync_all+0x30/0x30 [ 1001.959292] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 1001.964121] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1001.969044] ? syscall_return_slowpath+0x30f/0x5c0 [ 1001.973969] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1001.979326] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1001.984163] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1001.989340] RIP: 0033:0x455259 [ 1001.992522] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1002.000218] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1002.007565] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1002.014822] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1002.022078] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 2018/04/10 12:55:30 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe1f002000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:30 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e05], 0x1}, 0x5}, 0x1c) [ 1002.029329] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000005 [ 1002.038206] binder: release 31933:31935 transaction 744 out, still active [ 1002.045268] binder: release 31933:31935 transaction 743 in, still active [ 1002.052228] binder: undelivered TRANSACTION_COMPLETE [ 1002.057416] binder: release 31933:31948 transaction 743 out, still active [ 1002.064400] binder: undelivered TRANSACTION_COMPLETE [ 1002.069563] binder: send failed reply for transaction 744, target dead 2018/04/10 12:55:30 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000007fffffff08001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1002.076300] binder: send failed reply for transaction 743, target dead 2018/04/10 12:55:30 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:30 executing program 7 (fault-call:0 fault-nth:6): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:30 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 1002.175654] FAULT_INJECTION: forcing a failure. [ 1002.175654] name failslab, interval 1, probability 0, space 0, times 0 [ 1002.187051] CPU: 0 PID: 31982 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1002.193985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1002.203344] Call Trace: [ 1002.205950] dump_stack+0x1b9/0x294 [ 1002.209592] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1002.214793] ? is_bpf_text_address+0xd7/0x170 [ 1002.219307] should_fail.cold.4+0xa/0x1a [ 1002.223380] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1002.228578] ? save_stack+0xa9/0xd0 [ 1002.232208] ? find_held_lock+0x36/0x1c0 [ 1002.236278] ? check_same_owner+0x320/0x320 [ 1002.240595] ? rcu_note_context_switch+0x710/0x710 [ 1002.245519] __should_failslab+0x124/0x180 [ 1002.249749] should_failslab+0x9/0x14 [ 1002.253541] kmem_cache_alloc_node_trace+0x26f/0x770 [ 1002.258634] ? kasan_unpoison_shadow+0x35/0x50 [ 1002.263212] __kmalloc_node+0x33/0x70 [ 1002.267005] kvmalloc_node+0x6b/0x100 [ 1002.270804] alloc_fdtable+0x145/0x280 [ 1002.274685] dup_fd+0xa60/0xf40 [ 1002.277962] ? ksys_dup3+0x670/0x670 [ 1002.281672] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1002.287210] ? sched_fork+0x473/0xba0 [ 1002.291005] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1002.296542] ? copy_semundo+0xc5/0x350 [ 1002.300420] ? SyS_semop+0x30/0x30 [ 1002.303949] ? __raw_spin_lock_init+0x1c/0x100 [ 1002.308517] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1002.313523] ? __lockdep_init_map+0x105/0x590 [ 1002.318034] ? security_task_alloc+0x88/0xb0 [ 1002.322447] copy_process.part.38+0x1e4a/0x6ee0 [ 1002.327115] ? __lock_acquire+0x7f5/0x5130 [ 1002.331343] ? lock_acquire+0x1dc/0x520 [ 1002.335309] ? alloc_set_pte+0x1077/0x16a0 [ 1002.339545] ? __cleanup_sighand+0x70/0x70 [ 1002.343766] ? alloc_set_pte+0x1077/0x16a0 [ 1002.347993] ? print_usage_bug+0xc0/0xc0 [ 1002.352048] ? lock_downgrade+0x8e0/0x8e0 [ 1002.356195] ? debug_check_no_locks_freed+0x310/0x310 [ 1002.361379] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1002.366571] ? print_usage_bug+0xc0/0xc0 [ 1002.370631] ? debug_check_no_locks_freed+0x310/0x310 [ 1002.375809] ? __lock_acquire+0x7f5/0x5130 [ 1002.380037] ? debug_check_no_locks_freed+0x310/0x310 [ 1002.385226] ? print_usage_bug+0xc0/0xc0 [ 1002.389277] ? print_usage_bug+0xc0/0xc0 [ 1002.393331] ? graph_lock+0x170/0x170 [ 1002.397122] ? lock_acquire+0x1dc/0x520 [ 1002.401781] ? __fdget_pos+0x1a9/0x1e0 [ 1002.405657] ? graph_lock+0x170/0x170 [ 1002.409448] ? __lock_acquire+0x7f5/0x5130 [ 1002.413670] ? find_held_lock+0x36/0x1c0 [ 1002.417723] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1002.423248] ? _parse_integer+0x13b/0x190 [ 1002.427386] ? graph_lock+0x170/0x170 [ 1002.431191] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1002.436716] ? _kstrtoull+0x180/0x230 [ 1002.440509] ? _parse_integer+0x190/0x190 [ 1002.444643] ? graph_lock+0x170/0x170 [ 1002.448433] ? lock_release+0xa10/0xa10 [ 1002.452395] ? check_same_owner+0x320/0x320 [ 1002.456702] ? find_held_lock+0x36/0x1c0 [ 1002.460769] ? graph_lock+0x170/0x170 [ 1002.464572] ? lock_downgrade+0x8e0/0x8e0 [ 1002.468713] ? find_held_lock+0x36/0x1c0 [ 1002.472770] ? lock_downgrade+0x8e0/0x8e0 [ 1002.476907] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1002.483043] ? proc_fail_nth_write+0x96/0x1f0 [ 1002.487537] ? proc_cwd_link+0x1d0/0x1d0 [ 1002.491596] ? find_held_lock+0x36/0x1c0 [ 1002.495647] _do_fork+0x291/0x12a0 [ 1002.499184] ? fork_idle+0x1a0/0x1a0 [ 1002.502885] ? __lock_is_held+0xb5/0x140 [ 1002.506943] ? __sb_end_write+0xac/0xe0 [ 1002.510909] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1002.516431] ? fput+0x130/0x1a0 [ 1002.519711] ? ksys_write+0x1a6/0x250 [ 1002.523503] ? SyS_read+0x30/0x30 [ 1002.526951] ? mm_fault_error+0x380/0x380 [ 1002.531090] SyS_clone+0x37/0x50 [ 1002.534442] ? sys_vfork+0x30/0x30 [ 1002.537979] do_syscall_64+0x29e/0x9d0 [ 1002.541850] ? vmalloc_sync_all+0x30/0x30 [ 1002.545988] ? _raw_spin_unlock_irq+0x27/0x70 [ 1002.550473] ? finish_task_switch+0x1ca/0x820 [ 1002.554955] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1002.559870] ? syscall_return_slowpath+0x30f/0x5c0 [ 1002.564795] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1002.570162] ? trace_hardirqs_off_thunk+0x1a/0x1c 2018/04/10 12:55:31 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:31 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000108001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1002.575017] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1002.580207] RIP: 0033:0x455259 [ 1002.583383] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1002.591083] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1002.598336] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1002.605595] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1002.612855] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1002.620119] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000006 2018/04/10 12:55:31 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000000000f0ffffff7f", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:31 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd4]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:31 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000002008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:31 executing program 7 (fault-call:0 fault-nth:7): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:31 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}}, 0x14) 2018/04/10 12:55:31 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:31 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000], 0x1}, 0x5}, 0x1c) [ 1002.817947] binder: 32014 RLIMIT_NICE not set [ 1002.819162] FAULT_INJECTION: forcing a failure. [ 1002.819162] name failslab, interval 1, probability 0, space 0, times 0 [ 1002.833815] CPU: 0 PID: 32011 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1002.840760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1002.850126] Call Trace: [ 1002.852734] dump_stack+0x1b9/0x294 [ 1002.856383] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1002.861600] should_fail.cold.4+0xa/0x1a 2018/04/10 12:55:31 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}}, 0x14) 2018/04/10 12:55:31 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffa4]}}, 0x14) [ 1002.865678] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1002.870795] ? lock_downgrade+0x8e0/0x8e0 [ 1002.874963] ? kasan_check_read+0x11/0x20 [ 1002.879123] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1002.883550] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1002.888153] ? find_held_lock+0x36/0x1c0 [ 1002.892252] ? check_same_owner+0x320/0x320 [ 1002.896595] ? rcu_note_context_switch+0x710/0x710 [ 1002.901546] __should_failslab+0x124/0x180 [ 1002.905792] should_failslab+0x9/0x14 [ 1002.909608] kmem_cache_alloc+0x2af/0x760 2018/04/10 12:55:31 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000]}}, 0x14) [ 1002.913772] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1002.918807] copy_fs_struct+0x46/0x2d0 [ 1002.922710] copy_process.part.38+0x3063/0x6ee0 [ 1002.927395] ? __lock_acquire+0x7f5/0x5130 [ 1002.931646] ? lock_acquire+0x1dc/0x520 [ 1002.935629] ? alloc_set_pte+0x1077/0x16a0 [ 1002.939899] ? __cleanup_sighand+0x70/0x70 [ 1002.944150] ? alloc_set_pte+0x1077/0x16a0 [ 1002.948399] ? print_usage_bug+0xc0/0xc0 [ 1002.952478] ? lock_downgrade+0x8e0/0x8e0 [ 1002.956647] ? debug_check_no_locks_freed+0x310/0x310 [ 1002.961858] ? rcu_bh_force_quiescent_state+0x20/0x20 2018/04/10 12:55:31 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff00000000]}}, 0x14) [ 1002.967063] ? print_usage_bug+0xc0/0xc0 [ 1002.971165] ? debug_check_no_locks_freed+0x310/0x310 [ 1002.976380] ? __lock_acquire+0x7f5/0x5130 [ 1002.980633] ? debug_check_no_locks_freed+0x310/0x310 [ 1002.985840] ? print_usage_bug+0xc0/0xc0 [ 1002.989908] ? print_usage_bug+0xc0/0xc0 [ 1002.993985] ? graph_lock+0x170/0x170 [ 1002.997801] ? lock_acquire+0x1dc/0x520 [ 1003.001791] ? __fdget_pos+0x1a9/0x1e0 [ 1003.005691] ? graph_lock+0x170/0x170 [ 1003.009503] ? __lock_acquire+0x7f5/0x5130 [ 1003.013747] ? find_held_lock+0x36/0x1c0 2018/04/10 12:55:31 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}}, 0x14) [ 1003.017819] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1003.023367] ? _parse_integer+0x13b/0x190 [ 1003.027526] ? graph_lock+0x170/0x170 [ 1003.031336] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1003.036885] ? _kstrtoull+0x180/0x230 [ 1003.040698] ? _parse_integer+0x190/0x190 [ 1003.044859] ? graph_lock+0x170/0x170 [ 1003.048672] ? lock_release+0xa10/0xa10 [ 1003.052672] ? check_same_owner+0x320/0x320 [ 1003.057004] ? find_held_lock+0x36/0x1c0 [ 1003.061082] ? graph_lock+0x170/0x170 [ 1003.064904] ? lock_downgrade+0x8e0/0x8e0 2018/04/10 12:55:31 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff]}}, 0x14) 2018/04/10 12:55:31 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5]}}, 0x14) [ 1003.069067] ? find_held_lock+0x36/0x1c0 [ 1003.073151] ? lock_downgrade+0x8e0/0x8e0 [ 1003.077313] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1003.082861] ? proc_fail_nth_write+0x96/0x1f0 [ 1003.087368] ? proc_cwd_link+0x1d0/0x1d0 [ 1003.091443] ? find_held_lock+0x36/0x1c0 [ 1003.095515] _do_fork+0x291/0x12a0 [ 1003.099071] ? fork_idle+0x1a0/0x1a0 [ 1003.102793] ? __lock_is_held+0xb5/0x140 [ 1003.106869] ? __sb_end_write+0xac/0xe0 [ 1003.110853] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 2018/04/10 12:55:31 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}}, 0x14) [ 1003.116395] ? fput+0x130/0x1a0 [ 1003.119684] ? ksys_write+0x1a6/0x250 [ 1003.123497] ? SyS_read+0x30/0x30 [ 1003.126958] ? mm_fault_error+0x380/0x380 [ 1003.131119] SyS_clone+0x37/0x50 [ 1003.134497] ? sys_vfork+0x30/0x30 [ 1003.138048] do_syscall_64+0x29e/0x9d0 [ 1003.141940] ? vmalloc_sync_all+0x30/0x30 [ 1003.146092] ? _raw_spin_unlock_irq+0x27/0x70 [ 1003.150604] ? finish_task_switch+0x1ca/0x820 [ 1003.155106] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1003.160057] ? syscall_return_slowpath+0x30f/0x5c0 [ 1003.165002] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1003.170388] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1003.175254] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1003.180459] RIP: 0033:0x455259 [ 1003.183647] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1003.191362] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1003.198639] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1003.205915] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1003.213189] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1003.220457] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000007 [ 1003.613246] binder: 32014 RLIMIT_NICE not set [ 1003.619615] binder: BINDER_SET_CONTEXT_MGR already set [ 1003.620125] binder: 32004:32014 ioctl c0306201 20004000 returned -14 [ 1003.624974] binder: 32004:32050 ioctl 40046207 0 returned -16 [ 1003.635408] binder_alloc: 32004: binder_alloc_buf, no vma [ 1003.643129] binder_alloc: 32004: binder_alloc_buf, no vma [ 1003.643150] binder: 32004:32053 transaction failed 29189/-3, size 0-0 line 2963 [ 1003.648735] binder: 32004:32054 transaction failed 29189/-3, size 0-0 line 2963 [ 1003.772513] binder: undelivered TRANSACTION_ERROR: 29189 [ 1003.778087] binder: undelivered TRANSACTION_ERROR: 29189 [ 1003.784467] binder: release 32004:32014 transaction 749 out, still active [ 1003.791481] binder: release 32004:32014 transaction 748 in, still active [ 1003.798379] binder: undelivered TRANSACTION_COMPLETE [ 1003.803523] binder: release 32004:32050 transaction 748 out, still active [ 1003.810509] binder: undelivered TRANSACTION_COMPLETE [ 1003.815655] binder: send failed reply for transaction 749, target dead 2018/04/10 12:55:32 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:32 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}}, 0x14) 2018/04/10 12:55:32 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000208001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:32 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:32 executing program 7 (fault-call:0 fault-nth:8): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:32 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000000000007fffffff", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 1003.822362] binder: send failed reply for transaction 748, target dead 2018/04/10 12:55:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff02], 0x1}, 0x5}, 0x1c) [ 1003.877561] FAULT_INJECTION: forcing a failure. [ 1003.877561] name failslab, interval 1, probability 0, space 0, times 0 [ 1003.888923] CPU: 0 PID: 32069 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1003.895858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1003.905223] Call Trace: [ 1003.907916] dump_stack+0x1b9/0x294 [ 1003.911565] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1003.916776] ? perf_trace_lock+0xd6/0x900 [ 1003.920950] should_fail.cold.4+0xa/0x1a 2018/04/10 12:55:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28], 0x1}, 0x5}, 0x1c) [ 1003.925036] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1003.930165] ? SyS_clone+0x37/0x50 [ 1003.933722] ? do_syscall_64+0x29e/0x9d0 [ 1003.937801] ? graph_lock+0x170/0x170 [ 1003.941627] ? find_held_lock+0x36/0x1c0 [ 1003.945723] ? check_same_owner+0x320/0x320 [ 1003.950067] ? kasan_check_read+0x11/0x20 [ 1003.954231] ? rcu_note_context_switch+0x710/0x710 [ 1003.959171] ? kasan_check_read+0x11/0x20 [ 1003.963332] __should_failslab+0x124/0x180 [ 1003.967583] should_failslab+0x9/0x14 [ 1003.971398] kmem_cache_alloc+0x2af/0x760 [ 1003.975565] ? _raw_spin_unlock+0x22/0x30 [ 1003.979737] copy_process.part.38+0x202a/0x6ee0 [ 1003.984426] ? __lock_acquire+0x7f5/0x5130 [ 1003.988684] ? lock_acquire+0x1dc/0x520 [ 1003.992671] ? alloc_set_pte+0x1077/0x16a0 [ 1003.996944] ? __cleanup_sighand+0x70/0x70 [ 1004.001195] ? alloc_set_pte+0x1077/0x16a0 [ 1004.005455] ? print_usage_bug+0xc0/0xc0 [ 1004.009532] ? lock_downgrade+0x8e0/0x8e0 [ 1004.013704] ? debug_check_no_locks_freed+0x310/0x310 [ 1004.018913] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1004.024295] ? print_usage_bug+0xc0/0xc0 2018/04/10 12:55:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x1}, 0x5}, 0x1c) [ 1004.028386] ? debug_check_no_locks_freed+0x310/0x310 [ 1004.033601] ? __lock_acquire+0x7f5/0x5130 [ 1004.037852] ? debug_check_no_locks_freed+0x310/0x310 [ 1004.043075] ? print_usage_bug+0xc0/0xc0 [ 1004.044494] binder: 32065 RLIMIT_NICE not set [ 1004.047147] ? print_usage_bug+0xc0/0xc0 [ 1004.047168] ? graph_lock+0x170/0x170 [ 1004.047191] ? lock_acquire+0x1dc/0x520 [ 1004.047206] ? __fdget_pos+0x1a9/0x1e0 [ 1004.047223] ? graph_lock+0x170/0x170 [ 1004.071178] ? __lock_acquire+0x7f5/0x5130 2018/04/10 12:55:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000], 0x1}, 0x5}, 0x1c) [ 1004.075421] ? find_held_lock+0x36/0x1c0 [ 1004.079495] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1004.085051] ? _parse_integer+0x13b/0x190 [ 1004.089218] ? graph_lock+0x170/0x170 [ 1004.093042] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1004.098598] ? _kstrtoull+0x180/0x230 [ 1004.102412] ? _parse_integer+0x190/0x190 [ 1004.106571] ? graph_lock+0x170/0x170 [ 1004.110380] ? lock_release+0xa10/0xa10 [ 1004.114371] ? check_same_owner+0x320/0x320 [ 1004.118708] ? find_held_lock+0x36/0x1c0 [ 1004.122787] ? graph_lock+0x170/0x170 2018/04/10 12:55:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], 0x1}, 0x5}, 0x1c) [ 1004.126607] ? lock_downgrade+0x8e0/0x8e0 [ 1004.130779] ? find_held_lock+0x36/0x1c0 [ 1004.134866] ? lock_downgrade+0x8e0/0x8e0 [ 1004.139035] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1004.144599] ? proc_fail_nth_write+0x96/0x1f0 [ 1004.149114] ? proc_cwd_link+0x1d0/0x1d0 [ 1004.153197] ? find_held_lock+0x36/0x1c0 [ 1004.157285] _do_fork+0x291/0x12a0 [ 1004.160849] ? fork_idle+0x1a0/0x1a0 [ 1004.164576] ? __lock_is_held+0xb5/0x140 [ 1004.168668] ? __sb_end_write+0xac/0xe0 [ 1004.172669] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 2018/04/10 12:55:32 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e050000], 0x1}, 0x5}, 0x1c) [ 1004.178213] ? fput+0x130/0x1a0 [ 1004.181509] ? ksys_write+0x1a6/0x250 [ 1004.185321] ? SyS_read+0x30/0x30 [ 1004.188778] ? mm_fault_error+0x380/0x380 [ 1004.192939] SyS_clone+0x37/0x50 [ 1004.196316] ? sys_vfork+0x30/0x30 [ 1004.199861] do_syscall_64+0x29e/0x9d0 [ 1004.203736] ? vmalloc_sync_all+0x30/0x30 [ 1004.207871] ? _raw_spin_unlock_irq+0x27/0x70 [ 1004.212356] ? finish_task_switch+0x1ca/0x820 [ 1004.216840] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1004.221757] ? syscall_return_slowpath+0x30f/0x5c0 [ 1004.226677] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1004.232042] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1004.236878] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1004.242053] RIP: 0033:0x455259 [ 1004.245226] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1004.252920] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1004.260269] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1004.267523] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 2018/04/10 12:55:33 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000308001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1004.274776] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1004.282036] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000008 [ 1004.669247] binder: 32065 RLIMIT_NICE not set [ 1004.677310] binder: BINDER_SET_CONTEXT_MGR already set [ 1004.678104] binder: 32060:32065 ioctl c0306201 20004000 returned -14 [ 1004.683368] binder: 32060:32102 ioctl 40046207 0 returned -16 [ 1004.702646] binder_alloc: 32060: binder_alloc_buf, no vma [ 1004.708604] binder: 32060:32105 transaction failed 29189/-3, size 0-0 line 2963 [ 1004.708609] binder_alloc: 32060: binder_alloc_buf, no vma [ 1004.708637] binder: 32060:32102 transaction failed 29189/-3, size 0-0 line 2963 [ 1004.831431] binder: undelivered TRANSACTION_ERROR: 29189 [ 1004.836980] binder: undelivered TRANSACTION_ERROR: 29189 [ 1004.842657] binder: release 32060:32065 transaction 754 out, still active [ 1004.849679] binder: release 32060:32065 transaction 753 in, still active [ 1004.856607] binder: undelivered TRANSACTION_COMPLETE [ 1004.861768] binder: release 32060:32102 transaction 753 out, still active [ 1004.868747] binder: undelivered TRANSACTION_COMPLETE [ 1004.873896] binder: send failed reply for transaction 754, target dead [ 1004.880624] binder: send failed reply for transaction 753, target dead 2018/04/10 12:55:33 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:33 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:33 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:33 executing program 7 (fault-call:0 fault-nth:9): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:33 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000003fff000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:33 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000]}}, 0x14) 2018/04/10 12:55:33 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 1004.963698] FAULT_INJECTION: forcing a failure. [ 1004.963698] name failslab, interval 1, probability 0, space 0, times 0 [ 1004.975129] CPU: 0 PID: 32112 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1004.982061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1004.991411] Call Trace: [ 1004.994014] dump_stack+0x1b9/0x294 [ 1004.997645] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1005.002827] ? __lock_acquire+0x7f5/0x5130 [ 1005.007066] should_fail.cold.4+0xa/0x1a [ 1005.011119] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1005.016215] ? lock_downgrade+0x8e0/0x8e0 [ 1005.020359] ? kasan_check_read+0x11/0x20 [ 1005.024498] ? find_held_lock+0x36/0x1c0 [ 1005.028569] ? check_same_owner+0x320/0x320 [ 1005.032881] ? rcu_note_context_switch+0x710/0x710 [ 1005.037803] __should_failslab+0x124/0x180 [ 1005.042033] should_failslab+0x9/0x14 [ 1005.045821] kmem_cache_alloc+0x2af/0x760 [ 1005.049980] ? kasan_slab_alloc+0x12/0x20 [ 1005.054133] ? kmem_cache_alloc+0x12e/0x760 [ 1005.058444] ? copy_process.part.38+0x202a/0x6ee0 [ 1005.063272] ? _do_fork+0x291/0x12a0 [ 1005.066972] ? SyS_clone+0x37/0x50 [ 1005.070499] ? do_syscall_64+0x29e/0x9d0 [ 1005.074549] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1005.079904] copy_signal+0x15c/0xc00 [ 1005.083610] ? sighand_ctor+0x50/0x50 [ 1005.087397] ? lock_downgrade+0x8e0/0x8e0 [ 1005.091537] ? kasan_check_read+0x11/0x20 [ 1005.095670] ? rcu_is_watching+0x85/0x140 [ 1005.099810] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1005.105262] ? kasan_check_read+0x11/0x20 [ 1005.109411] ? rcu_is_watching+0x85/0x140 [ 1005.113553] ? rcu_pm_notify+0xc0/0xc0 [ 1005.117443] ? rcu_read_lock_sched_held+0x108/0x120 [ 1005.122447] ? kmem_cache_alloc+0x5fa/0x760 [ 1005.126777] copy_process.part.38+0x2141/0x6ee0 [ 1005.131441] ? __lock_acquire+0x7f5/0x5130 [ 1005.135677] ? lock_acquire+0x1dc/0x520 [ 1005.139642] ? alloc_set_pte+0x1077/0x16a0 [ 1005.143876] ? __cleanup_sighand+0x70/0x70 [ 1005.148185] ? alloc_set_pte+0x1077/0x16a0 [ 1005.152413] ? print_usage_bug+0xc0/0xc0 [ 1005.156464] ? lock_downgrade+0x8e0/0x8e0 [ 1005.160607] ? debug_check_no_locks_freed+0x310/0x310 [ 1005.165807] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1005.171005] ? print_usage_bug+0xc0/0xc0 [ 1005.175160] ? debug_check_no_locks_freed+0x310/0x310 [ 1005.180340] ? __lock_acquire+0x7f5/0x5130 [ 1005.184563] ? debug_check_no_locks_freed+0x310/0x310 [ 1005.189751] ? print_usage_bug+0xc0/0xc0 [ 1005.193803] ? print_usage_bug+0xc0/0xc0 [ 1005.197863] ? graph_lock+0x170/0x170 [ 1005.201657] ? lock_acquire+0x1dc/0x520 [ 1005.205626] ? __fdget_pos+0x1a9/0x1e0 [ 1005.209502] ? graph_lock+0x170/0x170 [ 1005.213297] ? __lock_acquire+0x7f5/0x5130 [ 1005.217526] ? find_held_lock+0x36/0x1c0 [ 1005.221575] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1005.227106] ? _parse_integer+0x13b/0x190 [ 1005.231256] ? graph_lock+0x170/0x170 [ 1005.235056] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1005.240579] ? _kstrtoull+0x180/0x230 [ 1005.244368] ? _parse_integer+0x190/0x190 [ 1005.248509] ? graph_lock+0x170/0x170 [ 1005.252299] ? lock_release+0xa10/0xa10 [ 1005.256262] ? check_same_owner+0x320/0x320 [ 1005.260573] ? find_held_lock+0x36/0x1c0 [ 1005.264627] ? graph_lock+0x170/0x170 [ 1005.268419] ? lock_downgrade+0x8e0/0x8e0 [ 1005.272561] ? find_held_lock+0x36/0x1c0 [ 1005.276619] ? lock_downgrade+0x8e0/0x8e0 [ 1005.280758] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1005.286286] ? proc_fail_nth_write+0x96/0x1f0 [ 1005.290768] ? proc_cwd_link+0x1d0/0x1d0 [ 1005.294819] ? find_held_lock+0x36/0x1c0 [ 1005.298868] _do_fork+0x291/0x12a0 [ 1005.302409] ? fork_idle+0x1a0/0x1a0 [ 1005.306116] ? __lock_is_held+0xb5/0x140 [ 1005.310174] ? __sb_end_write+0xac/0xe0 [ 1005.314140] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1005.319659] ? fput+0x130/0x1a0 [ 1005.322930] ? ksys_write+0x1a6/0x250 [ 1005.326724] ? SyS_read+0x30/0x30 [ 1005.330173] ? mm_fault_error+0x380/0x380 [ 1005.334320] SyS_clone+0x37/0x50 [ 1005.337675] ? sys_vfork+0x30/0x30 [ 1005.341204] do_syscall_64+0x29e/0x9d0 [ 1005.345077] ? vmalloc_sync_all+0x30/0x30 [ 1005.349215] ? _raw_spin_unlock_irq+0x27/0x70 [ 1005.353696] ? finish_task_switch+0x1ca/0x820 [ 1005.358183] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1005.363103] ? syscall_return_slowpath+0x30f/0x5c0 [ 1005.368033] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1005.373390] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1005.378223] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1005.383398] RIP: 0033:0x455259 [ 1005.386576] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1005.394274] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1005.401527] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 2018/04/10 12:55:34 executing program 7 (fault-call:0 fault-nth:10): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:34 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x1}, 0x5}, 0x1c) [ 1005.408780] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1005.416039] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1005.423294] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000009 [ 1005.449286] binder: 32118 RLIMIT_NICE not set [ 1005.503213] FAULT_INJECTION: forcing a failure. [ 1005.503213] name failslab, interval 1, probability 0, space 0, times 0 [ 1005.514571] CPU: 0 PID: 32129 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1005.521521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1005.530883] Call Trace: [ 1005.533499] dump_stack+0x1b9/0x294 [ 1005.537147] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1005.542351] ? finish_task_switch+0x1ca/0x820 [ 1005.546847] ? finish_task_switch+0x182/0x820 [ 1005.551342] should_fail.cold.4+0xa/0x1a [ 1005.555400] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1005.560499] ? __schedule+0x80f/0x1e40 [ 1005.564376] ? __lockdep_init_map+0x105/0x590 [ 1005.568863] ? __sched_text_start+0x8/0x8 [ 1005.572994] ? find_held_lock+0x36/0x1c0 [ 1005.577064] ? check_same_owner+0x320/0x320 [ 1005.581384] __should_failslab+0x124/0x180 [ 1005.585613] should_failslab+0x9/0x14 [ 1005.589404] kmem_cache_alloc+0x2af/0x760 [ 1005.593549] create_new_namespaces+0x91/0x8f0 [ 1005.598042] ? sys_ni_syscall+0x20/0x20 [ 1005.602011] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1005.607540] ? ns_capable_common+0x13f/0x170 [ 1005.611940] copy_namespaces+0x3f7/0x4c0 [ 1005.615999] ? create_new_namespaces+0x8f0/0x8f0 [ 1005.620759] copy_process.part.38+0x353a/0x6ee0 [ 1005.625423] ? attach_entity_load_avg+0x830/0x830 [ 1005.630276] ? perf_trace_lock+0xd6/0x900 [ 1005.634414] ? graph_lock+0x170/0x170 [ 1005.638215] ? __cleanup_sighand+0x70/0x70 [ 1005.642443] ? find_held_lock+0x36/0x1c0 [ 1005.646499] ? print_usage_bug+0xc0/0xc0 [ 1005.650551] ? find_held_lock+0x36/0x1c0 [ 1005.654605] ? graph_lock+0x170/0x170 [ 1005.658399] ? __lock_acquire+0x7f5/0x5130 [ 1005.662627] ? graph_lock+0x170/0x170 [ 1005.666413] ? __lock_is_held+0xb5/0x140 [ 1005.670466] ? debug_check_no_locks_freed+0x310/0x310 [ 1005.675646] ? __lock_is_held+0xb5/0x140 [ 1005.679698] ? __account_cfs_rq_runtime+0x600/0x600 [ 1005.684712] ? perf_trace_lock+0xd6/0x900 [ 1005.688849] ? set_next_entity+0x2ae/0xaf0 [ 1005.693066] ? debug_check_no_locks_freed+0x310/0x310 [ 1005.698247] ? zap_class+0x720/0x720 [ 1005.701958] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1005.707492] ? graph_lock+0x170/0x170 [ 1005.711373] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1005.716903] ? __perf_event_task_sched_in+0x247/0xb80 [ 1005.722079] ? perf_trace_lock+0xd6/0x900 [ 1005.726214] ? perf_event_sync_stat+0x5f0/0x5f0 [ 1005.730873] ? find_held_lock+0x36/0x1c0 [ 1005.734934] ? lock_downgrade+0x8e0/0x8e0 [ 1005.739068] ? finish_task_switch+0x182/0x820 [ 1005.743556] ? kasan_check_read+0x11/0x20 [ 1005.747690] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1005.752084] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1005.756742] ? compat_start_thread+0x80/0x80 [ 1005.761139] ? _raw_spin_unlock_irq+0x27/0x70 [ 1005.765621] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1005.770627] ? trace_hardirqs_on+0xd/0x10 [ 1005.774764] ? _raw_spin_unlock_irq+0x27/0x70 [ 1005.779245] ? finish_task_switch+0x1ca/0x820 [ 1005.783723] ? finish_task_switch+0x182/0x820 [ 1005.788206] ? copy_overflow+0x20/0x20 [ 1005.792082] ? lock_repin_lock+0x410/0x410 [ 1005.796310] ? __schedule+0x80f/0x1e40 [ 1005.800190] ? __sched_text_start+0x8/0x8 [ 1005.804324] ? proc_fail_nth_write+0x96/0x1f0 [ 1005.808812] ? find_held_lock+0x36/0x1c0 [ 1005.812862] _do_fork+0x291/0x12a0 [ 1005.816402] ? fork_idle+0x1a0/0x1a0 [ 1005.820109] ? schedule+0xef/0x430 [ 1005.823639] ? __schedule+0x1e40/0x1e40 [ 1005.827609] ? __sb_end_write+0xac/0xe0 [ 1005.831572] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1005.837102] ? exit_to_usermode_loop+0x87/0x310 [ 1005.841766] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1005.847302] ? exit_to_usermode_loop+0x1ef/0x310 [ 1005.852046] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 1005.856887] SyS_clone+0x37/0x50 [ 1005.860241] ? sys_vfork+0x30/0x30 [ 1005.863772] do_syscall_64+0x29e/0x9d0 [ 1005.867648] ? vmalloc_sync_all+0x30/0x30 [ 1005.871788] ? _raw_spin_unlock_irq+0x27/0x70 [ 1005.876274] ? finish_task_switch+0x1ca/0x820 [ 1005.880758] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1005.885677] ? syscall_return_slowpath+0x30f/0x5c0 [ 1005.890600] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1005.895958] ? trace_hardirqs_off_thunk+0x1a/0x1c 2018/04/10 12:55:34 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000000000003fff08001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1005.900796] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1005.905973] RIP: 0033:0x455259 [ 1005.909150] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1005.916845] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1005.924105] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1005.931362] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1005.938620] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1005.945893] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000000a 2018/04/10 12:55:34 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 1005.962639] binder: 32118 RLIMIT_NICE not set 2018/04/10 12:55:34 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000], 0x1}, 0x5}, 0x1c) [ 1005.988641] binder: BINDER_SET_CONTEXT_MGR already set 2018/04/10 12:55:34 executing program 7 (fault-call:0 fault-nth:11): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:34 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:34 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000004018000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1006.010175] binder: 32117:32118 ioctl c0306201 20004000 returned -14 [ 1006.020378] binder: 32117:32131 ioctl 40046207 0 returned -16 [ 1006.058119] FAULT_INJECTION: forcing a failure. [ 1006.058119] name failslab, interval 1, probability 0, space 0, times 0 [ 1006.069475] CPU: 0 PID: 32144 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1006.076413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1006.082751] binder_alloc: 32117: binder_alloc_buf, no vma [ 1006.085786] Call Trace: [ 1006.085814] dump_stack+0x1b9/0x294 [ 1006.085833] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1006.085858] ? find_held_lock+0x36/0x1c0 [ 1006.085882] should_fail.cold.4+0xa/0x1a [ 1006.085900] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1006.085918] ? lock_downgrade+0x8e0/0x8e0 [ 1006.091545] binder: 32117:32131 transaction failed 29189/-3, size 0-0 line 2963 [ 1006.094042] ? kasan_check_read+0x11/0x20 [ 1006.094061] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1006.094081] ? find_held_lock+0x36/0x1c0 [ 1006.124603] binder_alloc: 32117: binder_alloc_buf, no vma [ 1006.127652] ? check_same_owner+0x320/0x320 [ 1006.127673] ? rcu_note_context_switch+0x710/0x710 [ 1006.127689] ? save_stack+0xa9/0xd0 [ 1006.127707] __should_failslab+0x124/0x180 [ 1006.131912] binder: 32117:32150 transaction failed 29189/-3, size 0-0 line 2963 [ 1006.136243] should_failslab+0x9/0x14 [ 1006.136257] kmem_cache_alloc+0x2af/0x760 [ 1006.136270] ? __lockdep_init_map+0x105/0x590 [ 1006.136284] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1006.136302] ? in_userns+0xe8/0x120 [ 1006.191294] copy_pid_ns+0x2c3/0xb40 [ 1006.195000] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1006.200531] ? refcount_inc_not_zero+0x1dd/0x2d0 [ 1006.205275] ? pidns_get+0x1c0/0x1c0 [ 1006.208984] ? kasan_check_read+0x11/0x20 [ 1006.213123] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1006.218732] ? refcount_inc+0x29/0x70 [ 1006.222540] ? copy_ipcs+0xb6/0x5b0 [ 1006.226157] ? ipcns_get+0xe0/0xe0 [ 1006.229686] ? do_mount+0x3070/0x3070 [ 1006.233484] create_new_namespaces+0x48a/0x8f0 [ 1006.238060] ? sys_ni_syscall+0x20/0x20 [ 1006.242030] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1006.247555] ? ns_capable_common+0x13f/0x170 [ 1006.251954] copy_namespaces+0x3f7/0x4c0 [ 1006.256002] ? create_new_namespaces+0x8f0/0x8f0 [ 1006.260760] copy_process.part.38+0x353a/0x6ee0 [ 1006.265415] ? __lock_acquire+0x7f5/0x5130 [ 1006.269639] ? lock_acquire+0x1dc/0x520 [ 1006.273597] ? alloc_set_pte+0x1077/0x16a0 [ 1006.277833] ? __cleanup_sighand+0x70/0x70 [ 1006.282054] ? alloc_set_pte+0x1077/0x16a0 [ 1006.286282] ? print_usage_bug+0xc0/0xc0 [ 1006.290333] ? lock_downgrade+0x8e0/0x8e0 [ 1006.294560] ? debug_check_no_locks_freed+0x310/0x310 [ 1006.299736] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1006.304918] ? print_usage_bug+0xc0/0xc0 [ 1006.308982] ? debug_check_no_locks_freed+0x310/0x310 [ 1006.314161] ? __lock_acquire+0x7f5/0x5130 [ 1006.318397] ? debug_check_no_locks_freed+0x310/0x310 [ 1006.323587] ? print_usage_bug+0xc0/0xc0 [ 1006.327636] ? print_usage_bug+0xc0/0xc0 [ 1006.331687] ? graph_lock+0x170/0x170 [ 1006.335478] ? lock_acquire+0x1dc/0x520 [ 1006.339441] ? __fdget_pos+0x1a9/0x1e0 [ 1006.343314] ? graph_lock+0x170/0x170 [ 1006.347106] ? __lock_acquire+0x7f5/0x5130 [ 1006.351330] ? find_held_lock+0x36/0x1c0 [ 1006.355380] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1006.360902] ? _parse_integer+0x13b/0x190 [ 1006.365043] ? graph_lock+0x170/0x170 [ 1006.368835] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1006.374357] ? _kstrtoull+0x180/0x230 [ 1006.378145] ? _parse_integer+0x190/0x190 [ 1006.382280] ? graph_lock+0x170/0x170 [ 1006.386064] ? lock_release+0xa10/0xa10 [ 1006.390031] ? check_same_owner+0x320/0x320 [ 1006.394341] ? find_held_lock+0x36/0x1c0 [ 1006.398389] ? graph_lock+0x170/0x170 [ 1006.402180] ? lock_downgrade+0x8e0/0x8e0 [ 1006.406318] ? find_held_lock+0x36/0x1c0 [ 1006.410375] ? lock_downgrade+0x8e0/0x8e0 [ 1006.414511] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1006.420041] ? proc_fail_nth_write+0x96/0x1f0 [ 1006.424525] ? proc_cwd_link+0x1d0/0x1d0 [ 1006.428576] ? find_held_lock+0x36/0x1c0 [ 1006.432627] _do_fork+0x291/0x12a0 [ 1006.436159] ? fork_idle+0x1a0/0x1a0 [ 1006.439860] ? __lock_is_held+0xb5/0x140 [ 1006.443918] ? __sb_end_write+0xac/0xe0 [ 1006.447882] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1006.453401] ? fput+0x130/0x1a0 [ 1006.456671] ? ksys_write+0x1a6/0x250 [ 1006.460461] ? SyS_read+0x30/0x30 [ 1006.463899] ? mm_fault_error+0x380/0x380 [ 1006.468046] SyS_clone+0x37/0x50 [ 1006.471400] ? sys_vfork+0x30/0x30 [ 1006.474930] do_syscall_64+0x29e/0x9d0 [ 1006.478802] ? vmalloc_sync_all+0x30/0x30 [ 1006.483601] ? _raw_spin_unlock_irq+0x27/0x70 [ 1006.488087] ? finish_task_switch+0x1ca/0x820 [ 1006.492573] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1006.497491] ? syscall_return_slowpath+0x30f/0x5c0 [ 1006.502412] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1006.507764] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1006.512601] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1006.517776] RIP: 0033:0x455259 [ 1006.520952] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1006.528650] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1006.535906] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1006.543161] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1006.550413] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1006.557669] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000000b [ 1006.587990] binder: undelivered TRANSACTION_ERROR: 29189 [ 1006.593603] binder: undelivered TRANSACTION_ERROR: 29189 [ 1006.610907] binder: release 32117:32118 transaction 759 out, still active [ 1006.618008] binder: release 32117:32118 transaction 758 in, still active [ 1006.624962] binder: undelivered TRANSACTION_COMPLETE [ 1006.630152] binder: release 32117:32131 transaction 758 out, still active [ 1006.637128] binder: undelivered TRANSACTION_COMPLETE [ 1006.642318] binder: send failed reply for transaction 759, target dead [ 1006.649058] binder: send failed reply for transaction 758, target dead 2018/04/10 12:55:35 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:35 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:35 executing program 7 (fault-call:0 fault-nth:12): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:35 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}, 0x14) 2018/04/10 12:55:35 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:35 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:35 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000200000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840000000000000007fffff", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 1006.946714] FAULT_INJECTION: forcing a failure. [ 1006.946714] name failslab, interval 1, probability 0, space 0, times 0 [ 1006.958064] CPU: 0 PID: 32173 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1006.964999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1006.974362] Call Trace: [ 1006.976961] dump_stack+0x1b9/0x294 [ 1006.980585] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1006.985772] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1006.990353] should_fail.cold.4+0xa/0x1a [ 1006.994403] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1006.999495] ? ida_remove+0x450/0x450 [ 1007.003281] ? rcu_read_lock_sched_held+0x108/0x120 [ 1007.008285] ? kmem_cache_alloc+0x5fa/0x760 [ 1007.012600] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1007.018126] ? find_held_lock+0x36/0x1c0 [ 1007.022191] ? check_same_owner+0x320/0x320 [ 1007.026498] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1007.032029] ? refcount_inc+0x29/0x70 [ 1007.035821] ? rcu_note_context_switch+0x710/0x710 [ 1007.040745] __should_failslab+0x124/0x180 [ 1007.044971] should_failslab+0x9/0x14 [ 1007.048764] kmem_cache_alloc+0x2af/0x760 [ 1007.052908] alloc_pid+0xc1/0xa50 [ 1007.056351] ? sys_ni_syscall+0x20/0x20 [ 1007.060313] ? __change_pid+0x410/0x410 [ 1007.064275] ? ns_capable_common+0x13f/0x170 [ 1007.068680] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1007.074204] ? copy_namespaces+0x25c/0x4c0 [ 1007.078425] ? memset+0x31/0x40 [ 1007.081692] ? copy_thread_tls+0x265/0x800 [ 1007.085920] copy_process.part.38+0x36bf/0x6ee0 [ 1007.090579] ? __lock_acquire+0x7f5/0x5130 [ 1007.094802] ? lock_acquire+0x1dc/0x520 [ 1007.098765] ? alloc_set_pte+0x1077/0x16a0 [ 1007.102999] ? __cleanup_sighand+0x70/0x70 [ 1007.107228] ? alloc_set_pte+0x1077/0x16a0 [ 1007.111455] ? print_usage_bug+0xc0/0xc0 [ 1007.115506] ? lock_downgrade+0x8e0/0x8e0 [ 1007.119647] ? debug_check_no_locks_freed+0x310/0x310 [ 1007.124823] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1007.130003] ? print_usage_bug+0xc0/0xc0 [ 1007.134069] ? debug_check_no_locks_freed+0x310/0x310 [ 1007.139245] ? __lock_acquire+0x7f5/0x5130 [ 1007.143466] ? debug_check_no_locks_freed+0x310/0x310 [ 1007.148652] ? print_usage_bug+0xc0/0xc0 [ 1007.152703] ? zap_class+0x720/0x720 [ 1007.156404] ? perf_trace_lock+0xd6/0x900 [ 1007.160538] ? perf_trace_lock+0xd6/0x900 [ 1007.164672] ? graph_lock+0x170/0x170 [ 1007.168458] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1007.173293] ? lock_acquire+0x1dc/0x520 [ 1007.177256] ? perf_trace_lock+0xd6/0x900 [ 1007.181396] ? zap_class+0x720/0x720 [ 1007.185095] ? find_held_lock+0x36/0x1c0 [ 1007.189144] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1007.194668] ? _parse_integer+0x13b/0x190 [ 1007.198806] ? graph_lock+0x170/0x170 [ 1007.202595] ? perf_trace_lock+0xd6/0x900 [ 1007.206725] ? _kstrtoull+0x180/0x230 [ 1007.210517] ? _parse_integer+0x190/0x190 [ 1007.214652] ? zap_class+0x720/0x720 [ 1007.218355] ? find_held_lock+0x36/0x1c0 [ 1007.222407] ? graph_lock+0x170/0x170 [ 1007.226202] ? perf_trace_lock+0xd6/0x900 [ 1007.230342] ? find_held_lock+0x36/0x1c0 [ 1007.234401] ? lock_downgrade+0x8e0/0x8e0 [ 1007.238536] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1007.244065] ? proc_fail_nth_write+0x96/0x1f0 [ 1007.248554] ? find_held_lock+0x36/0x1c0 [ 1007.252604] _do_fork+0x291/0x12a0 [ 1007.256135] ? fork_idle+0x1a0/0x1a0 [ 1007.259857] ? __sb_end_write+0xac/0xe0 [ 1007.263831] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1007.269351] ? fput+0x130/0x1a0 [ 1007.272619] ? ksys_write+0x1a6/0x250 [ 1007.276408] ? SyS_read+0x30/0x30 [ 1007.279846] ? mm_fault_error+0x380/0x380 [ 1007.283995] SyS_clone+0x37/0x50 [ 1007.287352] ? sys_vfork+0x30/0x30 [ 1007.290881] do_syscall_64+0x29e/0x9d0 [ 1007.294762] ? vmalloc_sync_all+0x30/0x30 [ 1007.298898] ? _raw_spin_unlock_irq+0x27/0x70 [ 1007.303380] ? finish_task_switch+0x1ca/0x820 [ 1007.307873] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1007.312790] ? syscall_return_slowpath+0x30f/0x5c0 [ 1007.317723] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1007.323095] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1007.327935] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1007.333198] RIP: 0033:0x455259 [ 1007.336372] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 2018/04/10 12:55:36 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe1f002000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:36 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:36 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000300000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1007.344066] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1007.351318] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1007.358572] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1007.365844] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1007.373101] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000000c [ 1007.389939] binder: 32177 RLIMIT_NICE not set 2018/04/10 12:55:36 executing program 7 (fault-call:0 fault-nth:13): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) [ 1007.473571] FAULT_INJECTION: forcing a failure. [ 1007.473571] name failslab, interval 1, probability 0, space 0, times 0 [ 1007.485043] CPU: 0 PID: 32188 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1007.491957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1007.501291] Call Trace: [ 1007.503867] dump_stack+0x1b9/0x294 [ 1007.507483] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1007.512665] should_fail.cold.4+0xa/0x1a [ 1007.516721] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1007.521814] ? radix_tree_clear_tags+0xc0/0xc0 [ 1007.526385] ? graph_lock+0x170/0x170 [ 1007.530171] ? graph_lock+0x170/0x170 [ 1007.533958] ? kasan_check_read+0x11/0x20 [ 1007.538092] ? rcu_is_watching+0x85/0x140 [ 1007.542227] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1007.547406] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1007.552586] ? graph_lock+0x170/0x170 [ 1007.556375] ? print_usage_bug+0xc0/0xc0 [ 1007.560425] __should_failslab+0x124/0x180 [ 1007.564650] should_failslab+0x9/0x14 [ 1007.568434] kmem_cache_alloc+0x47/0x760 [ 1007.572479] ? radix_tree_node_alloc.constprop.19+0x310/0x310 [ 1007.578346] ? lock_downgrade+0x8e0/0x8e0 [ 1007.582483] radix_tree_node_alloc.constprop.19+0x1e6/0x310 [ 1007.588180] idr_get_free+0x87e/0x1090 [ 1007.592059] ? is_bpf_text_address+0xd7/0x170 [ 1007.596540] ? radix_tree_clear_tags+0xc0/0xc0 [ 1007.601105] ? __kernel_text_address+0xd/0x40 [ 1007.605589] ? unwind_get_return_address+0x61/0xa0 [ 1007.610506] ? __save_stack_trace+0x7e/0xd0 [ 1007.614820] ? save_stack+0xa9/0xd0 [ 1007.618429] ? save_stack+0x43/0xd0 [ 1007.622037] ? kasan_kmalloc+0xc4/0xe0 [ 1007.625913] ? kasan_slab_alloc+0x12/0x20 [ 1007.630044] ? kmem_cache_alloc+0x12e/0x760 [ 1007.634345] ? alloc_pid+0xc1/0xa50 [ 1007.637954] ? copy_process.part.38+0x36bf/0x6ee0 [ 1007.642776] ? _do_fork+0x291/0x12a0 [ 1007.646469] ? SyS_clone+0x37/0x50 [ 1007.649990] ? do_syscall_64+0x29e/0x9d0 [ 1007.654037] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1007.659390] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1007.664910] ? find_held_lock+0x36/0x1c0 [ 1007.668966] idr_alloc_u32+0x1ef/0x3b0 [ 1007.672842] ? __fprop_inc_percpu_max+0x2c0/0x2c0 [ 1007.677669] ? lock_acquire+0x1dc/0x520 [ 1007.681627] ? alloc_pid+0x23d/0xa50 [ 1007.685323] ? rcu_pm_notify+0xc0/0xc0 [ 1007.689201] idr_alloc_cyclic+0x167/0x340 [ 1007.693338] ? idr_alloc+0x1a0/0x1a0 [ 1007.697034] ? kasan_check_write+0x14/0x20 [ 1007.701252] ? do_raw_spin_lock+0xc1/0x200 [ 1007.705473] alloc_pid+0x2de/0xa50 [ 1007.709001] ? __change_pid+0x410/0x410 [ 1007.712959] ? ns_capable_common+0x13f/0x170 [ 1007.717356] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1007.722878] ? memset+0x31/0x40 [ 1007.726143] ? copy_thread_tls+0x265/0x800 [ 1007.730374] copy_process.part.38+0x36bf/0x6ee0 [ 1007.735027] ? __lock_acquire+0x7f5/0x5130 [ 1007.739247] ? lock_acquire+0x1dc/0x520 [ 1007.743204] ? alloc_set_pte+0x1077/0x16a0 [ 1007.747430] ? __cleanup_sighand+0x70/0x70 [ 1007.751648] ? alloc_set_pte+0x1077/0x16a0 [ 1007.755868] ? print_usage_bug+0xc0/0xc0 [ 1007.759913] ? lock_downgrade+0x8e0/0x8e0 [ 1007.764050] ? debug_check_no_locks_freed+0x310/0x310 [ 1007.769232] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1007.774409] ? print_usage_bug+0xc0/0xc0 [ 1007.778464] ? debug_check_no_locks_freed+0x310/0x310 [ 1007.783637] ? __lock_acquire+0x7f5/0x5130 [ 1007.787855] ? debug_check_no_locks_freed+0x310/0x310 [ 1007.793035] ? print_usage_bug+0xc0/0xc0 [ 1007.797079] ? print_usage_bug+0xc0/0xc0 [ 1007.801128] ? graph_lock+0x170/0x170 [ 1007.804917] ? lock_acquire+0x1dc/0x520 [ 1007.808878] ? __fdget_pos+0x1a9/0x1e0 [ 1007.812752] ? graph_lock+0x170/0x170 [ 1007.816536] ? __lock_acquire+0x7f5/0x5130 [ 1007.820755] ? find_held_lock+0x36/0x1c0 [ 1007.824804] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1007.830326] ? _parse_integer+0x13b/0x190 [ 1007.834458] ? graph_lock+0x170/0x170 [ 1007.838245] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1007.843766] ? _kstrtoull+0x180/0x230 [ 1007.847554] ? _parse_integer+0x190/0x190 [ 1007.851690] ? graph_lock+0x170/0x170 [ 1007.855472] ? lock_release+0xa10/0xa10 [ 1007.859432] ? check_same_owner+0x320/0x320 [ 1007.863748] ? find_held_lock+0x36/0x1c0 [ 1007.867796] ? graph_lock+0x170/0x170 [ 1007.871584] ? lock_downgrade+0x8e0/0x8e0 [ 1007.875717] ? find_held_lock+0x36/0x1c0 [ 1007.879768] ? lock_downgrade+0x8e0/0x8e0 [ 1007.883901] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1007.889423] ? proc_fail_nth_write+0x96/0x1f0 [ 1007.893901] ? proc_cwd_link+0x1d0/0x1d0 [ 1007.897948] ? find_held_lock+0x36/0x1c0 [ 1007.901997] _do_fork+0x291/0x12a0 [ 1007.905524] ? fork_idle+0x1a0/0x1a0 [ 1007.909222] ? __lock_is_held+0xb5/0x140 [ 1007.913277] ? __sb_end_write+0xac/0xe0 [ 1007.917236] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1007.922756] ? fput+0x130/0x1a0 [ 1007.926020] ? ksys_write+0x1a6/0x250 [ 1007.929807] ? SyS_read+0x30/0x30 [ 1007.933245] ? mm_fault_error+0x380/0x380 [ 1007.937380] SyS_clone+0x37/0x50 [ 1007.940728] ? sys_vfork+0x30/0x30 [ 1007.944254] do_syscall_64+0x29e/0x9d0 [ 1007.948126] ? vmalloc_sync_all+0x30/0x30 [ 1007.952257] ? _raw_spin_unlock_irq+0x27/0x70 [ 1007.956737] ? finish_task_switch+0x1ca/0x820 [ 1007.961241] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1007.966157] ? syscall_return_slowpath+0x30f/0x5c0 [ 1007.971074] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1007.976423] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1007.981256] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1007.986426] RIP: 0033:0x455259 [ 1007.989595] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1007.997287] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1008.004536] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1008.011789] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1008.019039] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 2018/04/10 12:55:36 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeffdffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:36 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000400000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1008.026289] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000000d [ 1008.192292] binder: 32177 RLIMIT_NICE not set [ 1008.196980] binder: 32165:32206 got new transaction with bad transaction stack, transaction 763 has target 32165:32177 [ 1008.208008] binder: 32165:32206 transaction failed 29201/-71, size 0-0 line 2875 [ 1008.217378] binder: 32165:32177 ioctl c0306201 20004000 returned -14 [ 1008.217391] binder: BINDER_SET_CONTEXT_MGR already set [ 1008.229330] binder: 32165:32206 ioctl 40046207 0 returned -16 [ 1008.239959] binder_alloc: 32165: binder_alloc_buf, no vma [ 1008.245615] binder: 32165:32206 transaction failed 29189/-3, size 0-0 line 2963 [ 1008.245621] binder_alloc: 32165: binder_alloc_buf, no vma [ 1008.245657] binder: 32165:32208 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:55:37 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:37 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:37 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000401808001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:37 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:37 executing program 7 (fault-call:0 fault-nth:14): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:37 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000100", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:37 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x100000000000000}}, 0x14) [ 1008.375907] binder: undelivered TRANSACTION_ERROR: 29189 [ 1008.381495] binder: undelivered TRANSACTION_ERROR: 29189 [ 1008.400385] FAULT_INJECTION: forcing a failure. [ 1008.400385] name failslab, interval 1, probability 0, space 0, times 0 [ 1008.411775] CPU: 0 PID: 32215 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1008.411852] binder: release 32165:32177 transaction 763 in, still active [ 1008.418697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1008.418703] Call Trace: [ 1008.418725] dump_stack+0x1b9/0x294 [ 1008.418745] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1008.418763] ? kasan_check_read+0x11/0x20 [ 1008.418784] ? rcu_is_watching+0x85/0x140 [ 1008.425676] binder: send failed reply for transaction 763 to 32165:32206 [ 1008.434985] should_fail.cold.4+0xa/0x1a [ 1008.435008] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1008.435032] ? print_usage_bug+0xc0/0xc0 [ 1008.435051] ? find_held_lock+0x36/0x1c0 [ 1008.435089] ? check_same_owner+0x320/0x320 [ 1008.437699] binder: undelivered TRANSACTION_COMPLETE [ 1008.441274] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1008.441291] ? rcu_note_context_switch+0x710/0x710 [ 1008.441313] __should_failslab+0x124/0x180 [ 1008.446510] binder: undelivered TRANSACTION_ERROR: 29201 [ 1008.450616] should_failslab+0x9/0x14 [ 1008.450633] kmem_cache_alloc+0x2af/0x760 [ 1008.450651] ? __kernel_text_address+0xd/0x40 [ 1008.454794] binder: undelivered TRANSACTION_ERROR: 29189 [ 1008.461605] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1008.461618] ? replace_slot+0x14b/0x4f0 [ 1008.461645] alloc_vfsmnt+0xe0/0x9d0 [ 1008.540066] ? mnt_free_id.isra.27+0x60/0x60 [ 1008.544463] ? save_stack+0xa9/0xd0 [ 1008.548087] ? save_stack+0x43/0xd0 [ 1008.551704] ? kasan_kmalloc+0xc4/0xe0 [ 1008.555575] ? kasan_slab_alloc+0x12/0x20 [ 1008.559707] ? kmem_cache_alloc+0x12e/0x760 [ 1008.564030] ? alloc_pid+0xc1/0xa50 [ 1008.567644] ? copy_process.part.38+0x36bf/0x6ee0 [ 1008.572483] ? __radix_tree_replace+0x1f0/0x340 [ 1008.577142] ? graph_lock+0x170/0x170 [ 1008.580928] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1008.586448] ? node_tag_clear+0xc0/0x1c0 [ 1008.590498] ? radix_tree_iter_tag_clear+0x97/0xd0 [ 1008.595412] ? find_held_lock+0x36/0x1c0 [ 1008.599487] vfs_kern_mount.part.34+0x88/0x4d0 [ 1008.604058] ? may_umount+0xb0/0xb0 [ 1008.607668] ? kasan_check_read+0x11/0x20 [ 1008.611800] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1008.616196] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1008.620766] ? idr_alloc+0x1a0/0x1a0 [ 1008.624472] kern_mount_data+0x50/0xc0 [ 1008.628356] pid_ns_prepare_proc+0x1e/0x90 [ 1008.632587] alloc_pid+0x8cf/0xa50 [ 1008.636120] ? __change_pid+0x410/0x410 [ 1008.640078] ? ns_capable_common+0x13f/0x170 [ 1008.644475] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1008.650009] ? memset+0x31/0x40 [ 1008.653281] ? copy_thread_tls+0x265/0x800 [ 1008.657524] copy_process.part.38+0x36bf/0x6ee0 [ 1008.662176] ? __lock_acquire+0x7f5/0x5130 [ 1008.666399] ? lock_acquire+0x1dc/0x520 [ 1008.670361] ? alloc_set_pte+0x1077/0x16a0 [ 1008.674591] ? __cleanup_sighand+0x70/0x70 [ 1008.678815] ? alloc_set_pte+0x1077/0x16a0 [ 1008.683045] ? print_usage_bug+0xc0/0xc0 [ 1008.687095] ? lock_downgrade+0x8e0/0x8e0 [ 1008.691232] ? debug_check_no_locks_freed+0x310/0x310 [ 1008.696409] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1008.703407] ? print_usage_bug+0xc0/0xc0 [ 1008.707464] ? debug_check_no_locks_freed+0x310/0x310 [ 1008.712639] ? __lock_acquire+0x7f5/0x5130 [ 1008.716865] ? debug_check_no_locks_freed+0x310/0x310 [ 1008.722047] ? print_usage_bug+0xc0/0xc0 [ 1008.726095] ? print_usage_bug+0xc0/0xc0 [ 1008.730152] ? graph_lock+0x170/0x170 [ 1008.733942] ? lock_acquire+0x1dc/0x520 [ 1008.737902] ? __fdget_pos+0x1a9/0x1e0 [ 1008.741773] ? graph_lock+0x170/0x170 [ 1008.745560] ? __lock_acquire+0x7f5/0x5130 [ 1008.749782] ? find_held_lock+0x36/0x1c0 [ 1008.753831] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1008.759355] ? _parse_integer+0x13b/0x190 [ 1008.763501] ? graph_lock+0x170/0x170 [ 1008.767287] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1008.772810] ? _kstrtoull+0x180/0x230 [ 1008.776601] ? _parse_integer+0x190/0x190 [ 1008.780820] ? graph_lock+0x170/0x170 [ 1008.784614] ? lock_release+0xa10/0xa10 [ 1008.788582] ? check_same_owner+0x320/0x320 [ 1008.792899] ? find_held_lock+0x36/0x1c0 [ 1008.796962] ? graph_lock+0x170/0x170 [ 1008.800748] ? lock_downgrade+0x8e0/0x8e0 [ 1008.804887] ? find_held_lock+0x36/0x1c0 [ 1008.808942] ? lock_downgrade+0x8e0/0x8e0 [ 1008.813078] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1008.818609] ? proc_fail_nth_write+0x96/0x1f0 [ 1008.823087] ? proc_cwd_link+0x1d0/0x1d0 [ 1008.827135] ? find_held_lock+0x36/0x1c0 [ 1008.831185] _do_fork+0x291/0x12a0 [ 1008.834717] ? fork_idle+0x1a0/0x1a0 [ 1008.838418] ? __lock_is_held+0xb5/0x140 [ 1008.842476] ? __sb_end_write+0xac/0xe0 [ 1008.846439] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1008.851966] ? fput+0x130/0x1a0 [ 1008.855233] ? ksys_write+0x1a6/0x250 [ 1008.859025] ? SyS_read+0x30/0x30 [ 1008.862466] ? mm_fault_error+0x380/0x380 [ 1008.866611] SyS_clone+0x37/0x50 [ 1008.869963] ? sys_vfork+0x30/0x30 [ 1008.873495] do_syscall_64+0x29e/0x9d0 [ 1008.877363] ? vmalloc_sync_all+0x30/0x30 [ 1008.881495] ? _raw_spin_unlock_irq+0x27/0x70 [ 1008.885979] ? finish_task_switch+0x1ca/0x820 [ 1008.890460] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1008.895377] ? syscall_return_slowpath+0x30f/0x5c0 [ 1008.900303] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1008.905656] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1008.910490] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1008.915758] RIP: 0033:0x455259 [ 1008.918930] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1008.926625] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1008.933880] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1008.941137] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1008.948390] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1008.955735] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000000e 2018/04/10 12:55:37 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:37 executing program 7 (fault-call:0 fault-nth:15): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) [ 1008.995467] binder: 32227 RLIMIT_NICE not set 2018/04/10 12:55:37 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 1009.067845] FAULT_INJECTION: forcing a failure. [ 1009.067845] name failslab, interval 1, probability 0, space 0, times 0 [ 1009.079220] CPU: 0 PID: 32237 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1009.086155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1009.095515] Call Trace: [ 1009.098126] dump_stack+0x1b9/0x294 [ 1009.101772] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1009.106979] ? kasan_check_write+0x14/0x20 [ 1009.111236] should_fail.cold.4+0xa/0x1a [ 1009.115316] ? perf_trace_lock+0xd6/0x900 [ 1009.119593] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1009.124695] ? zap_class+0x720/0x720 [ 1009.128394] ? rcu_is_watching+0x85/0x140 [ 1009.132528] ? rcu_pm_notify+0xc0/0xc0 [ 1009.136413] ? find_held_lock+0x36/0x1c0 [ 1009.140481] ? check_same_owner+0x320/0x320 [ 1009.144794] ? rcu_note_context_switch+0x710/0x710 [ 1009.149724] __should_failslab+0x124/0x180 [ 1009.153953] should_failslab+0x9/0x14 [ 1009.157739] kmem_cache_alloc_trace+0x2cb/0x780 [ 1009.162399] ? kasan_check_write+0x14/0x20 [ 1009.166628] ? do_raw_spin_lock+0xc1/0x200 [ 1009.170854] sget_userns+0x1c7/0xf20 [ 1009.174553] ? set_anon_super+0x20/0x20 [ 1009.178519] ? get_empty_filp.cold.7+0x3e/0x3e [ 1009.183089] ? destroy_unused_super.part.9+0x100/0x100 [ 1009.188357] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1009.193365] ? save_stack+0xa9/0xd0 [ 1009.196984] ? zap_class+0x720/0x720 [ 1009.200686] ? kmem_cache_alloc+0x12e/0x760 [ 1009.204993] ? copy_process.part.38+0x36bf/0x6ee0 [ 1009.209839] ? __radix_tree_replace+0x1f0/0x340 [ 1009.214498] ? graph_lock+0x170/0x170 [ 1009.218287] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1009.223817] mount_ns+0x8f/0x1d0 [ 1009.227171] ? proc_get_inode+0x670/0x670 [ 1009.231312] proc_mount+0x73/0xa0 [ 1009.234753] mount_fs+0xae/0x328 [ 1009.238111] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1009.242681] ? may_umount+0xb0/0xb0 [ 1009.246294] ? kasan_check_read+0x11/0x20 [ 1009.250425] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1009.254821] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1009.259392] ? idr_alloc+0x1a0/0x1a0 [ 1009.263101] kern_mount_data+0x50/0xc0 [ 1009.266977] pid_ns_prepare_proc+0x1e/0x90 [ 1009.271200] alloc_pid+0x8cf/0xa50 [ 1009.274729] ? __change_pid+0x410/0x410 [ 1009.278689] ? ns_capable_common+0x13f/0x170 [ 1009.283095] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1009.288626] ? memset+0x31/0x40 [ 1009.291896] ? copy_thread_tls+0x265/0x800 [ 1009.296132] copy_process.part.38+0x36bf/0x6ee0 [ 1009.300818] ? __lock_acquire+0x7f5/0x5130 [ 1009.305048] ? lock_acquire+0x1dc/0x520 [ 1009.309010] ? alloc_set_pte+0x1077/0x16a0 [ 1009.313250] ? __cleanup_sighand+0x70/0x70 [ 1009.317475] ? alloc_set_pte+0x1077/0x16a0 [ 1009.321705] ? print_usage_bug+0xc0/0xc0 [ 1009.325755] ? lock_downgrade+0x8e0/0x8e0 [ 1009.329892] ? debug_check_no_locks_freed+0x310/0x310 [ 1009.335073] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1009.340250] ? print_usage_bug+0xc0/0xc0 [ 1009.344312] ? debug_check_no_locks_freed+0x310/0x310 [ 1009.349494] ? __lock_acquire+0x7f5/0x5130 [ 1009.353716] ? debug_check_no_locks_freed+0x310/0x310 [ 1009.358895] ? perf_trace_lock+0xd6/0x900 [ 1009.363039] ? print_usage_bug+0xc0/0xc0 [ 1009.367093] ? zap_class+0x720/0x720 [ 1009.370798] ? perf_trace_lock+0xd6/0x900 [ 1009.374931] ? perf_trace_lock+0xd6/0x900 [ 1009.379067] ? graph_lock+0x170/0x170 [ 1009.382861] ? lock_acquire+0x1dc/0x520 [ 1009.386833] ? perf_trace_lock+0xd6/0x900 [ 1009.390971] ? zap_class+0x720/0x720 [ 1009.394676] ? find_held_lock+0x36/0x1c0 [ 1009.398730] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1009.404258] ? _parse_integer+0x13b/0x190 [ 1009.408407] ? graph_lock+0x170/0x170 [ 1009.412201] ? perf_trace_lock+0xd6/0x900 [ 1009.416333] ? _kstrtoull+0x180/0x230 [ 1009.420118] ? _parse_integer+0x190/0x190 [ 1009.424260] ? zap_class+0x720/0x720 [ 1009.427970] ? find_held_lock+0x36/0x1c0 [ 1009.432028] ? graph_lock+0x170/0x170 [ 1009.435826] ? perf_trace_lock+0xd6/0x900 [ 1009.439963] ? find_held_lock+0x36/0x1c0 [ 1009.444028] ? lock_downgrade+0x8e0/0x8e0 [ 1009.448166] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1009.453689] ? proc_fail_nth_write+0x96/0x1f0 [ 1009.458182] ? find_held_lock+0x36/0x1c0 [ 1009.462234] _do_fork+0x291/0x12a0 [ 1009.465765] ? fork_idle+0x1a0/0x1a0 [ 1009.469485] ? __sb_end_write+0xac/0xe0 [ 1009.473451] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1009.478972] ? fput+0x130/0x1a0 [ 1009.482245] ? ksys_write+0x1a6/0x250 [ 1009.486041] ? SyS_read+0x30/0x30 [ 1009.489492] ? mm_fault_error+0x380/0x380 [ 1009.493640] SyS_clone+0x37/0x50 [ 1009.496999] ? sys_vfork+0x30/0x30 [ 1009.500544] do_syscall_64+0x29e/0x9d0 [ 1009.504418] ? vmalloc_sync_all+0x30/0x30 [ 1009.508563] ? _raw_spin_unlock_irq+0x27/0x70 [ 1009.513049] ? finish_task_switch+0x1ca/0x820 [ 1009.517533] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1009.522451] ? syscall_return_slowpath+0x30f/0x5c0 [ 1009.527373] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1009.532727] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1009.537564] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1009.542739] RIP: 0033:0x455259 [ 1009.545914] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1009.553611] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1009.560866] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1009.568120] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1009.575373] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1009.582629] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000000f [ 1009.796521] binder: 32227 RLIMIT_NICE not set [ 1009.800895] binder: 32226:32249 got new transaction with bad transaction stack, transaction 768 has target 32226:0 [ 1009.811643] binder: 32226:32249 transaction failed 29201/-71, size 0-0 line 2875 [ 1009.821353] binder: BINDER_SET_CONTEXT_MGR already set [ 1009.826878] binder: 32226:32227 ioctl c0306201 20004000 returned -14 [ 1009.832092] binder: 32226:32249 ioctl 40046207 0 returned -16 [ 1009.844082] binder_alloc: 32226: binder_alloc_buf, no vma [ 1009.849751] binder: 32226:32249 transaction failed 29189/-3, size 0-0 line 2963 [ 1009.851158] binder_alloc: 32226: binder_alloc_buf, no vma [ 1009.863157] binder: 32226:32251 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:55:38 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000003400008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:38 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0xa4ffffff}}, 0x14) 2018/04/10 12:55:38 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:38 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:38 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff0000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:38 executing program 7 (fault-call:0 fault-nth:16): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000000000fffffdfd00", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:38 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) [ 1009.978698] binder: undelivered TRANSACTION_ERROR: 29189 [ 1009.984243] binder: undelivered TRANSACTION_ERROR: 29189 [ 1010.003903] FAULT_INJECTION: forcing a failure. [ 1010.003903] name failslab, interval 1, probability 0, space 0, times 0 [ 1010.015693] CPU: 0 PID: 32255 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1010.022635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1010.027897] binder: BINDER_SET_CONTEXT_MGR already set [ 1010.031983] Call Trace: [ 1010.032087] dump_stack+0x1b9/0x294 [ 1010.043546] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1010.044560] binder: 32265:32266 ioctl 40046207 0 returned -16 [ 1010.048739] ? pcpu_next_fit_region.constprop.23+0x334/0x410 [ 1010.048766] should_fail.cold.4+0xa/0x1a [ 1010.048782] ? kasan_check_write+0x14/0x20 [ 1010.048803] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1010.048817] ? graph_lock+0x170/0x170 2018/04/10 12:55:38 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x2000000}}, 0x14) [ 1010.048834] ? wait_for_completion+0x870/0x870 [ 1010.057440] binder: 32266 RLIMIT_NICE not set [ 1010.060504] ? graph_lock+0x170/0x170 [ 1010.060523] ? find_next_zero_bit+0x111/0x140 [ 1010.095072] ? find_held_lock+0x36/0x1c0 [ 1010.099155] ? __lock_is_held+0xb5/0x140 [ 1010.103254] ? check_same_owner+0x320/0x320 [ 1010.107590] ? __might_sleep+0x95/0x190 [ 1010.111577] ? rcu_note_context_switch+0x710/0x710 [ 1010.116534] __should_failslab+0x124/0x180 [ 1010.120781] should_failslab+0x9/0x14 [ 1010.124590] __kmalloc+0x2c8/0x760 [ 1010.128137] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1010.133168] ? __lockdep_init_map+0x105/0x590 [ 1010.137674] ? __list_lru_init+0xdd/0x790 [ 1010.141843] __list_lru_init+0xdd/0x790 [ 1010.145855] ? list_lru_destroy+0x4c0/0x4c0 [ 1010.150188] ? mark_held_locks+0xc9/0x160 [ 1010.154347] ? __raw_spin_lock_init+0x1c/0x100 [ 1010.158933] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1010.163947] ? __lockdep_init_map+0x105/0x590 [ 1010.168439] ? lockdep_init_map+0x9/0x10 [ 1010.172502] sget_userns+0x6d9/0xf20 [ 1010.176205] ? set_anon_super+0x20/0x20 [ 1010.180167] ? get_empty_filp.cold.7+0x3e/0x3e [ 1010.184753] ? destroy_unused_super.part.9+0x100/0x100 [ 1010.190037] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1010.195047] ? save_stack+0x43/0xd0 [ 1010.198660] ? kasan_kmalloc+0xc4/0xe0 [ 1010.202535] ? kasan_slab_alloc+0x12/0x20 [ 1010.206672] ? kmem_cache_alloc+0x12e/0x760 [ 1010.210983] ? copy_process.part.38+0x36bf/0x6ee0 [ 1010.215823] ? graph_lock+0x170/0x170 [ 1010.219610] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1010.225142] mount_ns+0x8f/0x1d0 [ 1010.228497] ? proc_get_inode+0x670/0x670 [ 1010.232634] proc_mount+0x73/0xa0 [ 1010.236085] mount_fs+0xae/0x328 [ 1010.239445] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1010.244454] ? may_umount+0xb0/0xb0 [ 1010.248068] ? kasan_check_read+0x11/0x20 [ 1010.252207] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1010.256604] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1010.261172] ? idr_alloc+0x1a0/0x1a0 [ 1010.264876] kern_mount_data+0x50/0xc0 [ 1010.268751] pid_ns_prepare_proc+0x1e/0x90 [ 1010.272975] alloc_pid+0x8cf/0xa50 [ 1010.276511] ? __change_pid+0x410/0x410 [ 1010.280476] ? ns_capable_common+0x13f/0x170 [ 1010.284880] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1010.290407] ? memset+0x31/0x40 [ 1010.293678] ? copy_thread_tls+0x265/0x800 [ 1010.297904] copy_process.part.38+0x36bf/0x6ee0 [ 1010.302560] ? __lock_acquire+0x7f5/0x5130 [ 1010.306783] ? lock_acquire+0x1dc/0x520 [ 1010.310741] ? alloc_set_pte+0x1077/0x16a0 [ 1010.314991] ? __cleanup_sighand+0x70/0x70 [ 1010.319218] ? alloc_set_pte+0x1077/0x16a0 [ 1010.323446] ? print_usage_bug+0xc0/0xc0 [ 1010.327499] ? lock_downgrade+0x8e0/0x8e0 [ 1010.331640] ? debug_check_no_locks_freed+0x310/0x310 [ 1010.336820] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1010.341999] ? print_usage_bug+0xc0/0xc0 [ 1010.346064] ? debug_check_no_locks_freed+0x310/0x310 [ 1010.351241] ? __lock_acquire+0x7f5/0x5130 [ 1010.355467] ? debug_check_no_locks_freed+0x310/0x310 [ 1010.360657] ? print_usage_bug+0xc0/0xc0 [ 1010.364718] ? print_usage_bug+0xc0/0xc0 [ 1010.368774] ? graph_lock+0x170/0x170 [ 1010.372578] ? lock_acquire+0x1dc/0x520 [ 1010.376539] ? __fdget_pos+0x1a9/0x1e0 [ 1010.380414] ? graph_lock+0x170/0x170 [ 1010.384206] ? __lock_acquire+0x7f5/0x5130 [ 1010.388428] ? find_held_lock+0x36/0x1c0 [ 1010.392487] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1010.398026] ? _parse_integer+0x13b/0x190 [ 1010.402165] ? graph_lock+0x170/0x170 [ 1010.405954] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1010.411477] ? _kstrtoull+0x180/0x230 [ 1010.415270] ? _parse_integer+0x190/0x190 [ 1010.419405] ? graph_lock+0x170/0x170 [ 1010.423192] ? lock_release+0xa10/0xa10 [ 1010.427153] ? check_same_owner+0x320/0x320 [ 1010.431466] ? find_held_lock+0x36/0x1c0 [ 1010.435516] ? graph_lock+0x170/0x170 [ 1010.439308] ? lock_downgrade+0x8e0/0x8e0 [ 1010.443456] ? find_held_lock+0x36/0x1c0 [ 1010.447519] ? lock_downgrade+0x8e0/0x8e0 [ 1010.451654] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1010.457180] ? proc_fail_nth_write+0x96/0x1f0 [ 1010.461664] ? proc_cwd_link+0x1d0/0x1d0 [ 1010.465725] ? find_held_lock+0x36/0x1c0 [ 1010.469773] _do_fork+0x291/0x12a0 [ 1010.473317] ? fork_idle+0x1a0/0x1a0 [ 1010.477024] ? __lock_is_held+0xb5/0x140 [ 1010.481086] ? __sb_end_write+0xac/0xe0 [ 1010.485605] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1010.491142] ? fput+0x130/0x1a0 [ 1010.494418] ? ksys_write+0x1a6/0x250 [ 1010.498226] ? SyS_read+0x30/0x30 [ 1010.501667] ? mm_fault_error+0x380/0x380 [ 1010.505810] SyS_clone+0x37/0x50 [ 1010.509180] ? sys_vfork+0x30/0x30 [ 1010.512710] do_syscall_64+0x29e/0x9d0 [ 1010.516581] ? vmalloc_sync_all+0x30/0x30 [ 1010.520716] ? _raw_spin_unlock_irq+0x27/0x70 [ 1010.525200] ? finish_task_switch+0x1ca/0x820 [ 1010.529682] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1010.534599] ? syscall_return_slowpath+0x30f/0x5c0 [ 1010.539538] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1010.544893] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1010.549740] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1010.554916] RIP: 0033:0x455259 [ 1010.558092] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1010.565790] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1010.573043] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 2018/04/10 12:55:39 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0xf5ffffff00000000}}, 0x14) [ 1010.580297] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1010.587552] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1010.594807] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000010 [ 1010.604503] binder: release 32226:32227 transaction 768 in, still active [ 1010.611531] binder: send failed reply for transaction 768 to 32226:32249 [ 1010.618439] binder: undelivered TRANSACTION_COMPLETE [ 1010.623610] binder: undelivered TRANSACTION_ERROR: 29201 2018/04/10 12:55:39 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff02], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:39 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000508001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1010.629120] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:39 executing program 7 (fault-call:0 fault-nth:17): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:39 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:39 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:39 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x4000000000000000}}, 0x14) [ 1010.747006] FAULT_INJECTION: forcing a failure. [ 1010.747006] name failslab, interval 1, probability 0, space 0, times 0 [ 1010.758400] CPU: 0 PID: 32286 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1010.765344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1010.774711] Call Trace: [ 1010.777351] dump_stack+0x1b9/0x294 [ 1010.781000] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1010.786208] ? pcpu_next_fit_region.constprop.23+0x334/0x410 [ 1010.792055] should_fail.cold.4+0xa/0x1a 2018/04/10 12:55:39 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x8000000000000000}}, 0x14) [ 1010.796139] ? kasan_check_write+0x14/0x20 [ 1010.800404] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1010.805539] ? graph_lock+0x170/0x170 [ 1010.809374] ? wait_for_completion+0x870/0x870 [ 1010.813993] ? graph_lock+0x170/0x170 [ 1010.817807] ? find_next_zero_bit+0x111/0x140 [ 1010.822319] ? find_held_lock+0x36/0x1c0 [ 1010.826395] ? __lock_is_held+0xb5/0x140 [ 1010.827891] binder: 32265:32294 transaction failed 29189/-22, size 0-0 line 2848 [ 1010.830480] ? check_same_owner+0x320/0x320 [ 1010.830495] ? __might_sleep+0x95/0x190 2018/04/10 12:55:39 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x3f000000}}, 0x14) [ 1010.830514] ? rcu_note_context_switch+0x710/0x710 [ 1010.851252] __should_failslab+0x124/0x180 [ 1010.855504] should_failslab+0x9/0x14 [ 1010.859316] __kmalloc+0x2c8/0x760 [ 1010.862868] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1010.867894] ? __lockdep_init_map+0x105/0x590 [ 1010.872412] ? __list_lru_init+0xdd/0x790 [ 1010.876576] __list_lru_init+0xdd/0x790 [ 1010.880570] ? list_lru_destroy+0x4c0/0x4c0 [ 1010.884898] ? mark_held_locks+0xc9/0x160 [ 1010.889061] ? __raw_spin_lock_init+0x1c/0x100 [ 1010.893654] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1010.898716] ? __lockdep_init_map+0x105/0x590 [ 1010.903240] ? lockdep_init_map+0x9/0x10 [ 1010.907314] sget_userns+0x6d9/0xf20 [ 1010.911037] ? set_anon_super+0x20/0x20 [ 1010.915020] ? get_empty_filp.cold.7+0x3e/0x3e [ 1010.919626] ? destroy_unused_super.part.9+0x100/0x100 [ 1010.924928] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1010.929976] ? save_stack+0x43/0xd0 [ 1010.933618] ? kasan_kmalloc+0xc4/0xe0 [ 1010.937535] ? kasan_slab_alloc+0x12/0x20 [ 1010.941708] ? kmem_cache_alloc+0x12e/0x760 [ 1010.946036] ? copy_process.part.38+0x36bf/0x6ee0 [ 1010.950895] ? graph_lock+0x170/0x170 [ 1010.954127] binder_alloc: binder_alloc_mmap_handler: 32265 2000c000-2000e000 already mapped failed -16 [ 1010.954700] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1010.954720] mount_ns+0x8f/0x1d0 [ 1010.954739] ? proc_get_inode+0x670/0x670 [ 1010.970353] binder_alloc: 32265: binder_alloc_buf, no vma [ 1010.973048] proc_mount+0x73/0xa0 [ 1010.973067] mount_fs+0xae/0x328 [ 1010.973088] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1010.973105] ? may_umount+0xb0/0xb0 2018/04/10 12:55:39 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f4]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:39 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:39 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x1000000}}, 0x14) [ 1010.977288] binder: 32265:32294 transaction failed 29189/-3, size 0-0 line 2963 [ 1010.982761] ? kasan_check_read+0x11/0x20 [ 1010.982778] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1010.982789] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1010.982818] ? idr_alloc+0x1a0/0x1a0 [ 1010.998549] binder_alloc: 32265: binder_alloc_buf, no vma [ 1011.005238] kern_mount_data+0x50/0xc0 [ 1011.005255] pid_ns_prepare_proc+0x1e/0x90 [ 1011.005269] alloc_pid+0x8cf/0xa50 [ 1011.005287] ? __change_pid+0x410/0x410 [ 1011.005301] ? ns_capable_common+0x13f/0x170 [ 1011.005319] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1011.005339] ? memset+0x31/0x40 [ 1011.009530] binder: 32265:32303 transaction failed 29189/-3, size 0-0 line 2963 [ 1011.013884] ? copy_thread_tls+0x265/0x800 [ 1011.013915] copy_process.part.38+0x36bf/0x6ee0 [ 1011.072830] ? __lock_acquire+0x7f5/0x5130 [ 1011.077099] ? lock_acquire+0x1dc/0x520 [ 1011.081096] ? alloc_set_pte+0x1077/0x16a0 [ 1011.085347] ? __cleanup_sighand+0x70/0x70 [ 1011.089603] ? alloc_set_pte+0x1077/0x16a0 [ 1011.093852] ? print_usage_bug+0xc0/0xc0 [ 1011.097915] ? lock_downgrade+0x8e0/0x8e0 [ 1011.102062] ? debug_check_no_locks_freed+0x310/0x310 [ 1011.107251] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1011.112447] ? print_usage_bug+0xc0/0xc0 [ 1011.116519] ? debug_check_no_locks_freed+0x310/0x310 [ 1011.121701] ? __lock_acquire+0x7f5/0x5130 [ 1011.125926] ? debug_check_no_locks_freed+0x310/0x310 [ 1011.131119] ? print_usage_bug+0xc0/0xc0 [ 1011.135170] ? print_usage_bug+0xc0/0xc0 [ 1011.139220] ? graph_lock+0x170/0x170 [ 1011.143022] ? lock_acquire+0x1dc/0x520 [ 1011.146987] ? __fdget_pos+0x1a9/0x1e0 [ 1011.150862] ? graph_lock+0x170/0x170 [ 1011.154664] ? __lock_acquire+0x7f5/0x5130 [ 1011.158895] ? find_held_lock+0x36/0x1c0 [ 1011.162950] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1011.168487] ? _parse_integer+0x13b/0x190 [ 1011.172624] ? graph_lock+0x170/0x170 [ 1011.176411] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1011.182065] ? _kstrtoull+0x180/0x230 [ 1011.185851] ? _parse_integer+0x190/0x190 [ 1011.189988] ? graph_lock+0x170/0x170 [ 1011.193776] ? lock_release+0xa10/0xa10 [ 1011.197739] ? check_same_owner+0x320/0x320 [ 1011.202052] ? find_held_lock+0x36/0x1c0 [ 1011.206101] ? graph_lock+0x170/0x170 [ 1011.209890] ? lock_downgrade+0x8e0/0x8e0 [ 1011.214038] ? find_held_lock+0x36/0x1c0 [ 1011.218094] ? lock_downgrade+0x8e0/0x8e0 [ 1011.222231] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1011.227759] ? proc_fail_nth_write+0x96/0x1f0 [ 1011.232239] ? proc_cwd_link+0x1d0/0x1d0 [ 1011.236291] ? find_held_lock+0x36/0x1c0 [ 1011.240342] _do_fork+0x291/0x12a0 [ 1011.243875] ? fork_idle+0x1a0/0x1a0 [ 1011.247578] ? __lock_is_held+0xb5/0x140 [ 1011.251638] ? __sb_end_write+0xac/0xe0 [ 1011.255604] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1011.261123] ? fput+0x130/0x1a0 [ 1011.264396] ? ksys_write+0x1a6/0x250 [ 1011.268185] ? SyS_read+0x30/0x30 [ 1011.271624] ? mm_fault_error+0x380/0x380 [ 1011.275771] SyS_clone+0x37/0x50 [ 1011.279125] ? sys_vfork+0x30/0x30 [ 1011.282659] do_syscall_64+0x29e/0x9d0 [ 1011.286538] ? vmalloc_sync_all+0x30/0x30 [ 1011.290671] ? _raw_spin_unlock_irq+0x27/0x70 [ 1011.295153] ? finish_task_switch+0x1ca/0x820 [ 1011.299640] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1011.304563] ? syscall_return_slowpath+0x30f/0x5c0 [ 1011.309483] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1011.314840] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1011.330271] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1011.335446] RIP: 0033:0x455259 [ 1011.338622] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 2018/04/10 12:55:40 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x3f00000000000000}}, 0x14) [ 1011.346318] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1011.353573] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1011.360830] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1011.368261] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1011.375519] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000011 [ 1011.469439] binder: undelivered TRANSACTION_ERROR: 29189 [ 1011.475184] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:40 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:40 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000030008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:40 executing program 7 (fault-call:0 fault-nth:18): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:40 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000000000fdfdffff00", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:40 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:40 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff02000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:40 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0xffffffa4}}, 0x14) [ 1011.889395] FAULT_INJECTION: forcing a failure. [ 1011.889395] name failslab, interval 1, probability 0, space 0, times 0 [ 1011.900721] CPU: 0 PID: 32331 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1011.907658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1011.917023] Call Trace: [ 1011.919615] dump_stack+0x1b9/0x294 [ 1011.923259] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1011.928452] ? kernel_text_address+0x79/0xf0 [ 1011.932856] ? __unwind_start+0x166/0x330 [ 1011.936994] should_fail.cold.4+0xa/0x1a [ 1011.941051] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1011.946148] ? graph_lock+0x170/0x170 [ 1011.949937] ? save_stack+0x43/0xd0 [ 1011.953553] ? kasan_kmalloc+0xc4/0xe0 [ 1011.957422] ? __kmalloc+0x14e/0x760 [ 1011.961124] ? __list_lru_init+0xdd/0x790 [ 1011.965270] ? find_held_lock+0x36/0x1c0 [ 1011.969323] ? __lock_is_held+0xb5/0x140 [ 1011.973379] ? check_same_owner+0x320/0x320 [ 1011.977692] ? rcu_note_context_switch+0x710/0x710 [ 1011.982613] __should_failslab+0x124/0x180 [ 1011.986841] should_failslab+0x9/0x14 [ 1011.990630] kmem_cache_alloc_node_trace+0x26f/0x770 [ 1011.995726] ? mark_held_locks+0xc9/0x160 [ 1011.999871] ? __raw_spin_lock_init+0x1c/0x100 [ 1012.004443] __kmalloc_node+0x33/0x70 [ 1012.008230] kvmalloc_node+0x6b/0x100 [ 1012.012026] __list_lru_init+0x559/0x790 [ 1012.016078] ? list_lru_destroy+0x4c0/0x4c0 [ 1012.020383] ? mark_held_locks+0xc9/0x160 [ 1012.024518] ? __raw_spin_lock_init+0x1c/0x100 [ 1012.029086] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1012.034084] ? __lockdep_init_map+0x105/0x590 [ 1012.038564] ? lockdep_init_map+0x9/0x10 [ 1012.042615] sget_userns+0x6d9/0xf20 [ 1012.046318] ? set_anon_super+0x20/0x20 [ 1012.050280] ? get_empty_filp.cold.7+0x3e/0x3e [ 1012.054849] ? destroy_unused_super.part.9+0x100/0x100 [ 1012.060113] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1012.065117] ? save_stack+0x43/0xd0 [ 1012.068727] ? kasan_kmalloc+0xc4/0xe0 [ 1012.072595] ? kasan_slab_alloc+0x12/0x20 [ 1012.076726] ? kmem_cache_alloc+0x12e/0x760 [ 1012.081036] ? copy_process.part.38+0x36bf/0x6ee0 [ 1012.085866] ? graph_lock+0x170/0x170 [ 1012.089652] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1012.095179] mount_ns+0x8f/0x1d0 [ 1012.098532] ? proc_get_inode+0x670/0x670 [ 1012.102666] proc_mount+0x73/0xa0 [ 1012.106104] mount_fs+0xae/0x328 [ 1012.109460] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1012.114033] ? may_umount+0xb0/0xb0 [ 1012.117642] ? kasan_check_read+0x11/0x20 [ 1012.121775] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1012.126172] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1012.130739] ? idr_alloc+0x1a0/0x1a0 [ 1012.134440] kern_mount_data+0x50/0xc0 [ 1012.138317] pid_ns_prepare_proc+0x1e/0x90 [ 1012.142535] alloc_pid+0x8cf/0xa50 [ 1012.146064] ? __change_pid+0x410/0x410 [ 1012.150030] ? ns_capable_common+0x13f/0x170 [ 1012.154443] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1012.160055] ? memset+0x31/0x40 [ 1012.163321] ? copy_thread_tls+0x265/0x800 [ 1012.167544] copy_process.part.38+0x36bf/0x6ee0 [ 1012.172199] ? __lock_acquire+0x7f5/0x5130 [ 1012.176423] ? lock_acquire+0x1dc/0x520 [ 1012.180380] ? alloc_set_pte+0x1077/0x16a0 [ 1012.184607] ? __cleanup_sighand+0x70/0x70 [ 1012.188824] ? alloc_set_pte+0x1077/0x16a0 [ 1012.193050] ? print_usage_bug+0xc0/0xc0 [ 1012.197097] ? lock_downgrade+0x8e0/0x8e0 [ 1012.201234] ? debug_check_no_locks_freed+0x310/0x310 [ 1012.206410] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1012.211585] ? print_usage_bug+0xc0/0xc0 [ 1012.215639] ? debug_check_no_locks_freed+0x310/0x310 [ 1012.220815] ? __lock_acquire+0x7f5/0x5130 [ 1012.225037] ? debug_check_no_locks_freed+0x310/0x310 [ 1012.230217] ? print_usage_bug+0xc0/0xc0 [ 1012.234263] ? print_usage_bug+0xc0/0xc0 [ 1012.238312] ? graph_lock+0x170/0x170 [ 1012.242098] ? lock_acquire+0x1dc/0x520 [ 1012.246056] ? __fdget_pos+0x1a9/0x1e0 [ 1012.249928] ? graph_lock+0x170/0x170 [ 1012.253717] ? __lock_acquire+0x7f5/0x5130 [ 1012.257936] ? find_held_lock+0x36/0x1c0 [ 1012.261982] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1012.267525] ? _parse_integer+0x13b/0x190 [ 1012.271657] ? graph_lock+0x170/0x170 [ 1012.275442] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1012.280961] ? _kstrtoull+0x180/0x230 [ 1012.284748] ? _parse_integer+0x190/0x190 [ 1012.288882] ? graph_lock+0x170/0x170 [ 1012.292665] ? lock_release+0xa10/0xa10 [ 1012.296622] ? check_same_owner+0x320/0x320 [ 1012.300930] ? find_held_lock+0x36/0x1c0 [ 1012.304977] ? graph_lock+0x170/0x170 [ 1012.308765] ? lock_downgrade+0x8e0/0x8e0 [ 1012.312900] ? find_held_lock+0x36/0x1c0 [ 1012.316967] ? lock_downgrade+0x8e0/0x8e0 [ 1012.321107] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1012.326630] ? proc_fail_nth_write+0x96/0x1f0 [ 1012.331108] ? proc_cwd_link+0x1d0/0x1d0 [ 1012.335156] ? find_held_lock+0x36/0x1c0 [ 1012.339203] _do_fork+0x291/0x12a0 [ 1012.342734] ? fork_idle+0x1a0/0x1a0 [ 1012.346432] ? __lock_is_held+0xb5/0x140 [ 1012.350487] ? __sb_end_write+0xac/0xe0 [ 1012.354448] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1012.359968] ? fput+0x130/0x1a0 [ 1012.363231] ? ksys_write+0x1a6/0x250 [ 1012.367024] ? SyS_read+0x30/0x30 [ 1012.370464] ? mm_fault_error+0x380/0x380 [ 1012.374599] SyS_clone+0x37/0x50 [ 1012.377953] ? sys_vfork+0x30/0x30 [ 1012.381477] do_syscall_64+0x29e/0x9d0 [ 1012.385432] ? vmalloc_sync_all+0x30/0x30 [ 1012.389566] ? _raw_spin_unlock_irq+0x27/0x70 [ 1012.394045] ? finish_task_switch+0x1ca/0x820 [ 1012.398621] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1012.403535] ? syscall_return_slowpath+0x30f/0x5c0 [ 1012.408454] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1012.413805] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1012.418639] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1012.423810] RIP: 0033:0x455259 [ 1012.426983] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1012.434678] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1012.441940] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1012.449192] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1012.456447] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1012.463701] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000012 2018/04/10 12:55:41 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000], 0x1}, 0x5}, 0x1c) [ 1012.487951] binder: 32341 RLIMIT_NICE not set [ 1012.688638] binder: 32341 RLIMIT_NICE not set [ 1012.694091] binder: 32329:32341 ioctl c0306201 20004000 returned -14 [ 1012.694582] binder: BINDER_SET_CONTEXT_MGR already set [ 1012.706131] binder: 32329:32354 ioctl 40046207 0 returned -16 [ 1012.716861] binder_alloc: 32329: binder_alloc_buf, no vma [ 1012.722523] binder_alloc: 32329: binder_alloc_buf, no vma [ 1012.722535] binder: 32329:32354 transaction failed 29189/-3, size 0-0 line 2963 [ 1012.735700] binder: 32329:32355 transaction failed 29189/-3, size 0-0 line 2963 [ 1012.854565] binder: undelivered TRANSACTION_ERROR: 29189 [ 1012.860148] binder: undelivered TRANSACTION_ERROR: 29189 [ 1012.869564] binder: release 32329:32341 transaction 778 out, still active [ 1012.876620] binder: release 32329:32341 transaction 777 in, still active [ 1012.883529] binder: undelivered TRANSACTION_COMPLETE [ 1012.888727] binder: release 32329:32354 transaction 777 out, still active [ 1012.895713] binder: undelivered TRANSACTION_COMPLETE [ 1012.900861] binder: send failed reply for transaction 778, target dead [ 1012.907608] binder: send failed reply for transaction 777, target dead 2018/04/10 12:55:42 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000200008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:42 executing program 7 (fault-call:0 fault-nth:19): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:42 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdffffff00000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:42 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:42 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840000000000000f0ffffff", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:42 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x4000000000000}}, 0x14) 2018/04/10 12:55:42 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) [ 1013.397352] FAULT_INJECTION: forcing a failure. [ 1013.397352] name failslab, interval 1, probability 0, space 0, times 0 [ 1013.408685] CPU: 0 PID: 32362 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1013.415631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1013.424994] Call Trace: [ 1013.427593] dump_stack+0x1b9/0x294 [ 1013.431230] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1013.436429] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1013.441629] should_fail.cold.4+0xa/0x1a [ 1013.445684] ? is_bpf_text_address+0xd7/0x170 [ 1013.450192] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1013.455291] ? unwind_get_return_address+0x61/0xa0 [ 1013.460209] ? __save_stack_trace+0x7e/0xd0 [ 1013.464519] ? graph_lock+0x170/0x170 [ 1013.468311] ? find_held_lock+0x36/0x1c0 [ 1013.472364] ? __lock_is_held+0xb5/0x140 [ 1013.476425] ? check_same_owner+0x320/0x320 [ 1013.480742] ? rcu_note_context_switch+0x710/0x710 [ 1013.485667] __should_failslab+0x124/0x180 [ 1013.489895] should_failslab+0x9/0x14 [ 1013.493699] kmem_cache_alloc_trace+0x2cb/0x780 [ 1013.498359] ? __kmalloc_node+0x33/0x70 [ 1013.502319] ? __kmalloc_node+0x33/0x70 [ 1013.506286] ? rcu_read_lock_sched_held+0x108/0x120 [ 1013.511297] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1013.516306] ? kvfree_rcu+0x20/0x20 [ 1013.519921] ? __kmalloc_node+0x47/0x70 [ 1013.523889] __list_lru_init+0x456/0x790 [ 1013.527942] ? list_lru_destroy+0x4c0/0x4c0 [ 1013.532253] ? mark_held_locks+0xc9/0x160 [ 1013.536394] ? __raw_spin_lock_init+0x1c/0x100 [ 1013.540966] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1013.545967] ? __lockdep_init_map+0x105/0x590 [ 1013.550451] ? lockdep_init_map+0x9/0x10 [ 1013.554503] sget_userns+0x6d9/0xf20 [ 1013.558202] ? set_anon_super+0x20/0x20 [ 1013.562171] ? get_empty_filp.cold.7+0x3e/0x3e [ 1013.566912] ? destroy_unused_super.part.9+0x100/0x100 [ 1013.572182] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1013.577190] ? save_stack+0x43/0xd0 [ 1013.580805] ? kasan_kmalloc+0xc4/0xe0 [ 1013.584680] ? kasan_slab_alloc+0x12/0x20 [ 1013.588816] ? kmem_cache_alloc+0x12e/0x760 [ 1013.593125] ? copy_process.part.38+0x36bf/0x6ee0 [ 1013.597960] ? graph_lock+0x170/0x170 [ 1013.601751] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1013.607281] mount_ns+0x8f/0x1d0 [ 1013.610634] ? proc_get_inode+0x670/0x670 [ 1013.614774] proc_mount+0x73/0xa0 [ 1013.618216] mount_fs+0xae/0x328 [ 1013.621575] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1013.626151] ? may_umount+0xb0/0xb0 [ 1013.629761] ? kasan_check_read+0x11/0x20 [ 1013.633902] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1013.638302] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1013.642874] ? idr_alloc+0x1a0/0x1a0 [ 1013.646666] kern_mount_data+0x50/0xc0 [ 1013.650540] pid_ns_prepare_proc+0x1e/0x90 [ 1013.654763] alloc_pid+0x8cf/0xa50 [ 1013.658295] ? __change_pid+0x410/0x410 [ 1013.662257] ? ns_capable_common+0x13f/0x170 [ 1013.666656] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1013.672181] ? memset+0x31/0x40 [ 1013.675452] ? copy_thread_tls+0x265/0x800 [ 1013.679679] copy_process.part.38+0x36bf/0x6ee0 [ 1013.684344] ? __lock_acquire+0x7f5/0x5130 [ 1013.688568] ? lock_acquire+0x1dc/0x520 [ 1013.692528] ? alloc_set_pte+0x1077/0x16a0 [ 1013.696761] ? __cleanup_sighand+0x70/0x70 [ 1013.700980] ? alloc_set_pte+0x1077/0x16a0 [ 1013.705209] ? print_usage_bug+0xc0/0xc0 [ 1013.709261] ? lock_downgrade+0x8e0/0x8e0 [ 1013.713412] ? debug_check_no_locks_freed+0x310/0x310 [ 1013.718592] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1013.723771] ? print_usage_bug+0xc0/0xc0 [ 1013.727844] ? debug_check_no_locks_freed+0x310/0x310 [ 1013.733038] ? __lock_acquire+0x7f5/0x5130 [ 1013.737259] ? debug_check_no_locks_freed+0x310/0x310 [ 1013.742445] ? print_usage_bug+0xc0/0xc0 [ 1013.746494] ? print_usage_bug+0xc0/0xc0 [ 1013.750546] ? graph_lock+0x170/0x170 [ 1013.754339] ? lock_acquire+0x1dc/0x520 [ 1013.758297] ? __fdget_pos+0x1a9/0x1e0 [ 1013.762173] ? graph_lock+0x170/0x170 [ 1013.765963] ? __lock_acquire+0x7f5/0x5130 [ 1013.770194] ? find_held_lock+0x36/0x1c0 [ 1013.774247] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1013.779773] ? _parse_integer+0x13b/0x190 [ 1013.783912] ? graph_lock+0x170/0x170 [ 1013.787699] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1013.793223] ? _kstrtoull+0x180/0x230 [ 1013.797017] ? _parse_integer+0x190/0x190 [ 1013.801160] ? graph_lock+0x170/0x170 [ 1013.804946] ? lock_release+0xa10/0xa10 [ 1013.808906] ? check_same_owner+0x320/0x320 [ 1013.813214] ? find_held_lock+0x36/0x1c0 [ 1013.817264] ? graph_lock+0x170/0x170 [ 1013.821056] ? lock_downgrade+0x8e0/0x8e0 [ 1013.825197] ? find_held_lock+0x36/0x1c0 [ 1013.829252] ? lock_downgrade+0x8e0/0x8e0 [ 1013.833389] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1013.838913] ? proc_fail_nth_write+0x96/0x1f0 [ 1013.843396] ? proc_cwd_link+0x1d0/0x1d0 [ 1013.847448] ? find_held_lock+0x36/0x1c0 [ 1013.851498] _do_fork+0x291/0x12a0 [ 1013.855038] ? fork_idle+0x1a0/0x1a0 [ 1013.858741] ? __lock_is_held+0xb5/0x140 [ 1013.862800] ? __sb_end_write+0xac/0xe0 [ 1013.866766] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1013.872291] ? fput+0x130/0x1a0 [ 1013.875558] ? ksys_write+0x1a6/0x250 [ 1013.879347] ? SyS_read+0x30/0x30 [ 1013.882783] ? mm_fault_error+0x380/0x380 [ 1013.886923] SyS_clone+0x37/0x50 [ 1013.890276] ? sys_vfork+0x30/0x30 [ 1013.893806] do_syscall_64+0x29e/0x9d0 [ 1013.897681] ? vmalloc_sync_all+0x30/0x30 [ 1013.901818] ? _raw_spin_unlock_irq+0x27/0x70 [ 1013.906304] ? finish_task_switch+0x1ca/0x820 [ 1013.910789] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1013.915708] ? syscall_return_slowpath+0x30f/0x5c0 [ 1013.920977] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1013.926333] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1013.931171] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1013.936345] RIP: 0033:0x455259 [ 1013.939517] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 2018/04/10 12:55:42 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900], 0x1}, 0x5}, 0x1c) [ 1013.947215] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1013.954480] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1013.961737] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1013.968990] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1013.976247] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000013 [ 1013.991394] binder: 32370 RLIMIT_NICE not set 2018/04/10 12:55:42 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000050008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:42 executing program 7 (fault-call:0 fault-nth:20): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) [ 1014.085763] FAULT_INJECTION: forcing a failure. [ 1014.085763] name failslab, interval 1, probability 0, space 0, times 0 [ 1014.097159] CPU: 0 PID: 32388 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1014.104099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1014.113465] Call Trace: [ 1014.116082] dump_stack+0x1b9/0x294 [ 1014.119738] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1014.124943] ? __save_stack_trace+0x7e/0xd0 [ 1014.129302] should_fail.cold.4+0xa/0x1a [ 1014.133385] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1014.138509] ? save_stack+0x43/0xd0 [ 1014.143113] ? kasan_kmalloc+0xc4/0xe0 [ 1014.147020] ? kmem_cache_alloc_trace+0x152/0x780 [ 1014.151880] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1014.157087] ? __list_lru_init+0x456/0x790 [ 1014.161342] ? sget_userns+0x6d9/0xf20 [ 1014.165251] ? graph_lock+0x170/0x170 [ 1014.169060] ? kern_mount_data+0x50/0xc0 [ 1014.173138] ? pid_ns_prepare_proc+0x1e/0x90 [ 1014.177556] ? alloc_pid+0x8cf/0xa50 [ 1014.181286] ? copy_process.part.38+0x36bf/0x6ee0 [ 1014.186145] ? _do_fork+0x291/0x12a0 [ 1014.189865] ? SyS_clone+0x37/0x50 [ 1014.193400] ? find_held_lock+0x36/0x1c0 [ 1014.197454] ? __lock_is_held+0xb5/0x140 [ 1014.201516] ? check_same_owner+0x320/0x320 [ 1014.205836] ? rcu_note_context_switch+0x710/0x710 [ 1014.210783] __should_failslab+0x124/0x180 [ 1014.215012] should_failslab+0x9/0x14 [ 1014.218806] kmem_cache_alloc_trace+0x2cb/0x780 [ 1014.223460] ? __kmalloc_node+0x33/0x70 [ 1014.227420] ? __kmalloc_node+0x33/0x70 [ 1014.231383] ? rcu_read_lock_sched_held+0x108/0x120 [ 1014.236395] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1014.241403] ? kvfree_rcu+0x20/0x20 [ 1014.245023] ? __kmalloc_node+0x47/0x70 [ 1014.248997] __list_lru_init+0x456/0x790 [ 1014.253055] ? list_lru_destroy+0x4c0/0x4c0 [ 1014.257366] ? mark_held_locks+0xc9/0x160 [ 1014.261505] ? __raw_spin_lock_init+0x1c/0x100 [ 1014.266074] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1014.271080] ? __lockdep_init_map+0x105/0x590 [ 1014.275566] ? lockdep_init_map+0x9/0x10 [ 1014.279622] sget_userns+0x6d9/0xf20 [ 1014.283320] ? set_anon_super+0x20/0x20 [ 1014.287285] ? get_empty_filp.cold.7+0x3e/0x3e [ 1014.291856] ? destroy_unused_super.part.9+0x100/0x100 [ 1014.297124] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1014.302142] ? zap_class+0x720/0x720 [ 1014.305843] ? kmem_cache_alloc+0x12e/0x760 [ 1014.310150] ? copy_process.part.38+0x36bf/0x6ee0 [ 1014.314995] ? graph_lock+0x170/0x170 [ 1014.318791] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1014.324323] mount_ns+0x8f/0x1d0 [ 1014.327680] ? proc_get_inode+0x670/0x670 [ 1014.331820] proc_mount+0x73/0xa0 [ 1014.335260] mount_fs+0xae/0x328 [ 1014.338620] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1014.343195] ? may_umount+0xb0/0xb0 [ 1014.346810] ? kasan_check_read+0x11/0x20 [ 1014.350946] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1014.355344] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1014.359912] ? idr_alloc+0x1a0/0x1a0 [ 1014.363619] kern_mount_data+0x50/0xc0 [ 1014.367495] pid_ns_prepare_proc+0x1e/0x90 [ 1014.371719] alloc_pid+0x8cf/0xa50 [ 1014.375249] ? __change_pid+0x410/0x410 [ 1014.379210] ? ns_capable_common+0x13f/0x170 [ 1014.383611] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1014.389134] ? memset+0x31/0x40 [ 1014.392409] ? copy_thread_tls+0x265/0x800 [ 1014.396635] copy_process.part.38+0x36bf/0x6ee0 [ 1014.401295] ? __lock_acquire+0x7f5/0x5130 [ 1014.405523] ? lock_acquire+0x1dc/0x520 [ 1014.409482] ? alloc_set_pte+0x1077/0x16a0 [ 1014.413716] ? __cleanup_sighand+0x70/0x70 [ 1014.417936] ? alloc_set_pte+0x1077/0x16a0 [ 1014.422167] ? print_usage_bug+0xc0/0xc0 [ 1014.426217] ? lock_downgrade+0x8e0/0x8e0 [ 1014.430357] ? debug_check_no_locks_freed+0x310/0x310 [ 1014.435534] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1014.440711] ? print_usage_bug+0xc0/0xc0 [ 1014.444771] ? debug_check_no_locks_freed+0x310/0x310 [ 1014.449952] ? __lock_acquire+0x7f5/0x5130 [ 1014.454174] ? debug_check_no_locks_freed+0x310/0x310 [ 1014.459352] ? perf_trace_lock+0xd6/0x900 [ 1014.463494] ? print_usage_bug+0xc0/0xc0 [ 1014.467546] ? zap_class+0x720/0x720 [ 1014.471428] ? perf_trace_lock+0xd6/0x900 [ 1014.475562] ? perf_trace_lock+0xd6/0x900 [ 1014.479696] ? graph_lock+0x170/0x170 [ 1014.484154] ? lock_acquire+0x1dc/0x520 [ 1014.488123] ? perf_trace_lock+0xd6/0x900 [ 1014.492277] ? zap_class+0x720/0x720 [ 1014.495978] ? find_held_lock+0x36/0x1c0 [ 1014.500035] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1014.505558] ? _parse_integer+0x13b/0x190 [ 1014.509696] ? graph_lock+0x170/0x170 [ 1014.513484] ? perf_trace_lock+0xd6/0x900 [ 1014.517615] ? _kstrtoull+0x180/0x230 [ 1014.521403] ? _parse_integer+0x190/0x190 [ 1014.525539] ? zap_class+0x720/0x720 [ 1014.529245] ? find_held_lock+0x36/0x1c0 [ 1014.533305] ? graph_lock+0x170/0x170 [ 1014.537101] ? perf_trace_lock+0xd6/0x900 [ 1014.541241] ? find_held_lock+0x36/0x1c0 [ 1014.545296] ? lock_downgrade+0x8e0/0x8e0 [ 1014.549434] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1014.554959] ? proc_fail_nth_write+0x96/0x1f0 [ 1014.559450] ? find_held_lock+0x36/0x1c0 [ 1014.563504] _do_fork+0x291/0x12a0 [ 1014.567066] ? fork_idle+0x1a0/0x1a0 [ 1014.570787] ? __sb_end_write+0xac/0xe0 [ 1014.574752] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1014.580272] ? fput+0x130/0x1a0 [ 1014.583542] ? ksys_write+0x1a6/0x250 [ 1014.587331] ? SyS_read+0x30/0x30 [ 1014.590772] ? mm_fault_error+0x380/0x380 [ 1014.594912] SyS_clone+0x37/0x50 [ 1014.598262] ? sys_vfork+0x30/0x30 [ 1014.601797] do_syscall_64+0x29e/0x9d0 [ 1014.605675] ? vmalloc_sync_all+0x30/0x30 [ 1014.609811] ? _raw_spin_unlock_irq+0x27/0x70 [ 1014.614294] ? finish_task_switch+0x1ca/0x820 [ 1014.618783] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1014.623703] ? syscall_return_slowpath+0x30f/0x5c0 [ 1014.628683] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1014.634043] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1014.638883] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1014.644062] RIP: 0033:0x455259 [ 1014.647236] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1014.654934] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1014.662192] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1014.669468] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1014.676724] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1014.683983] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000014 [ 1014.697818] binder: 32370 RLIMIT_NICE not set [ 1014.705356] binder: BINDER_SET_CONTEXT_MGR already set [ 1014.714016] binder: 32369:32370 ioctl c0306201 20004000 returned -14 [ 1014.727780] binder: 32369:32393 ioctl 40046207 0 returned -16 [ 1014.739171] binder_alloc: 32369: binder_alloc_buf, no vma [ 1014.744881] binder: 32369:32393 transaction failed 29189/-3, size 0-0 line 2963 [ 1014.750646] binder_alloc: 32369: binder_alloc_buf, no vma [ 1014.758064] binder: 32369:32397 transaction failed 29189/-3, size 0-0 line 2963 [ 1014.875563] binder: undelivered TRANSACTION_ERROR: 29189 [ 1014.881157] binder: undelivered TRANSACTION_ERROR: 29189 [ 1014.887339] binder: release 32369:32370 transaction 783 out, still active [ 1014.894381] binder: release 32369:32370 transaction 782 in, still active [ 1014.901300] binder: undelivered TRANSACTION_COMPLETE [ 1014.906449] binder: release 32369:32393 transaction 782 out, still active [ 1014.913404] binder: undelivered TRANSACTION_COMPLETE [ 1014.918542] binder: send failed reply for transaction 783, target dead 2018/04/10 12:55:43 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc0], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:43 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x40000000}}, 0x14) 2018/04/10 12:55:43 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:43 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000000000000e001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:43 executing program 7 (fault-call:0 fault-nth:21): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:43 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:43 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x1, 0x0) 2018/04/10 12:55:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 1014.925274] binder: send failed reply for transaction 782, target dead [ 1014.968650] binder: 32414 RLIMIT_NICE not set [ 1014.971174] FAULT_INJECTION: forcing a failure. [ 1014.971174] name failslab, interval 1, probability 0, space 0, times 0 [ 1014.984546] CPU: 0 PID: 32407 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1014.991492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1015.000854] Call Trace: [ 1015.003444] dump_stack+0x1b9/0x294 [ 1015.007071] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1015.012265] ? __save_stack_trace+0x7e/0xd0 [ 1015.016592] should_fail.cold.4+0xa/0x1a [ 1015.020656] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1015.025749] ? save_stack+0x43/0xd0 [ 1015.029361] ? kasan_kmalloc+0xc4/0xe0 [ 1015.033251] ? kmem_cache_alloc_trace+0x152/0x780 [ 1015.038080] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1015.043263] ? __list_lru_init+0x456/0x790 [ 1015.047489] ? sget_userns+0x6d9/0xf20 [ 1015.051365] ? graph_lock+0x170/0x170 [ 1015.055150] ? kern_mount_data+0x50/0xc0 [ 1015.059198] ? pid_ns_prepare_proc+0x1e/0x90 [ 1015.063595] ? alloc_pid+0x8cf/0xa50 [ 1015.067295] ? copy_process.part.38+0x36bf/0x6ee0 [ 1015.072121] ? _do_fork+0x291/0x12a0 [ 1015.075819] ? SyS_clone+0x37/0x50 [ 1015.079352] ? find_held_lock+0x36/0x1c0 [ 1015.083406] ? __lock_is_held+0xb5/0x140 [ 1015.087469] ? check_same_owner+0x320/0x320 [ 1015.091787] ? rcu_note_context_switch+0x710/0x710 [ 1015.096709] __should_failslab+0x124/0x180 [ 1015.100939] should_failslab+0x9/0x14 [ 1015.104736] kmem_cache_alloc_trace+0x2cb/0x780 [ 1015.109392] ? __kmalloc_node+0x33/0x70 [ 1015.113353] ? __kmalloc_node+0x33/0x70 [ 1015.117319] ? rcu_read_lock_sched_held+0x108/0x120 [ 1015.122331] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1015.127339] ? kvfree_rcu+0x20/0x20 [ 1015.130952] ? __kmalloc_node+0x47/0x70 [ 1015.134919] __list_lru_init+0x456/0x790 [ 1015.138970] ? list_lru_destroy+0x4c0/0x4c0 [ 1015.143286] ? mark_held_locks+0xc9/0x160 [ 1015.147421] ? __raw_spin_lock_init+0x1c/0x100 [ 1015.151989] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1015.156995] ? __lockdep_init_map+0x105/0x590 [ 1015.161485] ? lockdep_init_map+0x9/0x10 [ 1015.165537] sget_userns+0x6d9/0xf20 [ 1015.169233] ? set_anon_super+0x20/0x20 [ 1015.173196] ? get_empty_filp.cold.7+0x3e/0x3e [ 1015.177767] ? destroy_unused_super.part.9+0x100/0x100 [ 1015.183043] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1015.188057] ? zap_class+0x720/0x720 [ 1015.191757] ? kmem_cache_alloc+0x12e/0x760 [ 1015.196064] ? copy_process.part.38+0x36bf/0x6ee0 [ 1015.200900] ? graph_lock+0x170/0x170 [ 1015.204693] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1015.210223] mount_ns+0x8f/0x1d0 [ 1015.213577] ? proc_get_inode+0x670/0x670 [ 1015.217714] proc_mount+0x73/0xa0 [ 1015.221154] mount_fs+0xae/0x328 [ 1015.224516] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1015.229086] ? may_umount+0xb0/0xb0 [ 1015.232696] ? kasan_check_read+0x11/0x20 [ 1015.236834] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1015.241231] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1015.245799] ? idr_alloc+0x1a0/0x1a0 [ 1015.249503] kern_mount_data+0x50/0xc0 [ 1015.253388] pid_ns_prepare_proc+0x1e/0x90 [ 1015.257608] alloc_pid+0x8cf/0xa50 [ 1015.261142] ? __change_pid+0x410/0x410 [ 1015.265101] ? ns_capable_common+0x13f/0x170 [ 1015.269500] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1015.275035] ? memset+0x31/0x40 [ 1015.278304] ? copy_thread_tls+0x265/0x800 [ 1015.282530] copy_process.part.38+0x36bf/0x6ee0 [ 1015.287190] ? __lock_acquire+0x7f5/0x5130 [ 1015.291415] ? lock_acquire+0x1dc/0x520 [ 1015.295374] ? alloc_set_pte+0x1077/0x16a0 [ 1015.299605] ? __cleanup_sighand+0x70/0x70 [ 1015.303826] ? alloc_set_pte+0x1077/0x16a0 [ 1015.308066] ? print_usage_bug+0xc0/0xc0 [ 1015.312119] ? lock_downgrade+0x8e0/0x8e0 [ 1015.316261] ? debug_check_no_locks_freed+0x310/0x310 [ 1015.321448] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1015.326627] ? print_usage_bug+0xc0/0xc0 [ 1015.330686] ? debug_check_no_locks_freed+0x310/0x310 [ 1015.335865] ? __lock_acquire+0x7f5/0x5130 [ 1015.340095] ? debug_check_no_locks_freed+0x310/0x310 [ 1015.345273] ? perf_trace_lock+0xd6/0x900 [ 1015.349413] ? print_usage_bug+0xc0/0xc0 [ 1015.353463] ? zap_class+0x720/0x720 [ 1015.357167] ? perf_trace_lock+0xd6/0x900 [ 1015.361300] ? perf_trace_lock+0xd6/0x900 [ 1015.365435] ? graph_lock+0x170/0x170 [ 1015.369234] ? lock_acquire+0x1dc/0x520 [ 1015.373200] ? perf_trace_lock+0xd6/0x900 [ 1015.377341] ? zap_class+0x720/0x720 [ 1015.381045] ? find_held_lock+0x36/0x1c0 [ 1015.385098] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1015.390624] ? _parse_integer+0x13b/0x190 [ 1015.394763] ? graph_lock+0x170/0x170 [ 1015.398550] ? perf_trace_lock+0xd6/0x900 [ 1015.402680] ? _kstrtoull+0x180/0x230 [ 1015.406467] ? _parse_integer+0x190/0x190 [ 1015.410607] ? zap_class+0x720/0x720 [ 1015.414314] ? find_held_lock+0x36/0x1c0 [ 1015.418363] ? graph_lock+0x170/0x170 [ 1015.422158] ? perf_trace_lock+0xd6/0x900 [ 1015.426296] ? find_held_lock+0x36/0x1c0 [ 1015.430352] ? lock_downgrade+0x8e0/0x8e0 [ 1015.434488] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1015.440018] ? proc_fail_nth_write+0x96/0x1f0 [ 1015.444510] ? find_held_lock+0x36/0x1c0 [ 1015.448560] _do_fork+0x291/0x12a0 [ 1015.452091] ? fork_idle+0x1a0/0x1a0 [ 1015.455819] ? __sb_end_write+0xac/0xe0 [ 1015.459812] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1015.465330] ? fput+0x130/0x1a0 [ 1015.468596] ? ksys_write+0x1a6/0x250 [ 1015.472393] ? SyS_read+0x30/0x30 [ 1015.475831] ? mm_fault_error+0x380/0x380 [ 1015.479993] SyS_clone+0x37/0x50 [ 1015.483352] ? sys_vfork+0x30/0x30 [ 1015.486889] do_syscall_64+0x29e/0x9d0 [ 1015.490760] ? vmalloc_sync_all+0x30/0x30 [ 1015.494895] ? _raw_spin_unlock_irq+0x27/0x70 [ 1015.499376] ? finish_task_switch+0x1ca/0x820 [ 1015.503865] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1015.508780] ? syscall_return_slowpath+0x30f/0x5c0 [ 1015.513698] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1015.519052] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1015.523889] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1015.529062] RIP: 0033:0x455259 [ 1015.532235] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1015.539937] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1015.547192] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1015.554445] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1015.561700] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 2018/04/10 12:55:44 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:44 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000], 0x1}, 0x5}, 0x1c) [ 1015.568954] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000015 2018/04/10 12:55:44 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000040180008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:44 executing program 7 (fault-call:0 fault-nth:22): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) [ 1015.684374] FAULT_INJECTION: forcing a failure. [ 1015.684374] name failslab, interval 1, probability 0, space 0, times 0 [ 1015.695699] CPU: 0 PID: 32434 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1015.702647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1015.712025] Call Trace: [ 1015.714645] dump_stack+0x1b9/0x294 [ 1015.718302] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1015.723515] ? __save_stack_trace+0x7e/0xd0 [ 1015.727870] should_fail.cold.4+0xa/0x1a [ 1015.731948] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1015.737062] ? save_stack+0x43/0xd0 [ 1015.740678] ? kasan_kmalloc+0xc4/0xe0 [ 1015.744553] ? kmem_cache_alloc_trace+0x152/0x780 [ 1015.749391] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1015.754564] ? __list_lru_init+0x456/0x790 [ 1015.758784] ? sget_userns+0x6d9/0xf20 [ 1015.762672] ? graph_lock+0x170/0x170 [ 1015.766467] ? kern_mount_data+0x50/0xc0 [ 1015.770517] ? pid_ns_prepare_proc+0x1e/0x90 [ 1015.774911] ? alloc_pid+0x8cf/0xa50 [ 1015.778612] ? copy_process.part.38+0x36bf/0x6ee0 [ 1015.783438] ? _do_fork+0x291/0x12a0 [ 1015.787136] ? SyS_clone+0x37/0x50 [ 1015.790667] ? find_held_lock+0x36/0x1c0 [ 1015.794735] ? __lock_is_held+0xb5/0x140 [ 1015.798809] ? check_same_owner+0x320/0x320 [ 1015.803120] ? rcu_note_context_switch+0x710/0x710 [ 1015.808048] __should_failslab+0x124/0x180 [ 1015.812273] should_failslab+0x9/0x14 [ 1015.816064] kmem_cache_alloc_trace+0x2cb/0x780 [ 1015.820718] ? __kmalloc_node+0x33/0x70 [ 1015.824678] ? __kmalloc_node+0x33/0x70 [ 1015.828644] ? rcu_read_lock_sched_held+0x108/0x120 [ 1015.833657] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1015.838668] ? kvfree_rcu+0x20/0x20 [ 1015.842280] ? __kmalloc_node+0x47/0x70 [ 1015.846248] __list_lru_init+0x456/0x790 [ 1015.850303] ? list_lru_destroy+0x4c0/0x4c0 [ 1015.854620] ? mark_held_locks+0xc9/0x160 [ 1015.858763] ? __raw_spin_lock_init+0x1c/0x100 [ 1015.863330] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1015.868340] ? __lockdep_init_map+0x105/0x590 [ 1015.872830] ? lockdep_init_map+0x9/0x10 [ 1015.876879] sget_userns+0x6d9/0xf20 [ 1015.880579] ? set_anon_super+0x20/0x20 [ 1015.884554] ? get_empty_filp.cold.7+0x3e/0x3e [ 1015.889123] ? destroy_unused_super.part.9+0x100/0x100 [ 1015.894398] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1015.899415] ? zap_class+0x720/0x720 [ 1015.903132] ? kmem_cache_alloc+0x12e/0x760 [ 1015.907459] ? copy_process.part.38+0x36bf/0x6ee0 [ 1015.912299] ? graph_lock+0x170/0x170 [ 1015.916109] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1015.921652] mount_ns+0x8f/0x1d0 [ 1015.925014] ? proc_get_inode+0x670/0x670 [ 1015.929167] proc_mount+0x73/0xa0 [ 1015.932616] mount_fs+0xae/0x328 [ 1015.935977] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1015.940551] ? may_umount+0xb0/0xb0 [ 1015.944166] ? kasan_check_read+0x11/0x20 [ 1015.948302] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1015.952697] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1015.957268] ? idr_alloc+0x1a0/0x1a0 [ 1015.960975] kern_mount_data+0x50/0xc0 [ 1015.964854] pid_ns_prepare_proc+0x1e/0x90 [ 1015.969078] alloc_pid+0x8cf/0xa50 [ 1015.972611] ? __change_pid+0x410/0x410 [ 1015.976570] ? ns_capable_common+0x13f/0x170 [ 1015.980975] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1015.986503] ? memset+0x31/0x40 [ 1015.989772] ? copy_thread_tls+0x265/0x800 [ 1015.994087] copy_process.part.38+0x36bf/0x6ee0 [ 1015.998748] ? __lock_acquire+0x7f5/0x5130 [ 1016.002978] ? lock_acquire+0x1dc/0x520 [ 1016.006944] ? alloc_set_pte+0x1077/0x16a0 [ 1016.011174] ? __cleanup_sighand+0x70/0x70 [ 1016.015394] ? alloc_set_pte+0x1077/0x16a0 [ 1016.019636] ? print_usage_bug+0xc0/0xc0 [ 1016.023695] ? lock_downgrade+0x8e0/0x8e0 [ 1016.027840] ? debug_check_no_locks_freed+0x310/0x310 [ 1016.033044] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1016.038226] ? print_usage_bug+0xc0/0xc0 [ 1016.042287] ? debug_check_no_locks_freed+0x310/0x310 [ 1016.047464] ? __lock_acquire+0x7f5/0x5130 [ 1016.051688] ? debug_check_no_locks_freed+0x310/0x310 [ 1016.056884] ? perf_trace_lock+0xd6/0x900 [ 1016.061033] ? print_usage_bug+0xc0/0xc0 [ 1016.065088] ? zap_class+0x720/0x720 [ 1016.068788] ? perf_trace_lock+0xd6/0x900 [ 1016.072927] ? perf_trace_lock+0xd6/0x900 [ 1016.077072] ? graph_lock+0x170/0x170 [ 1016.080885] ? lock_acquire+0x1dc/0x520 [ 1016.084848] ? perf_trace_lock+0xd6/0x900 [ 1016.088999] ? zap_class+0x720/0x720 [ 1016.092712] ? find_held_lock+0x36/0x1c0 [ 1016.096758] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1016.102302] ? _parse_integer+0x13b/0x190 [ 1016.106447] ? graph_lock+0x170/0x170 [ 1016.110236] ? perf_trace_lock+0xd6/0x900 [ 1016.114368] ? _kstrtoull+0x180/0x230 [ 1016.118155] ? _parse_integer+0x190/0x190 [ 1016.122297] ? zap_class+0x720/0x720 [ 1016.126007] ? find_held_lock+0x36/0x1c0 [ 1016.130061] ? graph_lock+0x170/0x170 [ 1016.133857] ? perf_trace_lock+0xd6/0x900 [ 1016.137996] ? find_held_lock+0x36/0x1c0 [ 1016.142057] ? lock_downgrade+0x8e0/0x8e0 [ 1016.146203] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1016.151741] ? proc_fail_nth_write+0x96/0x1f0 [ 1016.156228] ? find_held_lock+0x36/0x1c0 [ 1016.160277] _do_fork+0x291/0x12a0 [ 1016.163811] ? fork_idle+0x1a0/0x1a0 [ 1016.167528] ? __sb_end_write+0xac/0xe0 [ 1016.171497] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1016.177027] ? fput+0x130/0x1a0 [ 1016.180298] ? ksys_write+0x1a6/0x250 [ 1016.184090] ? SyS_read+0x30/0x30 [ 1016.187531] ? mm_fault_error+0x380/0x380 [ 1016.191668] SyS_clone+0x37/0x50 [ 1016.195026] ? sys_vfork+0x30/0x30 [ 1016.198556] do_syscall_64+0x29e/0x9d0 [ 1016.202429] ? vmalloc_sync_all+0x30/0x30 [ 1016.206564] ? _raw_spin_unlock_irq+0x27/0x70 [ 1016.211053] ? finish_task_switch+0x1ca/0x820 [ 1016.215543] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1016.220462] ? syscall_return_slowpath+0x30f/0x5c0 [ 1016.225382] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1016.230747] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1016.235584] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1016.240761] RIP: 0033:0x455259 [ 1016.243934] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1016.251630] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1016.258883] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1016.266139] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1016.273395] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 2018/04/10 12:55:44 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:45 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000001001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:45 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000], 0x1}, 0x5}, 0x1c) [ 1016.280654] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000016 2018/04/10 12:55:45 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840000000000000000000ff", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 1016.393166] binder: 32450 RLIMIT_NICE not set [ 1017.195282] binder: 32450 RLIMIT_NICE not set [ 1017.202238] binder: BINDER_SET_CONTEXT_MGR already set [ 1017.207705] binder: 32449:32450 ioctl c0306201 20004000 returned -14 [ 1017.209095] binder: 32449:32460 ioctl 40046207 0 returned -16 [ 1017.224918] binder_alloc: 32449: binder_alloc_buf, no vma [ 1017.230540] binder_alloc: 32449: binder_alloc_buf, no vma [ 1017.230561] binder: 32449:32460 transaction failed 29189/-3, size 0-0 line 2963 [ 1017.236151] binder: 32449:32462 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:55:46 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000018001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:46 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x4000}}, 0x14) 2018/04/10 12:55:46 executing program 7 (fault-call:0 fault-nth:23): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:46 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x3, 0x0) 2018/04/10 12:55:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000001", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:46 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:46 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa6050000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:46 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 1017.361667] binder: undelivered TRANSACTION_ERROR: 29189 [ 1017.367215] binder: undelivered TRANSACTION_ERROR: 29189 [ 1017.385007] binder: release 32449:32450 transaction 789 out, still active [ 1017.392060] binder: release 32449:32450 transaction 788 in, still active [ 1017.397262] FAULT_INJECTION: forcing a failure. [ 1017.397262] name failslab, interval 1, probability 0, space 0, times 0 [ 1017.398949] binder: undelivered TRANSACTION_COMPLETE [ 1017.410186] CPU: 0 PID: 32471 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1017.415530] binder: release 32449:32460 transaction 788 out, still active [ 1017.422319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1017.422326] Call Trace: [ 1017.422349] dump_stack+0x1b9/0x294 [ 1017.422370] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1017.429311] binder: undelivered TRANSACTION_COMPLETE [ 1017.438633] ? __save_stack_trace+0x7e/0xd0 [ 1017.438672] should_fail.cold.4+0xa/0x1a [ 1017.441440] binder: send failed reply for transaction 789, target dead [ 1017.444853] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1017.444870] ? save_stack+0x43/0xd0 [ 1017.444886] ? kasan_kmalloc+0xc4/0xe0 [ 1017.450073] binder: send failed reply for transaction 788, target dead [ 1017.455134] ? kmem_cache_alloc_trace+0x152/0x780 [ 1017.455150] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1017.455166] ? __list_lru_init+0x456/0x790 [ 1017.476639] binder: 32477 RLIMIT_NICE not set [ 1017.478888] ? sget_userns+0x6d9/0xf20 [ 1017.478909] ? graph_lock+0x170/0x170 [ 1017.478924] ? kern_mount_data+0x50/0xc0 [ 1017.478938] ? pid_ns_prepare_proc+0x1e/0x90 [ 1017.478954] ? alloc_pid+0x8cf/0xa50 [ 1017.527923] ? copy_process.part.38+0x36bf/0x6ee0 [ 1017.532750] ? _do_fork+0x291/0x12a0 [ 1017.536445] ? SyS_clone+0x37/0x50 [ 1017.539969] ? find_held_lock+0x36/0x1c0 [ 1017.544035] ? __lock_is_held+0xb5/0x140 [ 1017.548088] ? check_same_owner+0x320/0x320 [ 1017.552393] ? rcu_note_context_switch+0x710/0x710 [ 1017.557308] __should_failslab+0x124/0x180 [ 1017.561541] should_failslab+0x9/0x14 [ 1017.565323] kmem_cache_alloc_trace+0x2cb/0x780 [ 1017.569991] ? __kmalloc_node+0x33/0x70 [ 1017.573951] ? __kmalloc_node+0x33/0x70 [ 1017.577917] ? rcu_read_lock_sched_held+0x108/0x120 [ 1017.582921] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1017.587925] ? kvfree_rcu+0x20/0x20 [ 1017.591543] ? __kmalloc_node+0x47/0x70 [ 1017.595507] __list_lru_init+0x456/0x790 [ 1017.599556] ? list_lru_destroy+0x4c0/0x4c0 [ 1017.603859] ? mark_held_locks+0xc9/0x160 [ 1017.607991] ? __raw_spin_lock_init+0x1c/0x100 [ 1017.612563] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1017.617560] ? __lockdep_init_map+0x105/0x590 [ 1017.622039] ? lockdep_init_map+0x9/0x10 [ 1017.626084] sget_userns+0x6d9/0xf20 [ 1017.629781] ? set_anon_super+0x20/0x20 [ 1017.633738] ? get_empty_filp.cold.7+0x3e/0x3e [ 1017.638303] ? destroy_unused_super.part.9+0x100/0x100 [ 1017.643565] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1017.648566] ? save_stack+0x43/0xd0 [ 1017.652173] ? kasan_kmalloc+0xc4/0xe0 [ 1017.656046] ? kasan_slab_alloc+0x12/0x20 [ 1017.660173] ? kmem_cache_alloc+0x12e/0x760 [ 1017.664484] ? copy_process.part.38+0x36bf/0x6ee0 [ 1017.669314] ? graph_lock+0x170/0x170 [ 1017.673100] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1017.680101] mount_ns+0x8f/0x1d0 [ 1017.683472] ? proc_get_inode+0x670/0x670 [ 1017.687611] proc_mount+0x73/0xa0 [ 1017.691050] mount_fs+0xae/0x328 [ 1017.694404] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1017.698973] ? may_umount+0xb0/0xb0 [ 1017.702582] ? kasan_check_read+0x11/0x20 [ 1017.706712] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1017.711101] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1017.715666] ? idr_alloc+0x1a0/0x1a0 [ 1017.719365] kern_mount_data+0x50/0xc0 [ 1017.723233] pid_ns_prepare_proc+0x1e/0x90 [ 1017.727450] alloc_pid+0x8cf/0xa50 [ 1017.730975] ? __change_pid+0x410/0x410 [ 1017.734930] ? ns_capable_common+0x13f/0x170 [ 1017.739322] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1017.744841] ? memset+0x31/0x40 [ 1017.748105] ? copy_thread_tls+0x265/0x800 [ 1017.752324] copy_process.part.38+0x36bf/0x6ee0 [ 1017.756978] ? __lock_acquire+0x7f5/0x5130 [ 1017.761197] ? lock_acquire+0x1dc/0x520 [ 1017.765151] ? alloc_set_pte+0x1077/0x16a0 [ 1017.769375] ? __cleanup_sighand+0x70/0x70 [ 1017.773593] ? alloc_set_pte+0x1077/0x16a0 [ 1017.777817] ? print_usage_bug+0xc0/0xc0 [ 1017.781868] ? lock_downgrade+0x8e0/0x8e0 [ 1017.786011] ? debug_check_no_locks_freed+0x310/0x310 [ 1017.791212] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1017.796390] ? print_usage_bug+0xc0/0xc0 [ 1017.800448] ? debug_check_no_locks_freed+0x310/0x310 [ 1017.805623] ? __lock_acquire+0x7f5/0x5130 [ 1017.809846] ? debug_check_no_locks_freed+0x310/0x310 [ 1017.815036] ? print_usage_bug+0xc0/0xc0 [ 1017.819101] ? print_usage_bug+0xc0/0xc0 [ 1017.823161] ? graph_lock+0x170/0x170 [ 1017.826948] ? lock_acquire+0x1dc/0x520 [ 1017.830916] ? __fdget_pos+0x1a9/0x1e0 [ 1017.834788] ? graph_lock+0x170/0x170 [ 1017.838573] ? __lock_acquire+0x7f5/0x5130 [ 1017.842792] ? find_held_lock+0x36/0x1c0 [ 1017.846839] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1017.852360] ? _parse_integer+0x13b/0x190 [ 1017.856490] ? graph_lock+0x170/0x170 [ 1017.860274] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1017.865798] ? _kstrtoull+0x180/0x230 [ 1017.869583] ? _parse_integer+0x190/0x190 [ 1017.873714] ? graph_lock+0x170/0x170 [ 1017.877496] ? lock_release+0xa10/0xa10 [ 1017.881453] ? check_same_owner+0x320/0x320 [ 1017.885758] ? find_held_lock+0x36/0x1c0 [ 1017.889803] ? graph_lock+0x170/0x170 [ 1017.893586] ? lock_downgrade+0x8e0/0x8e0 [ 1017.897721] ? find_held_lock+0x36/0x1c0 [ 1017.901773] ? lock_downgrade+0x8e0/0x8e0 [ 1017.905908] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1017.911429] ? proc_fail_nth_write+0x96/0x1f0 [ 1017.915907] ? proc_cwd_link+0x1d0/0x1d0 [ 1017.919953] ? find_held_lock+0x36/0x1c0 [ 1017.924000] _do_fork+0x291/0x12a0 [ 1017.927537] ? fork_idle+0x1a0/0x1a0 [ 1017.931237] ? __lock_is_held+0xb5/0x140 [ 1017.935286] ? __sb_end_write+0xac/0xe0 [ 1017.939244] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1017.944768] ? fput+0x130/0x1a0 [ 1017.948036] ? ksys_write+0x1a6/0x250 [ 1017.951822] ? SyS_read+0x30/0x30 [ 1017.955259] ? mm_fault_error+0x380/0x380 [ 1017.959395] SyS_clone+0x37/0x50 [ 1017.962741] ? sys_vfork+0x30/0x30 [ 1017.966267] do_syscall_64+0x29e/0x9d0 [ 1017.970137] ? vmalloc_sync_all+0x30/0x30 [ 1017.974270] ? _raw_spin_unlock_irq+0x27/0x70 [ 1017.978758] ? finish_task_switch+0x1ca/0x820 [ 1017.983249] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1017.988164] ? syscall_return_slowpath+0x30f/0x5c0 [ 1017.993079] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1017.998429] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1018.003257] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1018.008426] RIP: 0033:0x455259 2018/04/10 12:55:46 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000000000ff3f0008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1018.011594] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1018.019283] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1018.026531] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1018.033781] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1018.041035] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1018.048287] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000017 2018/04/10 12:55:46 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:46 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:46 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000018400008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:46 executing program 7 (fault-call:0 fault-nth:24): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2800], 0x1}, 0x5}, 0x1c) [ 1018.170303] FAULT_INJECTION: forcing a failure. [ 1018.170303] name failslab, interval 1, probability 0, space 0, times 0 [ 1018.181632] CPU: 0 PID: 32494 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1018.188563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1018.197919] Call Trace: [ 1018.200522] dump_stack+0x1b9/0x294 [ 1018.204165] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1018.209376] ? __save_stack_trace+0x7e/0xd0 [ 1018.213719] should_fail.cold.4+0xa/0x1a 2018/04/10 12:55:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a6], 0x1}, 0x5}, 0x1c) [ 1018.217856] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1018.222987] ? save_stack+0x43/0xd0 [ 1018.226634] ? kasan_kmalloc+0xc4/0xe0 [ 1018.230535] ? kmem_cache_alloc_trace+0x152/0x780 [ 1018.235409] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1018.240622] ? __list_lru_init+0x456/0x790 [ 1018.244887] ? sget_userns+0x6d9/0xf20 [ 1018.248792] ? graph_lock+0x170/0x170 [ 1018.252646] ? kern_mount_data+0x50/0xc0 [ 1018.256730] ? pid_ns_prepare_proc+0x1e/0x90 [ 1018.261150] ? alloc_pid+0x8cf/0xa50 [ 1018.264874] ? copy_process.part.38+0x36bf/0x6ee0 [ 1018.269741] ? _do_fork+0x291/0x12a0 [ 1018.273472] ? SyS_clone+0x37/0x50 [ 1018.277045] ? find_held_lock+0x36/0x1c0 [ 1018.281126] ? __lock_is_held+0xb5/0x140 [ 1018.285226] ? check_same_owner+0x320/0x320 [ 1018.289606] ? rcu_note_context_switch+0x710/0x710 [ 1018.294555] __should_failslab+0x124/0x180 [ 1018.298820] should_failslab+0x9/0x14 [ 1018.302649] kmem_cache_alloc_trace+0x2cb/0x780 [ 1018.302843] binder_alloc: 32476: binder_alloc_buf, no vma [ 1018.307335] ? __kmalloc_node+0x33/0x70 [ 1018.307355] ? __kmalloc_node+0x33/0x70 2018/04/10 12:55:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdef], 0x1}, 0x5}, 0x1c) [ 1018.307379] ? rcu_read_lock_sched_held+0x108/0x120 [ 1018.307404] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1018.307430] ? kvfree_rcu+0x20/0x20 [ 1018.307457] ? __kmalloc_node+0x47/0x70 [ 1018.313087] binder: 32476:32507 transaction failed 29189/-3, size 0-0 line 2963 [ 1018.316958] __list_lru_init+0x456/0x790 [ 1018.316976] ? list_lru_destroy+0x4c0/0x4c0 [ 1018.316989] ? mark_held_locks+0xc9/0x160 [ 1018.317008] ? __raw_spin_lock_init+0x1c/0x100 [ 1018.363067] ? trace_hardirqs_on_caller+0x421/0x5c0 2018/04/10 12:55:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa605000000000000], 0x1}, 0x5}, 0x1c) [ 1018.368105] ? __lockdep_init_map+0x105/0x590 [ 1018.372616] ? lockdep_init_map+0x9/0x10 [ 1018.376693] sget_userns+0x6d9/0xf20 [ 1018.380418] ? set_anon_super+0x20/0x20 [ 1018.384413] ? get_empty_filp.cold.7+0x3e/0x3e [ 1018.389001] ? destroy_unused_super.part.9+0x100/0x100 [ 1018.394295] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1018.399329] ? save_stack+0x43/0xd0 [ 1018.402959] ? kasan_kmalloc+0xc4/0xe0 [ 1018.406855] ? kasan_slab_alloc+0x12/0x20 [ 1018.411003] ? kmem_cache_alloc+0x12e/0x760 [ 1018.415331] ? copy_process.part.38+0x36bf/0x6ee0 [ 1018.420189] ? graph_lock+0x170/0x170 [ 1018.424001] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1018.429552] mount_ns+0x8f/0x1d0 [ 1018.432925] ? proc_get_inode+0x670/0x670 [ 1018.437083] proc_mount+0x73/0xa0 [ 1018.440548] mount_fs+0xae/0x328 [ 1018.442490] binder: BINDER_SET_CONTEXT_MGR already set [ 1018.443924] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1018.443943] ? may_umount+0xb0/0xb0 [ 1018.443958] ? kasan_check_read+0x11/0x20 [ 1018.443974] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1018.443987] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1018.444001] ? idr_alloc+0x1a0/0x1a0 [ 1018.444022] kern_mount_data+0x50/0xc0 [ 1018.461876] binder: 32476:32517 ioctl 40046207 0 returned -16 [ 1018.466002] pid_ns_prepare_proc+0x1e/0x90 [ 1018.466018] alloc_pid+0x8cf/0xa50 [ 1018.466038] ? __change_pid+0x410/0x410 [ 1018.466052] ? ns_capable_common+0x13f/0x170 [ 1018.466070] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1018.466089] ? memset+0x31/0x40 [ 1018.493524] binder_alloc: 32476: binder_alloc_buf, no vma [ 1018.496370] ? copy_thread_tls+0x265/0x800 [ 1018.496393] copy_process.part.38+0x36bf/0x6ee0 [ 1018.496409] ? __lock_acquire+0x7f5/0x5130 [ 1018.496427] ? lock_acquire+0x1dc/0x520 [ 1018.496445] ? alloc_set_pte+0x1077/0x16a0 [ 1018.500894] binder: 32476:32503 transaction failed 29189/-3, size 0-0 line 2963 [ 1018.506376] ? __cleanup_sighand+0x70/0x70 [ 1018.506391] ? alloc_set_pte+0x1077/0x16a0 [ 1018.506410] ? print_usage_bug+0xc0/0xc0 [ 1018.506430] ? lock_downgrade+0x8e0/0x8e0 [ 1018.510150] binder_alloc: 32476: binder_alloc_buf, no vma [ 1018.515217] ? debug_check_no_locks_freed+0x310/0x310 [ 1018.515234] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1018.515249] ? print_usage_bug+0xc0/0xc0 [ 1018.515275] ? debug_check_no_locks_freed+0x310/0x310 [ 1018.515290] ? __lock_acquire+0x7f5/0x5130 [ 1018.515305] ? debug_check_no_locks_freed+0x310/0x310 [ 1018.515326] ? print_usage_bug+0xc0/0xc0 [ 1018.519648] binder: 32476:32507 transaction failed 29189/-3, size 0-0 line 2963 [ 1018.524189] ? print_usage_bug+0xc0/0xc0 [ 1018.524206] ? graph_lock+0x170/0x170 [ 1018.524223] ? lock_acquire+0x1dc/0x520 [ 1018.524237] ? __fdget_pos+0x1a9/0x1e0 [ 1018.524255] ? graph_lock+0x170/0x170 [ 1018.626167] ? __lock_acquire+0x7f5/0x5130 [ 1018.630390] ? find_held_lock+0x36/0x1c0 [ 1018.634439] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1018.639960] ? _parse_integer+0x13b/0x190 [ 1018.644094] ? graph_lock+0x170/0x170 [ 1018.647882] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1018.653401] ? _kstrtoull+0x180/0x230 [ 1018.657187] ? _parse_integer+0x190/0x190 [ 1018.661321] ? graph_lock+0x170/0x170 [ 1018.665104] ? lock_release+0xa10/0xa10 [ 1018.669062] ? check_same_owner+0x320/0x320 [ 1018.673369] ? find_held_lock+0x36/0x1c0 [ 1018.677418] ? graph_lock+0x170/0x170 [ 1018.681211] ? lock_downgrade+0x8e0/0x8e0 [ 1018.685350] ? find_held_lock+0x36/0x1c0 [ 1018.689405] ? lock_downgrade+0x8e0/0x8e0 [ 1018.693543] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1018.699065] ? proc_fail_nth_write+0x96/0x1f0 [ 1018.703547] ? proc_cwd_link+0x1d0/0x1d0 [ 1018.707600] ? find_held_lock+0x36/0x1c0 [ 1018.711648] _do_fork+0x291/0x12a0 [ 1018.715188] ? fork_idle+0x1a0/0x1a0 [ 1018.718888] ? __lock_is_held+0xb5/0x140 [ 1018.722944] ? __sb_end_write+0xac/0xe0 [ 1018.726907] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1018.732429] ? fput+0x130/0x1a0 [ 1018.735703] ? ksys_write+0x1a6/0x250 [ 1018.739490] ? SyS_read+0x30/0x30 [ 1018.742927] ? mm_fault_error+0x380/0x380 [ 1018.747064] SyS_clone+0x37/0x50 [ 1018.750413] ? sys_vfork+0x30/0x30 [ 1018.753941] do_syscall_64+0x29e/0x9d0 [ 1018.757813] ? vmalloc_sync_all+0x30/0x30 [ 1018.761948] ? _raw_spin_unlock_irq+0x27/0x70 [ 1018.766430] ? finish_task_switch+0x1ca/0x820 [ 1018.770910] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1018.775825] ? syscall_return_slowpath+0x30f/0x5c0 [ 1018.780751] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1018.786106] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1018.790940] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1018.796113] RIP: 0033:0x455259 [ 1018.799284] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1018.806980] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1018.814233] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 2018/04/10 12:55:47 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0xb00000000000000}}, 0x14) 2018/04/10 12:55:47 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0xa, 0x0) 2018/04/10 12:55:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000], 0x1}, 0x5}, 0x1c) [ 1018.821486] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1018.828742] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1018.835998] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000018 [ 1018.905330] binder: undelivered TRANSACTION_ERROR: 29189 [ 1018.910934] binder: undelivered TRANSACTION_ERROR: 29189 [ 1018.946139] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:48 executing program 7 (fault-call:0 fault-nth:25): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:48 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:48 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000003000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:48 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x4, 0x0) 2018/04/10 12:55:48 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:48 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840000000000000fffffdfd", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:48 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x2}}, 0x14) [ 1019.927210] FAULT_INJECTION: forcing a failure. [ 1019.927210] name failslab, interval 1, probability 0, space 0, times 0 [ 1019.938593] CPU: 0 PID: 32540 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1019.945530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1019.954905] Call Trace: [ 1019.957510] dump_stack+0x1b9/0x294 [ 1019.961151] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1019.966357] ? __save_stack_trace+0x7e/0xd0 [ 1019.970696] should_fail.cold.4+0xa/0x1a [ 1019.974794] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1019.979900] ? save_stack+0x43/0xd0 [ 1019.983520] ? kasan_kmalloc+0xc4/0xe0 [ 1019.987396] ? kmem_cache_alloc_trace+0x152/0x780 [ 1019.992226] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1019.997399] ? __list_lru_init+0x456/0x790 [ 1020.001616] ? sget_userns+0x6d9/0xf20 [ 1020.005488] ? graph_lock+0x170/0x170 [ 1020.009275] ? kern_mount_data+0x50/0xc0 [ 1020.013320] ? pid_ns_prepare_proc+0x1e/0x90 [ 1020.017716] ? alloc_pid+0x8cf/0xa50 [ 1020.021410] ? copy_process.part.38+0x36bf/0x6ee0 [ 1020.026236] ? _do_fork+0x291/0x12a0 [ 1020.029931] ? SyS_clone+0x37/0x50 [ 1020.033458] ? find_held_lock+0x36/0x1c0 [ 1020.037509] ? __lock_is_held+0xb5/0x140 [ 1020.041568] ? check_same_owner+0x320/0x320 [ 1020.045877] ? rcu_note_context_switch+0x710/0x710 [ 1020.050827] __should_failslab+0x124/0x180 [ 1020.055054] should_failslab+0x9/0x14 [ 1020.058839] kmem_cache_alloc_trace+0x2cb/0x780 [ 1020.063492] ? __kmalloc_node+0x33/0x70 [ 1020.067448] ? __kmalloc_node+0x33/0x70 [ 1020.071412] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1020.076414] ? kvfree_rcu+0x20/0x20 [ 1020.080033] ? __kmalloc_node+0x47/0x70 [ 1020.084001] __list_lru_init+0x456/0x790 [ 1020.088056] ? list_lru_destroy+0x4c0/0x4c0 [ 1020.092365] ? mark_held_locks+0xc9/0x160 [ 1020.096501] ? __raw_spin_lock_init+0x1c/0x100 [ 1020.101065] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1020.106065] ? __lockdep_init_map+0x105/0x590 [ 1020.110550] ? lockdep_init_map+0x9/0x10 [ 1020.114598] sget_userns+0x6d9/0xf20 [ 1020.118294] ? set_anon_super+0x20/0x20 [ 1020.122255] ? get_empty_filp.cold.7+0x3e/0x3e [ 1020.126820] ? destroy_unused_super.part.9+0x100/0x100 [ 1020.132085] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1020.137088] ? save_stack+0x43/0xd0 [ 1020.140700] ? kasan_kmalloc+0xc4/0xe0 [ 1020.144569] ? kasan_slab_alloc+0x12/0x20 [ 1020.148709] ? kmem_cache_alloc+0x12e/0x760 [ 1020.153019] ? copy_process.part.38+0x36bf/0x6ee0 [ 1020.157858] ? graph_lock+0x170/0x170 [ 1020.161642] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1020.167166] mount_ns+0x8f/0x1d0 [ 1020.170518] ? proc_get_inode+0x670/0x670 [ 1020.174662] proc_mount+0x73/0xa0 [ 1020.178099] mount_fs+0xae/0x328 [ 1020.181454] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1020.186028] ? may_umount+0xb0/0xb0 [ 1020.189640] ? kasan_check_read+0x11/0x20 [ 1020.193772] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1020.198162] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1020.202727] ? idr_alloc+0x1a0/0x1a0 [ 1020.206425] kern_mount_data+0x50/0xc0 [ 1020.210299] pid_ns_prepare_proc+0x1e/0x90 [ 1020.214514] alloc_pid+0x8cf/0xa50 [ 1020.218045] ? __change_pid+0x410/0x410 [ 1020.222001] ? ns_capable_common+0x13f/0x170 [ 1020.226403] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1020.231922] ? memset+0x31/0x40 [ 1020.235187] ? copy_thread_tls+0x265/0x800 [ 1020.239411] copy_process.part.38+0x36bf/0x6ee0 [ 1020.244066] ? __lock_acquire+0x7f5/0x5130 [ 1020.248288] ? lock_acquire+0x1dc/0x520 [ 1020.252248] ? alloc_set_pte+0x1077/0x16a0 [ 1020.256478] ? __cleanup_sighand+0x70/0x70 [ 1020.260696] ? alloc_set_pte+0x1077/0x16a0 [ 1020.264918] ? print_usage_bug+0xc0/0xc0 [ 1020.268964] ? lock_downgrade+0x8e0/0x8e0 [ 1020.273099] ? debug_check_no_locks_freed+0x310/0x310 [ 1020.278275] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1020.283794] ? print_usage_bug+0xc0/0xc0 [ 1020.287848] ? debug_check_no_locks_freed+0x310/0x310 [ 1020.293031] ? __lock_acquire+0x7f5/0x5130 [ 1020.297253] ? debug_check_no_locks_freed+0x310/0x310 [ 1020.302433] ? print_usage_bug+0xc0/0xc0 [ 1020.306478] ? print_usage_bug+0xc0/0xc0 [ 1020.310523] ? graph_lock+0x170/0x170 [ 1020.314324] ? lock_acquire+0x1dc/0x520 [ 1020.318285] ? __fdget_pos+0x1a9/0x1e0 [ 1020.322157] ? graph_lock+0x170/0x170 [ 1020.325953] ? __lock_acquire+0x7f5/0x5130 [ 1020.330169] ? find_held_lock+0x36/0x1c0 [ 1020.334227] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1020.339749] ? _parse_integer+0x13b/0x190 [ 1020.343883] ? graph_lock+0x170/0x170 [ 1020.347668] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1020.353186] ? _kstrtoull+0x180/0x230 [ 1020.356974] ? _parse_integer+0x190/0x190 [ 1020.361104] ? graph_lock+0x170/0x170 [ 1020.364885] ? lock_release+0xa10/0xa10 [ 1020.368841] ? check_same_owner+0x320/0x320 [ 1020.373144] ? find_held_lock+0x36/0x1c0 [ 1020.377189] ? graph_lock+0x170/0x170 [ 1020.380975] ? lock_downgrade+0x8e0/0x8e0 [ 1020.385110] ? find_held_lock+0x36/0x1c0 [ 1020.389161] ? lock_downgrade+0x8e0/0x8e0 [ 1020.393294] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1020.398812] ? proc_fail_nth_write+0x96/0x1f0 [ 1020.403293] ? proc_cwd_link+0x1d0/0x1d0 [ 1020.407342] ? find_held_lock+0x36/0x1c0 [ 1020.411389] _do_fork+0x291/0x12a0 [ 1020.414917] ? fork_idle+0x1a0/0x1a0 [ 1020.418615] ? __lock_is_held+0xb5/0x140 [ 1020.422669] ? __sb_end_write+0xac/0xe0 [ 1020.426639] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1020.432156] ? fput+0x130/0x1a0 [ 1020.435419] ? ksys_write+0x1a6/0x250 [ 1020.439206] ? SyS_read+0x30/0x30 [ 1020.442645] ? mm_fault_error+0x380/0x380 [ 1020.446780] SyS_clone+0x37/0x50 [ 1020.450130] ? sys_vfork+0x30/0x30 [ 1020.453665] do_syscall_64+0x29e/0x9d0 [ 1020.457538] ? vmalloc_sync_all+0x30/0x30 [ 1020.461669] ? _raw_spin_unlock_irq+0x27/0x70 [ 1020.466147] ? finish_task_switch+0x1ca/0x820 [ 1020.470629] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1020.475544] ? syscall_return_slowpath+0x30f/0x5c0 [ 1020.480460] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1020.486607] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1020.491445] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1020.496618] RIP: 0033:0x455259 [ 1020.499791] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1020.507484] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1020.514735] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1020.521984] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 2018/04/10 12:55:49 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:49 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000004000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1020.529238] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1020.536487] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000019 [ 1020.553999] binder: 32550 RLIMIT_NICE not set 2018/04/10 12:55:50 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:50 executing program 7 (fault-call:0 fault-nth:26): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:50 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000002000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:50 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:50 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x200000000000000}}, 0x14) 2018/04/10 12:55:50 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e8]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:50 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0xfffffdef, 0x0) 2018/04/10 12:55:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="11634840000000000000fdfdffff", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) [ 1021.610945] FAULT_INJECTION: forcing a failure. [ 1021.610945] name failslab, interval 1, probability 0, space 0, times 0 [ 1021.622418] CPU: 0 PID: 32574 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1021.629466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1021.632260] binder: 32583 RLIMIT_NICE not set [ 1021.638822] Call Trace: [ 1021.638851] dump_stack+0x1b9/0x294 [ 1021.638871] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1021.638896] ? __save_stack_trace+0x7e/0xd0 [ 1021.659092] should_fail.cold.4+0xa/0x1a [ 1021.663180] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1021.668277] ? save_stack+0x43/0xd0 [ 1021.671884] ? kasan_kmalloc+0xc4/0xe0 [ 1021.675754] ? kmem_cache_alloc_trace+0x152/0x780 [ 1021.680582] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1021.685768] ? __list_lru_init+0x456/0x790 [ 1021.690061] ? sget_userns+0x6d9/0xf20 [ 1021.693935] ? graph_lock+0x170/0x170 [ 1021.697720] ? kern_mount_data+0x50/0xc0 [ 1021.701798] ? pid_ns_prepare_proc+0x1e/0x90 [ 1021.706192] ? alloc_pid+0x8cf/0xa50 [ 1021.709891] ? copy_process.part.38+0x36bf/0x6ee0 [ 1021.714716] ? _do_fork+0x291/0x12a0 [ 1021.718432] ? SyS_clone+0x37/0x50 [ 1021.721965] ? find_held_lock+0x36/0x1c0 [ 1021.726021] ? __lock_is_held+0xb5/0x140 [ 1021.730079] ? check_same_owner+0x320/0x320 [ 1021.734392] ? rcu_note_context_switch+0x710/0x710 [ 1021.739316] __should_failslab+0x124/0x180 [ 1021.743539] should_failslab+0x9/0x14 [ 1021.747327] kmem_cache_alloc_trace+0x2cb/0x780 [ 1021.751988] ? __kmalloc_node+0x33/0x70 [ 1021.755950] ? __kmalloc_node+0x33/0x70 [ 1021.759919] ? rcu_read_lock_sched_held+0x108/0x120 [ 1021.764926] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1021.769927] ? kvfree_rcu+0x20/0x20 [ 1021.773541] ? __kmalloc_node+0x47/0x70 [ 1021.777503] __list_lru_init+0x456/0x790 [ 1021.781556] ? list_lru_destroy+0x4c0/0x4c0 [ 1021.785867] ? mark_held_locks+0xc9/0x160 [ 1021.790028] ? __raw_spin_lock_init+0x1c/0x100 [ 1021.794603] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1021.799602] ? __lockdep_init_map+0x105/0x590 [ 1021.804090] ? lockdep_init_map+0x9/0x10 [ 1021.808140] sget_userns+0x6d9/0xf20 [ 1021.811834] ? set_anon_super+0x20/0x20 [ 1021.815794] ? get_empty_filp.cold.7+0x3e/0x3e [ 1021.820363] ? destroy_unused_super.part.9+0x100/0x100 [ 1021.825640] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1021.830648] ? save_stack+0x43/0xd0 [ 1021.834258] ? kasan_kmalloc+0xc4/0xe0 [ 1021.838130] ? kasan_slab_alloc+0x12/0x20 [ 1021.842263] ? kmem_cache_alloc+0x12e/0x760 [ 1021.846568] ? copy_process.part.38+0x36bf/0x6ee0 [ 1021.851406] ? graph_lock+0x170/0x170 [ 1021.855198] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1021.860729] mount_ns+0x8f/0x1d0 [ 1021.864084] ? proc_get_inode+0x670/0x670 [ 1021.868218] proc_mount+0x73/0xa0 [ 1021.871655] mount_fs+0xae/0x328 [ 1021.875018] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1021.879593] ? may_umount+0xb0/0xb0 [ 1021.883205] ? kasan_check_read+0x11/0x20 [ 1021.887337] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1021.891731] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1021.896296] ? idr_alloc+0x1a0/0x1a0 [ 1021.899996] kern_mount_data+0x50/0xc0 [ 1021.903875] pid_ns_prepare_proc+0x1e/0x90 [ 1021.908094] alloc_pid+0x8cf/0xa50 [ 1021.911635] ? __change_pid+0x410/0x410 [ 1021.915593] ? ns_capable_common+0x13f/0x170 [ 1021.919987] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1021.925512] ? memset+0x31/0x40 [ 1021.928778] ? copy_thread_tls+0x265/0x800 [ 1021.933001] copy_process.part.38+0x36bf/0x6ee0 [ 1021.937660] ? __lock_acquire+0x7f5/0x5130 [ 1021.941881] ? lock_acquire+0x1dc/0x520 [ 1021.945838] ? alloc_set_pte+0x1077/0x16a0 [ 1021.950061] ? __cleanup_sighand+0x70/0x70 [ 1021.954278] ? alloc_set_pte+0x1077/0x16a0 [ 1021.958504] ? print_usage_bug+0xc0/0xc0 [ 1021.962551] ? lock_downgrade+0x8e0/0x8e0 [ 1021.966689] ? debug_check_no_locks_freed+0x310/0x310 [ 1021.971871] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1021.977051] ? print_usage_bug+0xc0/0xc0 [ 1021.981103] ? debug_check_no_locks_freed+0x310/0x310 [ 1021.986280] ? __lock_acquire+0x7f5/0x5130 [ 1021.990500] ? debug_check_no_locks_freed+0x310/0x310 [ 1021.995677] ? print_usage_bug+0xc0/0xc0 [ 1021.999724] ? print_usage_bug+0xc0/0xc0 [ 1022.003786] ? graph_lock+0x170/0x170 [ 1022.007575] ? lock_acquire+0x1dc/0x520 [ 1022.011541] ? __fdget_pos+0x1a9/0x1e0 [ 1022.015414] ? graph_lock+0x170/0x170 [ 1022.019201] ? __lock_acquire+0x7f5/0x5130 [ 1022.023422] ? find_held_lock+0x36/0x1c0 [ 1022.027468] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1022.032989] ? _parse_integer+0x13b/0x190 [ 1022.037124] ? graph_lock+0x170/0x170 [ 1022.040911] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1022.046429] ? _kstrtoull+0x180/0x230 [ 1022.050215] ? _parse_integer+0x190/0x190 [ 1022.054346] ? graph_lock+0x170/0x170 [ 1022.058133] ? lock_release+0xa10/0xa10 [ 1022.062089] ? check_same_owner+0x320/0x320 [ 1022.066395] ? find_held_lock+0x36/0x1c0 [ 1022.070440] ? graph_lock+0x170/0x170 [ 1022.074224] ? lock_downgrade+0x8e0/0x8e0 [ 1022.078357] ? find_held_lock+0x36/0x1c0 [ 1022.082412] ? lock_downgrade+0x8e0/0x8e0 [ 1022.086546] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1022.092067] ? proc_fail_nth_write+0x96/0x1f0 [ 1022.096546] ? proc_cwd_link+0x1d0/0x1d0 [ 1022.100594] ? find_held_lock+0x36/0x1c0 [ 1022.104643] _do_fork+0x291/0x12a0 [ 1022.108170] ? fork_idle+0x1a0/0x1a0 [ 1022.111872] ? __lock_is_held+0xb5/0x140 [ 1022.115924] ? __sb_end_write+0xac/0xe0 [ 1022.119886] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1022.125408] ? fput+0x130/0x1a0 [ 1022.128671] ? ksys_write+0x1a6/0x250 [ 1022.132458] ? SyS_read+0x30/0x30 [ 1022.135895] ? mm_fault_error+0x380/0x380 [ 1022.140038] SyS_clone+0x37/0x50 [ 1022.143388] ? sys_vfork+0x30/0x30 [ 1022.146916] do_syscall_64+0x29e/0x9d0 [ 1022.150787] ? vmalloc_sync_all+0x30/0x30 [ 1022.154928] ? _raw_spin_unlock_irq+0x27/0x70 [ 1022.159413] ? finish_task_switch+0x1ca/0x820 [ 1022.163892] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1022.168807] ? syscall_return_slowpath+0x30f/0x5c0 [ 1022.173726] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1022.179079] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1022.183916] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1022.189087] RIP: 0033:0x455259 [ 1022.192259] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1022.199958] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 2018/04/10 12:55:51 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000005000008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1022.207214] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1022.214468] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1022.221805] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1022.229065] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000001a 2018/04/10 12:55:51 executing program 7 (fault-call:0 fault-nth:27): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:51 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], 0x1}, 0x5}, 0x1c) [ 1022.313770] FAULT_INJECTION: forcing a failure. [ 1022.313770] name failslab, interval 1, probability 0, space 0, times 0 [ 1022.325117] CPU: 0 PID: 32595 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1022.332050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1022.341438] Call Trace: [ 1022.344044] dump_stack+0x1b9/0x294 [ 1022.347697] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1022.352901] ? __save_stack_trace+0x7e/0xd0 [ 1022.357241] should_fail.cold.4+0xa/0x1a [ 1022.361312] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1022.366422] ? save_stack+0x43/0xd0 [ 1022.370045] ? kasan_kmalloc+0xc4/0xe0 [ 1022.373926] ? kmem_cache_alloc_trace+0x152/0x780 [ 1022.378762] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1022.383940] ? __list_lru_init+0x456/0x790 [ 1022.388182] ? sget_userns+0x6d9/0xf20 [ 1022.392062] ? graph_lock+0x170/0x170 [ 1022.395852] ? kern_mount_data+0x50/0xc0 [ 1022.399897] ? pid_ns_prepare_proc+0x1e/0x90 [ 1022.404304] ? alloc_pid+0x8cf/0xa50 [ 1022.408005] ? copy_process.part.38+0x36bf/0x6ee0 [ 1022.412840] ? _do_fork+0x291/0x12a0 [ 1022.416536] ? SyS_clone+0x37/0x50 [ 1022.420066] ? find_held_lock+0x36/0x1c0 [ 1022.424116] ? __lock_is_held+0xb5/0x140 [ 1022.428195] ? check_same_owner+0x320/0x320 [ 1022.433050] ? rcu_note_context_switch+0x710/0x710 [ 1022.437972] __should_failslab+0x124/0x180 [ 1022.442197] should_failslab+0x9/0x14 [ 1022.445982] kmem_cache_alloc_trace+0x2cb/0x780 [ 1022.450635] ? __kmalloc_node+0x33/0x70 [ 1022.454593] ? __kmalloc_node+0x33/0x70 [ 1022.458554] ? rcu_read_lock_sched_held+0x108/0x120 [ 1022.463561] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1022.468564] ? kvfree_rcu+0x20/0x20 [ 1022.472177] ? __kmalloc_node+0x47/0x70 [ 1022.476145] __list_lru_init+0x456/0x790 [ 1022.480198] ? list_lru_destroy+0x4c0/0x4c0 [ 1022.485168] ? mark_held_locks+0xc9/0x160 [ 1022.489306] ? __raw_spin_lock_init+0x1c/0x100 [ 1022.493879] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1022.498879] ? __lockdep_init_map+0x105/0x590 [ 1022.503360] ? lockdep_init_map+0x9/0x10 [ 1022.507408] sget_userns+0x6d9/0xf20 [ 1022.511105] ? set_anon_super+0x20/0x20 [ 1022.515068] ? get_empty_filp.cold.7+0x3e/0x3e [ 1022.519635] ? destroy_unused_super.part.9+0x100/0x100 [ 1022.524903] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1022.529909] ? save_stack+0x43/0xd0 [ 1022.533519] ? kasan_kmalloc+0xc4/0xe0 [ 1022.537389] ? kasan_slab_alloc+0x12/0x20 [ 1022.541519] ? kmem_cache_alloc+0x12e/0x760 [ 1022.545827] ? copy_process.part.38+0x36bf/0x6ee0 [ 1022.550662] ? graph_lock+0x170/0x170 [ 1022.554449] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1022.559979] mount_ns+0x8f/0x1d0 [ 1022.563334] ? proc_get_inode+0x670/0x670 [ 1022.567468] proc_mount+0x73/0xa0 [ 1022.570908] mount_fs+0xae/0x328 [ 1022.574269] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1022.578838] ? may_umount+0xb0/0xb0 [ 1022.582447] ? kasan_check_read+0x11/0x20 [ 1022.586579] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1022.590980] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1022.595550] ? idr_alloc+0x1a0/0x1a0 [ 1022.599253] kern_mount_data+0x50/0xc0 [ 1022.603128] pid_ns_prepare_proc+0x1e/0x90 [ 1022.607350] alloc_pid+0x8cf/0xa50 [ 1022.610880] ? __change_pid+0x410/0x410 [ 1022.614838] ? ns_capable_common+0x13f/0x170 [ 1022.619237] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1022.624761] ? memset+0x31/0x40 [ 1022.628035] ? copy_thread_tls+0x265/0x800 [ 1022.632259] copy_process.part.38+0x36bf/0x6ee0 [ 1022.636917] ? __lock_acquire+0x7f5/0x5130 [ 1022.641140] ? lock_acquire+0x1dc/0x520 [ 1022.645098] ? alloc_set_pte+0x1077/0x16a0 [ 1022.649334] ? __cleanup_sighand+0x70/0x70 [ 1022.653555] ? alloc_set_pte+0x1077/0x16a0 [ 1022.657781] ? print_usage_bug+0xc0/0xc0 [ 1022.661840] ? lock_downgrade+0x8e0/0x8e0 [ 1022.665977] ? debug_check_no_locks_freed+0x310/0x310 [ 1022.671153] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1022.676332] ? print_usage_bug+0xc0/0xc0 [ 1022.680394] ? debug_check_no_locks_freed+0x310/0x310 [ 1022.685588] ? __lock_acquire+0x7f5/0x5130 [ 1022.689806] ? debug_check_no_locks_freed+0x310/0x310 [ 1022.694991] ? print_usage_bug+0xc0/0xc0 [ 1022.699046] ? print_usage_bug+0xc0/0xc0 [ 1022.703094] ? graph_lock+0x170/0x170 [ 1022.706972] ? lock_acquire+0x1dc/0x520 [ 1022.710932] ? __fdget_pos+0x1a9/0x1e0 [ 1022.714806] ? graph_lock+0x170/0x170 [ 1022.718599] ? __lock_acquire+0x7f5/0x5130 [ 1022.722839] ? find_held_lock+0x36/0x1c0 [ 1022.726889] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1022.732415] ? _parse_integer+0x13b/0x190 [ 1022.736548] ? graph_lock+0x170/0x170 [ 1022.740336] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1022.745857] ? _kstrtoull+0x180/0x230 [ 1022.749644] ? _parse_integer+0x190/0x190 [ 1022.753776] ? graph_lock+0x170/0x170 [ 1022.757559] ? lock_release+0xa10/0xa10 [ 1022.761521] ? check_same_owner+0x320/0x320 [ 1022.765830] ? find_held_lock+0x36/0x1c0 [ 1022.769886] ? graph_lock+0x170/0x170 [ 1022.773674] ? lock_downgrade+0x8e0/0x8e0 [ 1022.777821] ? find_held_lock+0x36/0x1c0 [ 1022.781878] ? lock_downgrade+0x8e0/0x8e0 [ 1022.786026] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1022.791551] ? proc_fail_nth_write+0x96/0x1f0 [ 1022.796036] ? proc_cwd_link+0x1d0/0x1d0 [ 1022.800086] ? find_held_lock+0x36/0x1c0 [ 1022.804136] _do_fork+0x291/0x12a0 [ 1022.808018] ? fork_idle+0x1a0/0x1a0 [ 1022.811721] ? __lock_is_held+0xb5/0x140 [ 1022.815779] ? __sb_end_write+0xac/0xe0 [ 1022.819742] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1022.825262] ? fput+0x130/0x1a0 [ 1022.828530] ? ksys_write+0x1a6/0x250 [ 1022.832324] ? SyS_read+0x30/0x30 [ 1022.835759] ? mm_fault_error+0x380/0x380 [ 1022.839897] SyS_clone+0x37/0x50 [ 1022.843249] ? sys_vfork+0x30/0x30 [ 1022.846778] do_syscall_64+0x29e/0x9d0 [ 1022.850648] ? vmalloc_sync_all+0x30/0x30 [ 1022.854781] ? _raw_spin_unlock_irq+0x27/0x70 [ 1022.859260] ? finish_task_switch+0x1ca/0x820 [ 1022.863742] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1022.868660] ? syscall_return_slowpath+0x30f/0x5c0 [ 1022.873581] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1022.878933] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1022.883765] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1022.888937] RIP: 0033:0x455259 [ 1022.892109] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1022.899801] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1022.907054] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 2018/04/10 12:55:51 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000003fff0008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:51 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}, 0x10) shutdown(r0, 0x1) [ 1022.914309] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1022.921560] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1022.928810] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000001b 2018/04/10 12:55:51 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0xa4ffffff00000000}}, 0x14) 2018/04/10 12:55:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000f0ffff", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:51 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:51 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:51 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000040008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1023.037870] binder: 32610 RLIMIT_NICE not set 2018/04/10 12:55:51 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:51 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000050008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:51 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:51 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0xfeffffff00000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:52 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x33c00, 0x0) 2018/04/10 12:55:52 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000308001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:52 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:52 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0xa4ffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:52 executing program 7 (fault-call:0 fault-nth:28): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:52 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0xb}}, 0x14) [ 1023.316506] FAULT_INJECTION: forcing a failure. [ 1023.316506] name failslab, interval 1, probability 0, space 0, times 0 [ 1023.327877] CPU: 0 PID: 32651 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1023.334804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1023.344157] Call Trace: [ 1023.346752] dump_stack+0x1b9/0x294 [ 1023.350394] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1023.355609] should_fail.cold.4+0xa/0x1a [ 1023.359682] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1023.364798] ? zap_class+0x720/0x720 [ 1023.368522] ? print_usage_bug+0xc0/0xc0 [ 1023.372590] ? graph_lock+0x170/0x170 [ 1023.376389] ? lock_downgrade+0x8e0/0x8e0 [ 1023.380540] ? find_held_lock+0x36/0x1c0 [ 1023.384602] ? __lock_is_held+0xb5/0x140 [ 1023.388685] ? check_same_owner+0x320/0x320 [ 1023.393018] ? __might_sleep+0x95/0x190 [ 1023.397003] ? rcu_note_context_switch+0x710/0x710 [ 1023.401947] __should_failslab+0x124/0x180 [ 1023.406190] should_failslab+0x9/0x14 [ 1023.409994] __kmalloc+0x2c8/0x760 [ 1023.413535] ? __kmalloc_node+0x47/0x70 [ 1023.417517] ? __list_lru_init+0xdd/0x790 [ 1023.421676] __list_lru_init+0xdd/0x790 [ 1023.425663] ? list_lru_destroy+0x4c0/0x4c0 [ 1023.429987] ? mark_held_locks+0xc9/0x160 [ 1023.434144] ? __raw_spin_lock_init+0x1c/0x100 [ 1023.438728] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1023.443742] ? lockdep_init_map+0x9/0x10 [ 1023.447798] sget_userns+0x706/0xf20 [ 1023.451494] ? set_anon_super+0x20/0x20 [ 1023.455459] ? get_empty_filp.cold.7+0x3e/0x3e [ 1023.460033] ? destroy_unused_super.part.9+0x100/0x100 [ 1023.465299] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1023.470308] ? zap_class+0x720/0x720 [ 1023.474003] ? kmem_cache_alloc+0x12e/0x760 [ 1023.478327] ? copy_process.part.38+0x36bf/0x6ee0 [ 1023.483254] ? graph_lock+0x170/0x170 [ 1023.487046] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1023.492574] mount_ns+0x8f/0x1d0 [ 1023.495926] ? proc_get_inode+0x670/0x670 [ 1023.500062] proc_mount+0x73/0xa0 [ 1023.503502] mount_fs+0xae/0x328 [ 1023.506863] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1023.511432] ? may_umount+0xb0/0xb0 [ 1023.515043] ? kasan_check_read+0x11/0x20 [ 1023.519178] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1023.523568] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1023.528137] ? idr_alloc+0x1a0/0x1a0 [ 1023.531836] kern_mount_data+0x50/0xc0 [ 1023.535709] pid_ns_prepare_proc+0x1e/0x90 [ 1023.539926] alloc_pid+0x8cf/0xa50 [ 1023.543456] ? __change_pid+0x410/0x410 [ 1023.547415] ? ns_capable_common+0x13f/0x170 [ 1023.551811] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1023.557333] ? memset+0x31/0x40 [ 1023.560600] ? copy_thread_tls+0x265/0x800 [ 1023.564826] copy_process.part.38+0x36bf/0x6ee0 [ 1023.569480] ? __lock_acquire+0x7f5/0x5130 [ 1023.573701] ? lock_acquire+0x1dc/0x520 [ 1023.577657] ? alloc_set_pte+0x1077/0x16a0 [ 1023.581887] ? __cleanup_sighand+0x70/0x70 [ 1023.586107] ? alloc_set_pte+0x1077/0x16a0 [ 1023.590336] ? print_usage_bug+0xc0/0xc0 [ 1023.594386] ? lock_downgrade+0x8e0/0x8e0 [ 1023.598523] ? debug_check_no_locks_freed+0x310/0x310 [ 1023.603698] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1023.608873] ? print_usage_bug+0xc0/0xc0 [ 1023.612933] ? debug_check_no_locks_freed+0x310/0x310 [ 1023.618110] ? __lock_acquire+0x7f5/0x5130 [ 1023.622328] ? debug_check_no_locks_freed+0x310/0x310 [ 1023.627506] ? perf_trace_lock+0xd6/0x900 [ 1023.631642] ? print_usage_bug+0xc0/0xc0 [ 1023.635691] ? zap_class+0x720/0x720 [ 1023.639391] ? perf_trace_lock+0xd6/0x900 [ 1023.643524] ? perf_trace_lock+0xd6/0x900 [ 1023.647656] ? graph_lock+0x170/0x170 [ 1023.651445] ? lock_acquire+0x1dc/0x520 [ 1023.655668] ? perf_trace_lock+0xd6/0x900 [ 1023.660066] ? zap_class+0x720/0x720 [ 1023.663763] ? find_held_lock+0x36/0x1c0 [ 1023.667901] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1023.673424] ? _parse_integer+0x13b/0x190 [ 1023.677556] ? graph_lock+0x170/0x170 [ 1023.681343] ? perf_trace_lock+0xd6/0x900 [ 1023.685472] ? _kstrtoull+0x180/0x230 [ 1023.689255] ? _parse_integer+0x190/0x190 [ 1023.693389] ? zap_class+0x720/0x720 [ 1023.697089] ? find_held_lock+0x36/0x1c0 [ 1023.701136] ? graph_lock+0x170/0x170 [ 1023.704929] ? perf_trace_lock+0xd6/0x900 [ 1023.709064] ? find_held_lock+0x36/0x1c0 [ 1023.713117] ? lock_downgrade+0x8e0/0x8e0 [ 1023.717254] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1023.722777] ? proc_fail_nth_write+0x96/0x1f0 [ 1023.727262] ? find_held_lock+0x36/0x1c0 [ 1023.731309] _do_fork+0x291/0x12a0 [ 1023.734837] ? fork_idle+0x1a0/0x1a0 [ 1023.738550] ? __sb_end_write+0xac/0xe0 [ 1023.742511] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1023.748036] ? fput+0x130/0x1a0 [ 1023.751304] ? ksys_write+0x1a6/0x250 [ 1023.755090] ? SyS_read+0x30/0x30 [ 1023.758529] ? mm_fault_error+0x380/0x380 [ 1023.762665] SyS_clone+0x37/0x50 [ 1023.766021] ? sys_vfork+0x30/0x30 [ 1023.769553] do_syscall_64+0x29e/0x9d0 [ 1023.773424] ? vmalloc_sync_all+0x30/0x30 [ 1023.777558] ? _raw_spin_unlock_irq+0x27/0x70 [ 1023.782042] ? finish_task_switch+0x1ca/0x820 [ 1023.786525] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1023.791438] ? syscall_return_slowpath+0x30f/0x5c0 [ 1023.796365] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1023.801720] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1023.806553] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1023.811724] RIP: 0033:0x455259 [ 1023.814894] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1023.822589] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1023.829842] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1023.837097] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1023.844352] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1023.851605] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000001c [ 1023.862604] binder: 32610 RLIMIT_NICE not set 2018/04/10 12:55:52 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:52 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000], 0x1}, 0x5}, 0x1c) [ 1023.872472] binder: BINDER_SET_CONTEXT_MGR already set [ 1023.878413] binder: 32609:32610 ioctl c0306201 20004000 returned -14 [ 1023.918218] binder: 32609:32660 ioctl 40046207 0 returned -16 [ 1023.947851] binder_alloc: 32609: binder_alloc_buf, no vma [ 1023.953624] binder_alloc: 32609: binder_alloc_buf, no vma [ 1023.953647] binder: 32609:32660 transaction failed 29189/-3, size 0-0 line 2963 [ 1023.959253] binder: 32609:32670 transaction failed 29189/-3, size 0-0 line 2963 [ 1024.085096] binder: undelivered TRANSACTION_ERROR: 29189 [ 1024.090696] binder: undelivered TRANSACTION_ERROR: 29189 [ 1024.096595] binder: release 32609:32610 transaction 800 out, still active [ 1024.103571] binder: release 32609:32610 transaction 799 in, still active [ 1024.110472] binder: undelivered TRANSACTION_COMPLETE [ 1024.115620] binder: release 32609:32660 transaction 799 out, still active [ 1024.122601] binder: undelivered TRANSACTION_COMPLETE [ 1024.127751] binder: send failed reply for transaction 800, target dead [ 1024.134458] binder: send failed reply for transaction 799, target dead 2018/04/10 12:55:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000007fff", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:53 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:53 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x34000, 0x0) 2018/04/10 12:55:53 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0xf5ffffff}}, 0x14) 2018/04/10 12:55:53 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c70000000000000000030005000000000002000000000000000000000000003fff08001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:53 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0xfeffffff}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:53 executing program 7 (fault-call:0 fault-nth:29): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:53 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x1}, 0x5}, 0x1c) [ 1024.738086] FAULT_INJECTION: forcing a failure. [ 1024.738086] name failslab, interval 1, probability 0, space 0, times 0 [ 1024.749367] CPU: 0 PID: 32679 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1024.756292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1024.765651] Call Trace: [ 1024.768238] dump_stack+0x1b9/0x294 [ 1024.771866] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1024.777056] ? kernel_text_address+0x79/0xf0 [ 1024.781453] ? __unwind_start+0x166/0x330 [ 1024.785595] should_fail.cold.4+0xa/0x1a [ 1024.789645] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1024.794741] ? graph_lock+0x170/0x170 [ 1024.798529] ? save_stack+0x43/0xd0 [ 1024.802142] ? kasan_kmalloc+0xc4/0xe0 [ 1024.806013] ? __kmalloc+0x14e/0x760 [ 1024.809717] ? __list_lru_init+0xdd/0x790 [ 1024.813852] ? find_held_lock+0x36/0x1c0 [ 1024.817903] ? __lock_is_held+0xb5/0x140 [ 1024.821959] ? check_same_owner+0x320/0x320 [ 1024.826266] ? rcu_note_context_switch+0x710/0x710 [ 1024.831190] __should_failslab+0x124/0x180 [ 1024.835411] should_failslab+0x9/0x14 [ 1024.839198] kmem_cache_alloc_node_trace+0x26f/0x770 [ 1024.844282] ? mark_held_locks+0xc9/0x160 [ 1024.848417] ? __raw_spin_lock_init+0x1c/0x100 [ 1024.852987] __kmalloc_node+0x33/0x70 [ 1024.856778] kvmalloc_node+0x6b/0x100 [ 1024.860571] __list_lru_init+0x559/0x790 [ 1024.864622] ? list_lru_destroy+0x4c0/0x4c0 [ 1024.868927] ? mark_held_locks+0xc9/0x160 [ 1024.873062] ? __raw_spin_lock_init+0x1c/0x100 [ 1024.877631] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1024.882635] ? lockdep_init_map+0x9/0x10 [ 1024.886684] sget_userns+0x706/0xf20 [ 1024.890382] ? set_anon_super+0x20/0x20 [ 1024.894347] ? get_empty_filp.cold.7+0x3e/0x3e [ 1024.898914] ? destroy_unused_super.part.9+0x100/0x100 [ 1024.904176] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1024.909182] ? save_stack+0x43/0xd0 [ 1024.912791] ? kasan_kmalloc+0xc4/0xe0 [ 1024.916662] ? kasan_slab_alloc+0x12/0x20 [ 1024.920791] ? kmem_cache_alloc+0x12e/0x760 [ 1024.925095] ? copy_process.part.38+0x36bf/0x6ee0 [ 1024.929930] ? graph_lock+0x170/0x170 [ 1024.933720] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1024.939249] mount_ns+0x8f/0x1d0 [ 1024.942599] ? proc_get_inode+0x670/0x670 [ 1024.946733] proc_mount+0x73/0xa0 [ 1024.950172] mount_fs+0xae/0x328 [ 1024.953530] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1024.958104] ? may_umount+0xb0/0xb0 [ 1024.961716] ? kasan_check_read+0x11/0x20 [ 1024.965849] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1024.970240] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1024.974808] ? idr_alloc+0x1a0/0x1a0 [ 1024.978509] kern_mount_data+0x50/0xc0 [ 1024.982383] pid_ns_prepare_proc+0x1e/0x90 [ 1024.986602] alloc_pid+0x8cf/0xa50 [ 1024.990131] ? __change_pid+0x410/0x410 [ 1024.994091] ? ns_capable_common+0x13f/0x170 [ 1024.998494] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1025.004026] ? memset+0x31/0x40 [ 1025.007300] ? copy_thread_tls+0x265/0x800 [ 1025.011525] copy_process.part.38+0x36bf/0x6ee0 [ 1025.016183] ? __lock_acquire+0x7f5/0x5130 [ 1025.020404] ? lock_acquire+0x1dc/0x520 [ 1025.024363] ? alloc_set_pte+0x1077/0x16a0 [ 1025.028596] ? __cleanup_sighand+0x70/0x70 [ 1025.032816] ? alloc_set_pte+0x1077/0x16a0 [ 1025.037048] ? print_usage_bug+0xc0/0xc0 [ 1025.041099] ? lock_downgrade+0x8e0/0x8e0 [ 1025.045239] ? debug_check_no_locks_freed+0x310/0x310 [ 1025.050413] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1025.055591] ? print_usage_bug+0xc0/0xc0 [ 1025.059648] ? debug_check_no_locks_freed+0x310/0x310 [ 1025.064827] ? __lock_acquire+0x7f5/0x5130 [ 1025.069050] ? debug_check_no_locks_freed+0x310/0x310 [ 1025.074233] ? print_usage_bug+0xc0/0xc0 [ 1025.078281] ? print_usage_bug+0xc0/0xc0 [ 1025.082328] ? graph_lock+0x170/0x170 [ 1025.086120] ? lock_acquire+0x1dc/0x520 [ 1025.090079] ? __fdget_pos+0x1a9/0x1e0 [ 1025.093955] ? graph_lock+0x170/0x170 [ 1025.097743] ? __lock_acquire+0x7f5/0x5130 [ 1025.101961] ? find_held_lock+0x36/0x1c0 [ 1025.106013] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1025.111542] ? _parse_integer+0x13b/0x190 [ 1025.115678] ? graph_lock+0x170/0x170 [ 1025.119466] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1025.124988] ? _kstrtoull+0x180/0x230 [ 1025.128777] ? _parse_integer+0x190/0x190 [ 1025.132908] ? graph_lock+0x170/0x170 [ 1025.136692] ? lock_release+0xa10/0xa10 [ 1025.140652] ? check_same_owner+0x320/0x320 [ 1025.144960] ? find_held_lock+0x36/0x1c0 [ 1025.149011] ? graph_lock+0x170/0x170 [ 1025.152807] ? lock_downgrade+0x8e0/0x8e0 [ 1025.156943] ? find_held_lock+0x36/0x1c0 [ 1025.160996] ? lock_downgrade+0x8e0/0x8e0 [ 1025.165133] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1025.170656] ? proc_fail_nth_write+0x96/0x1f0 [ 1025.175134] ? proc_cwd_link+0x1d0/0x1d0 [ 1025.179184] ? find_held_lock+0x36/0x1c0 [ 1025.183233] _do_fork+0x291/0x12a0 [ 1025.186763] ? fork_idle+0x1a0/0x1a0 [ 1025.190463] ? __lock_is_held+0xb5/0x140 [ 1025.194522] ? __sb_end_write+0xac/0xe0 [ 1025.198486] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1025.204007] ? fput+0x130/0x1a0 [ 1025.207279] ? ksys_write+0x1a6/0x250 [ 1025.211067] ? SyS_read+0x30/0x30 [ 1025.214507] ? mm_fault_error+0x380/0x380 [ 1025.218644] SyS_clone+0x37/0x50 [ 1025.221990] ? sys_vfork+0x30/0x30 [ 1025.225518] do_syscall_64+0x29e/0x9d0 [ 1025.229386] ? vmalloc_sync_all+0x30/0x30 [ 1025.233522] ? _raw_spin_unlock_irq+0x27/0x70 [ 1025.238000] ? finish_task_switch+0x1ca/0x820 [ 1025.242486] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1025.247403] ? syscall_return_slowpath+0x30f/0x5c0 [ 1025.252320] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1025.257675] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1025.262510] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1025.267684] RIP: 0033:0x455259 [ 1025.270860] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1025.278556] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 2018/04/10 12:55:54 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e05], 0x1}, 0x5}, 0x1c) [ 1025.285809] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1025.293073] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1025.300323] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1025.307575] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000001d [ 1025.324955] binder: 32690 RLIMIT_NICE not set 2018/04/10 12:55:54 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000002008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:54 executing program 7 (fault-call:0 fault-nth:30): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:54 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0x14000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:54 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0x1}, 0x5}, 0x1c) [ 1025.438489] FAULT_INJECTION: forcing a failure. [ 1025.438489] name failslab, interval 1, probability 0, space 0, times 0 [ 1025.449859] CPU: 0 PID: 32705 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1025.456794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1025.466155] Call Trace: [ 1025.468755] dump_stack+0x1b9/0x294 [ 1025.472397] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1025.477591] ? kernel_text_address+0x79/0xf0 [ 1025.482007] ? __unwind_start+0x166/0x330 2018/04/10 12:55:54 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:54 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x40000}}, 0x14) [ 1025.486166] should_fail.cold.4+0xa/0x1a [ 1025.490328] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1025.495444] ? graph_lock+0x170/0x170 [ 1025.499251] ? save_stack+0x43/0xd0 [ 1025.502882] ? kasan_kmalloc+0xc4/0xe0 [ 1025.506771] ? __kmalloc+0x14e/0x760 [ 1025.510501] ? __list_lru_init+0xdd/0x790 [ 1025.514659] ? find_held_lock+0x36/0x1c0 [ 1025.518728] ? __lock_is_held+0xb5/0x140 [ 1025.522806] ? check_same_owner+0x320/0x320 [ 1025.527146] ? rcu_note_context_switch+0x710/0x710 [ 1025.532093] __should_failslab+0x124/0x180 2018/04/10 12:55:54 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x1}, 0x5}, 0x1c) [ 1025.536339] should_failslab+0x9/0x14 [ 1025.540147] kmem_cache_alloc_node_trace+0x26f/0x770 [ 1025.545253] ? mark_held_locks+0xc9/0x160 [ 1025.549411] ? __raw_spin_lock_init+0x1c/0x100 [ 1025.554000] __kmalloc_node+0x33/0x70 [ 1025.557810] kvmalloc_node+0x6b/0x100 [ 1025.561613] __list_lru_init+0x559/0x790 [ 1025.565674] ? list_lru_destroy+0x4c0/0x4c0 [ 1025.569985] ? mark_held_locks+0xc9/0x160 [ 1025.574136] ? __raw_spin_lock_init+0x1c/0x100 [ 1025.578710] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1025.583715] ? lockdep_init_map+0x9/0x10 [ 1025.587764] sget_userns+0x706/0xf20 [ 1025.591461] ? set_anon_super+0x20/0x20 [ 1025.595429] ? get_empty_filp.cold.7+0x3e/0x3e [ 1025.599999] ? destroy_unused_super.part.9+0x100/0x100 [ 1025.605271] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1025.610279] ? save_stack+0x43/0xd0 [ 1025.613890] ? kasan_kmalloc+0xc4/0xe0 [ 1025.617758] ? kasan_slab_alloc+0x12/0x20 [ 1025.621892] ? kmem_cache_alloc+0x12e/0x760 [ 1025.626200] ? copy_process.part.38+0x36bf/0x6ee0 [ 1025.631046] ? graph_lock+0x170/0x170 [ 1025.634834] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1025.640364] mount_ns+0x8f/0x1d0 [ 1025.643718] ? proc_get_inode+0x670/0x670 [ 1025.647855] proc_mount+0x73/0xa0 [ 1025.651295] mount_fs+0xae/0x328 [ 1025.654654] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1025.659223] ? may_umount+0xb0/0xb0 [ 1025.662831] ? kasan_check_read+0x11/0x20 [ 1025.666963] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1025.671360] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1025.675937] ? idr_alloc+0x1a0/0x1a0 [ 1025.679641] kern_mount_data+0x50/0xc0 [ 1025.683518] pid_ns_prepare_proc+0x1e/0x90 [ 1025.687743] alloc_pid+0x8cf/0xa50 [ 1025.691273] ? __change_pid+0x410/0x410 [ 1025.695234] ? ns_capable_common+0x13f/0x170 [ 1025.699633] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1025.705159] ? memset+0x31/0x40 [ 1025.708432] ? copy_thread_tls+0x265/0x800 [ 1025.712656] copy_process.part.38+0x36bf/0x6ee0 [ 1025.717310] ? __lock_acquire+0x7f5/0x5130 [ 1025.721534] ? lock_acquire+0x1dc/0x520 [ 1025.725495] ? alloc_set_pte+0x1077/0x16a0 [ 1025.729730] ? __cleanup_sighand+0x70/0x70 [ 1025.733953] ? alloc_set_pte+0x1077/0x16a0 [ 1025.738183] ? print_usage_bug+0xc0/0xc0 [ 1025.742233] ? lock_downgrade+0x8e0/0x8e0 [ 1025.746371] ? debug_check_no_locks_freed+0x310/0x310 [ 1025.751548] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1025.756724] ? print_usage_bug+0xc0/0xc0 [ 1025.760786] ? debug_check_no_locks_freed+0x310/0x310 [ 1025.765966] ? __lock_acquire+0x7f5/0x5130 [ 1025.770185] ? debug_check_no_locks_freed+0x310/0x310 [ 1025.775369] ? print_usage_bug+0xc0/0xc0 [ 1025.779417] ? print_usage_bug+0xc0/0xc0 [ 1025.783465] ? graph_lock+0x170/0x170 [ 1025.787255] ? lock_acquire+0x1dc/0x520 [ 1025.791215] ? __fdget_pos+0x1a9/0x1e0 [ 1025.795094] ? graph_lock+0x170/0x170 [ 1025.798902] ? __lock_acquire+0x7f5/0x5130 [ 1025.803129] ? find_held_lock+0x36/0x1c0 [ 1025.807179] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1025.812698] ? _parse_integer+0x13b/0x190 [ 1025.816835] ? graph_lock+0x170/0x170 [ 1025.820624] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1025.826144] ? _kstrtoull+0x180/0x230 [ 1025.829932] ? _parse_integer+0x190/0x190 [ 1025.834077] ? graph_lock+0x170/0x170 [ 1025.837865] ? lock_release+0xa10/0xa10 [ 1025.841828] ? check_same_owner+0x320/0x320 [ 1025.846143] ? find_held_lock+0x36/0x1c0 [ 1025.850193] ? graph_lock+0x170/0x170 [ 1025.853981] ? lock_downgrade+0x8e0/0x8e0 [ 1025.858120] ? find_held_lock+0x36/0x1c0 [ 1025.862175] ? lock_downgrade+0x8e0/0x8e0 [ 1025.866314] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1025.871837] ? proc_fail_nth_write+0x96/0x1f0 [ 1025.876323] ? proc_cwd_link+0x1d0/0x1d0 [ 1025.880372] ? find_held_lock+0x36/0x1c0 [ 1025.884422] _do_fork+0x291/0x12a0 [ 1025.887957] ? fork_idle+0x1a0/0x1a0 [ 1025.891659] ? __lock_is_held+0xb5/0x140 [ 1025.895720] ? __sb_end_write+0xac/0xe0 [ 1025.899683] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1025.905202] ? fput+0x130/0x1a0 [ 1025.908467] ? ksys_write+0x1a6/0x250 [ 1025.912258] ? SyS_read+0x30/0x30 [ 1025.915694] ? mm_fault_error+0x380/0x380 [ 1025.919843] SyS_clone+0x37/0x50 [ 1025.923190] ? sys_vfork+0x30/0x30 [ 1025.926719] do_syscall_64+0x29e/0x9d0 [ 1025.930591] ? vmalloc_sync_all+0x30/0x30 [ 1025.934724] ? _raw_spin_unlock_irq+0x27/0x70 [ 1025.939207] ? finish_task_switch+0x1ca/0x820 [ 1025.943699] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1025.948615] ? syscall_return_slowpath+0x30f/0x5c0 [ 1025.953534] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1025.958891] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1025.963724] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1025.968897] RIP: 0033:0x455259 [ 1025.972073] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1025.979766] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1025.987027] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1025.994284] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1026.001539] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1026.008796] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000001e [ 1026.021555] binder: 32690 RLIMIT_NICE not set [ 1026.029454] binder: 32685:32716 got new transaction with bad transaction stack, transaction 804 has target 32685:32690 [ 1026.040501] binder: 32685:32716 transaction failed 29201/-71, size 0-0 line 2875 [ 1026.100402] binder: 32685:32690 ioctl c0306201 20004000 returned -14 [ 1026.108100] binder: BINDER_SET_CONTEXT_MGR already set [ 1026.121451] binder: 32685:32716 ioctl 40046207 0 returned -16 [ 1026.135395] binder_alloc: 32685: binder_alloc_buf, no vma [ 1026.141082] binder: 32685:32716 transaction failed 29189/-3, size 0-0 line 2963 [ 1026.148686] binder_alloc: 32685: binder_alloc_buf, no vma [ 1026.154359] binder: 32685:32726 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:55:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:55 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000508001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:55 executing program 7 (fault-call:0 fault-nth:31): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:55 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x4}}, 0x14) 2018/04/10 12:55:55 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0xff00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:55 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:55 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x20000241, 0x0) [ 1026.280779] binder: undelivered TRANSACTION_ERROR: 29189 [ 1026.286324] binder: undelivered TRANSACTION_ERROR: 29189 [ 1026.292118] binder: release 32685:32690 transaction 804 in, still active [ 1026.299155] binder: send failed reply for transaction 804 to 32685:32716 [ 1026.306076] binder: undelivered TRANSACTION_COMPLETE [ 1026.311206] binder: undelivered TRANSACTION_ERROR: 29201 [ 1026.316694] binder: undelivered TRANSACTION_ERROR: 29189 2018/04/10 12:55:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e05000000000000], 0x1}, 0x5}, 0x1c) [ 1026.344649] FAULT_INJECTION: forcing a failure. [ 1026.344649] name failslab, interval 1, probability 0, space 0, times 0 [ 1026.347823] binder: 32748 RLIMIT_NICE not set [ 1026.355973] CPU: 0 PID: 32749 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1026.355985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1026.355995] Call Trace: [ 1026.379338] dump_stack+0x1b9/0x294 [ 1026.382985] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1026.388185] ? kernel_text_address+0x79/0xf0 2018/04/10 12:55:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa], 0x1}, 0x5}, 0x1c) [ 1026.392619] should_fail.cold.4+0xa/0x1a [ 1026.396699] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1026.401826] ? graph_lock+0x170/0x170 [ 1026.405634] ? save_stack+0x43/0xd0 [ 1026.409270] ? kasan_kmalloc+0xc4/0xe0 [ 1026.413165] ? __kmalloc+0x14e/0x760 [ 1026.416884] ? __list_lru_init+0xdd/0x790 [ 1026.421033] ? find_held_lock+0x36/0x1c0 [ 1026.425106] ? __lock_is_held+0xb5/0x140 [ 1026.429182] ? check_same_owner+0x320/0x320 [ 1026.433538] ? rcu_note_context_switch+0x710/0x710 [ 1026.438482] __should_failslab+0x124/0x180 2018/04/10 12:55:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe], 0x1}, 0x5}, 0x1c) [ 1026.442724] should_failslab+0x9/0x14 [ 1026.446548] kmem_cache_alloc_node_trace+0x26f/0x770 [ 1026.451678] ? mark_held_locks+0xc9/0x160 [ 1026.455851] ? __raw_spin_lock_init+0x1c/0x100 [ 1026.460450] __kmalloc_node+0x33/0x70 [ 1026.464272] kvmalloc_node+0x6b/0x100 [ 1026.468079] __list_lru_init+0x559/0x790 [ 1026.472147] ? list_lru_destroy+0x4c0/0x4c0 [ 1026.476477] ? mark_held_locks+0xc9/0x160 [ 1026.480636] ? __raw_spin_lock_init+0x1c/0x100 [ 1026.485661] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1026.490688] ? lockdep_init_map+0x9/0x10 2018/04/10 12:55:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401000000000000], 0x1}, 0x5}, 0x1c) [ 1026.494767] sget_userns+0x706/0xf20 [ 1026.498480] ? set_anon_super+0x20/0x20 [ 1026.502459] ? get_empty_filp.cold.7+0x3e/0x3e [ 1026.507045] ? destroy_unused_super.part.9+0x100/0x100 [ 1026.512326] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1026.517356] ? zap_class+0x720/0x720 [ 1026.521070] ? kmem_cache_alloc+0x12e/0x760 [ 1026.525397] ? copy_process.part.38+0x36bf/0x6ee0 [ 1026.530249] ? graph_lock+0x170/0x170 [ 1026.534057] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1026.539602] mount_ns+0x8f/0x1d0 2018/04/10 12:55:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff000000000000], 0x1}, 0x5}, 0x1c) [ 1026.542979] ? proc_get_inode+0x670/0x670 [ 1026.547133] proc_mount+0x73/0xa0 [ 1026.550602] mount_fs+0xae/0x328 [ 1026.553985] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1026.558576] ? may_umount+0xb0/0xb0 [ 1026.562209] ? kasan_check_read+0x11/0x20 [ 1026.566357] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1026.570770] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1026.575356] ? idr_alloc+0x1a0/0x1a0 [ 1026.579074] kern_mount_data+0x50/0xc0 [ 1026.582991] pid_ns_prepare_proc+0x1e/0x90 [ 1026.587227] alloc_pid+0x8cf/0xa50 [ 1026.590778] ? __change_pid+0x410/0x410 2018/04/10 12:55:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000], 0x1}, 0x5}, 0x1c) [ 1026.594755] ? ns_capable_common+0x13f/0x170 [ 1026.599181] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1026.604727] ? memset+0x31/0x40 [ 1026.608021] ? copy_thread_tls+0x265/0x800 [ 1026.612265] copy_process.part.38+0x36bf/0x6ee0 [ 1026.616938] ? __lock_acquire+0x7f5/0x5130 [ 1026.621191] ? lock_acquire+0x1dc/0x520 [ 1026.625173] ? alloc_set_pte+0x1077/0x16a0 [ 1026.629424] ? __cleanup_sighand+0x70/0x70 [ 1026.633673] ? alloc_set_pte+0x1077/0x16a0 [ 1026.637915] ? print_usage_bug+0xc0/0xc0 [ 1026.641991] ? lock_downgrade+0x8e0/0x8e0 2018/04/10 12:55:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000], 0x1}, 0x5}, 0x1c) [ 1026.646149] ? debug_check_no_locks_freed+0x310/0x310 [ 1026.651344] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1026.656539] ? print_usage_bug+0xc0/0xc0 [ 1026.660617] ? debug_check_no_locks_freed+0x310/0x310 [ 1026.665812] ? __lock_acquire+0x7f5/0x5130 [ 1026.670058] ? debug_check_no_locks_freed+0x310/0x310 [ 1026.675254] ? perf_trace_lock+0xd6/0x900 [ 1026.679409] ? print_usage_bug+0xc0/0xc0 [ 1026.683476] ? zap_class+0x720/0x720 [ 1026.687189] ? perf_trace_lock+0xd6/0x900 [ 1026.691334] ? perf_trace_lock+0xd6/0x900 2018/04/10 12:55:55 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000], 0x1}, 0x5}, 0x1c) [ 1026.695480] ? graph_lock+0x170/0x170 [ 1026.699296] ? lock_acquire+0x1dc/0x520 [ 1026.703274] ? perf_trace_lock+0xd6/0x900 [ 1026.707437] ? zap_class+0x720/0x720 [ 1026.711155] ? find_held_lock+0x36/0x1c0 [ 1026.715228] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1026.720769] ? _parse_integer+0x13b/0x190 [ 1026.724920] ? graph_lock+0x170/0x170 [ 1026.728734] ? perf_trace_lock+0xd6/0x900 [ 1026.732887] ? _kstrtoull+0x180/0x230 [ 1026.736702] ? _parse_integer+0x190/0x190 [ 1026.740855] ? zap_class+0x720/0x720 [ 1026.744575] ? find_held_lock+0x36/0x1c0 [ 1026.748648] ? graph_lock+0x170/0x170 [ 1026.752459] ? perf_trace_lock+0xd6/0x900 [ 1026.756619] ? find_held_lock+0x36/0x1c0 [ 1026.760691] ? lock_downgrade+0x8e0/0x8e0 [ 1026.764846] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1026.770385] ? proc_fail_nth_write+0x96/0x1f0 [ 1026.774888] ? find_held_lock+0x36/0x1c0 [ 1026.778961] _do_fork+0x291/0x12a0 [ 1026.782506] ? fork_idle+0x1a0/0x1a0 [ 1026.786245] ? __sb_end_write+0xac/0xe0 [ 1026.790231] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1026.795766] ? fput+0x130/0x1a0 [ 1026.799051] ? ksys_write+0x1a6/0x250 [ 1026.802857] ? SyS_read+0x30/0x30 [ 1026.806316] ? mm_fault_error+0x380/0x380 [ 1026.810460] SyS_clone+0x37/0x50 [ 1026.813805] ? sys_vfork+0x30/0x30 [ 1026.817340] do_syscall_64+0x29e/0x9d0 [ 1026.821215] ? vmalloc_sync_all+0x30/0x30 [ 1026.825344] ? _raw_spin_unlock_irq+0x27/0x70 [ 1026.829832] ? finish_task_switch+0x1ca/0x820 [ 1026.834309] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1026.839217] ? syscall_return_slowpath+0x30f/0x5c0 [ 1026.844128] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1026.849486] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1026.854320] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1026.859497] RIP: 0033:0x455259 [ 1026.862676] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1026.870363] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1026.877610] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1026.884857] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1026.892105] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1026.899361] R13: 0000000000000051 R14: 00000000006f3838 R15: 000000000000001f [ 1027.146380] binder: 32748 RLIMIT_NICE not set [ 1027.153678] binder: 32747:32748 ioctl c0306201 20004000 returned -14 [ 1027.153681] binder: BINDER_SET_CONTEXT_MGR already set [ 1027.153696] binder: 32747:316 ioctl 40046207 0 returned -16 [ 1027.176054] binder_alloc: 32747: binder_alloc_buf, no vma [ 1027.181716] binder_alloc: 32747: binder_alloc_buf, no vma [ 1027.181727] binder: 32747:316 transaction failed 29189/-3, size 0-0 line 2963 [ 1027.194670] binder: 32747:317 transaction failed 29189/-3, size 0-0 line 2963 [ 1027.311919] binder: undelivered TRANSACTION_ERROR: 29189 [ 1027.317465] binder: undelivered TRANSACTION_ERROR: 29189 [ 1027.323082] binder: release 32747:316 transaction 809 out, still active [ 1027.329885] binder: undelivered TRANSACTION_COMPLETE [ 1027.335064] binder: send failed reply for transaction 810 to 32747:32748 [ 1027.341937] binder: release 32747:32748 transaction 809 in, still active [ 1027.348794] binder: send failed reply for transaction 809, target dead [ 1027.355496] binder: undelivered TRANSACTION_COMPLETE 2018/04/10 12:55:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:56 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:56 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0xfffffff5}}, 0x14) 2018/04/10 12:55:56 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000401808001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:56 executing program 7 (fault-call:0 fault-nth:32): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:56 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0xffffffa4}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:56 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:56 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x2, 0x0) [ 1027.360700] binder: undelivered TRANSACTION_ERROR: 29189 [ 1027.392748] FAULT_INJECTION: forcing a failure. [ 1027.392748] name failslab, interval 1, probability 0, space 0, times 0 [ 1027.404089] CPU: 0 PID: 330 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1027.410854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1027.420214] Call Trace: [ 1027.422813] dump_stack+0x1b9/0x294 [ 1027.426631] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1027.431833] ? __save_stack_trace+0x7e/0xd0 [ 1027.436203] should_fail.cold.4+0xa/0x1a 2018/04/10 12:55:56 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000], 0x1}, 0x5}, 0x1c) [ 1027.440281] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1027.445400] ? save_stack+0x43/0xd0 [ 1027.449031] ? kasan_kmalloc+0xc4/0xe0 [ 1027.452919] ? kmem_cache_alloc_trace+0x152/0x780 [ 1027.457767] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1027.462969] ? __list_lru_init+0x456/0x790 [ 1027.467207] ? sget_userns+0x706/0xf20 [ 1027.471107] ? graph_lock+0x170/0x170 [ 1027.474919] ? kern_mount_data+0x50/0xc0 [ 1027.478987] ? pid_ns_prepare_proc+0x1e/0x90 [ 1027.483402] ? alloc_pid+0x8cf/0xa50 [ 1027.487120] ? copy_process.part.38+0x36bf/0x6ee0 [ 1027.491970] ? _do_fork+0x291/0x12a0 [ 1027.495699] ? SyS_clone+0x37/0x50 [ 1027.498962] binder: 335 RLIMIT_NICE not set [ 1027.499248] ? find_held_lock+0x36/0x1c0 [ 1027.499271] ? __lock_is_held+0xb5/0x140 [ 1027.499297] ? check_same_owner+0x320/0x320 [ 1027.516064] ? rcu_note_context_switch+0x710/0x710 [ 1027.520988] __should_failslab+0x124/0x180 [ 1027.525228] should_failslab+0x9/0x14 [ 1027.529021] kmem_cache_alloc_trace+0x2cb/0x780 [ 1027.533680] ? __kmalloc_node+0x33/0x70 [ 1027.537640] ? __kmalloc_node+0x33/0x70 [ 1027.541612] ? rcu_read_lock_sched_held+0x108/0x120 [ 1027.546618] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1027.551626] ? kvfree_rcu+0x20/0x20 [ 1027.555240] ? __kmalloc_node+0x47/0x70 [ 1027.559212] __list_lru_init+0x456/0x790 [ 1027.563264] ? list_lru_destroy+0x4c0/0x4c0 [ 1027.567569] ? mark_held_locks+0xc9/0x160 [ 1027.571705] ? __raw_spin_lock_init+0x1c/0x100 [ 1027.576273] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1027.581277] ? lockdep_init_map+0x9/0x10 [ 1027.585324] sget_userns+0x706/0xf20 [ 1027.589111] ? set_anon_super+0x20/0x20 [ 1027.593070] ? get_empty_filp.cold.7+0x3e/0x3e [ 1027.597637] ? destroy_unused_super.part.9+0x100/0x100 [ 1027.602909] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1027.607918] ? zap_class+0x720/0x720 [ 1027.611616] ? kmem_cache_alloc+0x12e/0x760 [ 1027.615922] ? copy_process.part.38+0x36bf/0x6ee0 [ 1027.620754] ? graph_lock+0x170/0x170 [ 1027.624540] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1027.630069] mount_ns+0x8f/0x1d0 [ 1027.633424] ? proc_get_inode+0x670/0x670 [ 1027.637559] proc_mount+0x73/0xa0 [ 1027.641007] mount_fs+0xae/0x328 [ 1027.644374] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1027.648948] ? may_umount+0xb0/0xb0 [ 1027.652561] ? kasan_check_read+0x11/0x20 [ 1027.656695] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1027.661091] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1027.665662] ? idr_alloc+0x1a0/0x1a0 [ 1027.669364] kern_mount_data+0x50/0xc0 [ 1027.673237] pid_ns_prepare_proc+0x1e/0x90 [ 1027.677457] alloc_pid+0x8cf/0xa50 [ 1027.680988] ? __change_pid+0x410/0x410 [ 1027.684953] ? ns_capable_common+0x13f/0x170 [ 1027.689349] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1027.694873] ? memset+0x31/0x40 [ 1027.698142] ? copy_thread_tls+0x265/0x800 [ 1027.702368] copy_process.part.38+0x36bf/0x6ee0 [ 1027.707033] ? __lock_acquire+0x7f5/0x5130 [ 1027.711267] ? lock_acquire+0x1dc/0x520 [ 1027.715227] ? alloc_set_pte+0x1077/0x16a0 [ 1027.719459] ? __cleanup_sighand+0x70/0x70 [ 1027.723678] ? alloc_set_pte+0x1077/0x16a0 [ 1027.727915] ? print_usage_bug+0xc0/0xc0 [ 1027.731962] ? lock_downgrade+0x8e0/0x8e0 [ 1027.736104] ? debug_check_no_locks_freed+0x310/0x310 [ 1027.741284] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1027.746462] ? print_usage_bug+0xc0/0xc0 [ 1027.750526] ? debug_check_no_locks_freed+0x310/0x310 [ 1027.755701] ? __lock_acquire+0x7f5/0x5130 [ 1027.759934] ? debug_check_no_locks_freed+0x310/0x310 [ 1027.765119] ? print_usage_bug+0xc0/0xc0 [ 1027.769166] ? print_usage_bug+0xc0/0xc0 [ 1027.773215] ? graph_lock+0x170/0x170 [ 1027.777010] ? lock_acquire+0x1dc/0x520 [ 1027.780976] ? __fdget_pos+0x1a9/0x1e0 [ 1027.784851] ? graph_lock+0x170/0x170 [ 1027.788640] ? __lock_acquire+0x7f5/0x5130 [ 1027.792860] ? find_held_lock+0x36/0x1c0 [ 1027.796909] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1027.802429] ? _parse_integer+0x13b/0x190 [ 1027.806563] ? graph_lock+0x170/0x170 [ 1027.810349] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1027.815871] ? _kstrtoull+0x180/0x230 [ 1027.819658] ? _parse_integer+0x190/0x190 [ 1027.823789] ? graph_lock+0x170/0x170 [ 1027.827576] ? lock_release+0xa10/0xa10 [ 1027.831534] ? check_same_owner+0x320/0x320 [ 1027.835843] ? find_held_lock+0x36/0x1c0 [ 1027.839889] ? graph_lock+0x170/0x170 [ 1027.843678] ? lock_downgrade+0x8e0/0x8e0 [ 1027.847815] ? find_held_lock+0x36/0x1c0 [ 1027.851875] ? lock_downgrade+0x8e0/0x8e0 [ 1027.856012] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1027.861536] ? proc_fail_nth_write+0x96/0x1f0 [ 1027.866021] ? proc_cwd_link+0x1d0/0x1d0 [ 1027.870078] ? find_held_lock+0x36/0x1c0 [ 1027.874133] _do_fork+0x291/0x12a0 [ 1027.877664] ? fork_idle+0x1a0/0x1a0 [ 1027.881364] ? __lock_is_held+0xb5/0x140 [ 1027.885424] ? __sb_end_write+0xac/0xe0 [ 1027.889388] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1027.894908] ? fput+0x130/0x1a0 [ 1027.898173] ? ksys_write+0x1a6/0x250 [ 1027.901968] ? SyS_read+0x30/0x30 [ 1027.905408] ? mm_fault_error+0x380/0x380 [ 1027.909546] SyS_clone+0x37/0x50 [ 1027.912902] ? sys_vfork+0x30/0x30 [ 1027.916795] do_syscall_64+0x29e/0x9d0 [ 1027.922931] ? vmalloc_sync_all+0x30/0x30 [ 1027.927065] ? _raw_spin_unlock_irq+0x27/0x70 [ 1027.931561] ? finish_task_switch+0x1ca/0x820 [ 1027.936047] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1027.940962] ? syscall_return_slowpath+0x30f/0x5c0 [ 1027.945879] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1027.951235] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1027.956079] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1027.961253] RIP: 0033:0x455259 [ 1027.964425] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1027.972121] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1027.979375] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1027.986633] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 2018/04/10 12:55:56 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000030008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:56 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff00000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:56 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80, [], 0x3f00}}, 0x14) [ 1027.993894] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1028.001151] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000020 2018/04/10 12:55:56 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:56 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000ff3f08001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:56 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0x2}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:56 executing program 7 (fault-call:0 fault-nth:33): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) [ 1028.157494] FAULT_INJECTION: forcing a failure. [ 1028.157494] name failslab, interval 1, probability 0, space 0, times 0 [ 1028.168837] CPU: 0 PID: 364 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1028.175602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1028.184964] Call Trace: [ 1028.187569] dump_stack+0x1b9/0x294 [ 1028.191217] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1028.196404] binder: 335 RLIMIT_NICE not set [ 1028.198349] binder: 326:335 ioctl c0306201 20004000 returned -14 [ 1028.200736] ? __save_stack_trace+0x7e/0xd0 [ 1028.200764] should_fail.cold.4+0xa/0x1a [ 1028.200782] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1028.200806] ? save_stack+0x43/0xd0 [ 1028.200818] ? kasan_kmalloc+0xc4/0xe0 [ 1028.200837] ? kmem_cache_alloc_trace+0x152/0x780 [ 1028.232689] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1028.237866] ? __list_lru_init+0x456/0x790 [ 1028.242086] ? sget_userns+0x706/0xf20 [ 1028.246508] ? graph_lock+0x170/0x170 [ 1028.250299] ? kern_mount_data+0x50/0xc0 [ 1028.254345] ? pid_ns_prepare_proc+0x1e/0x90 [ 1028.258748] ? alloc_pid+0x8cf/0xa50 [ 1028.262449] ? copy_process.part.38+0x36bf/0x6ee0 [ 1028.267277] ? _do_fork+0x291/0x12a0 [ 1028.270974] ? SyS_clone+0x37/0x50 [ 1028.274504] ? find_held_lock+0x36/0x1c0 [ 1028.278562] ? __lock_is_held+0xb5/0x140 [ 1028.282641] ? check_same_owner+0x320/0x320 [ 1028.286951] ? rcu_note_context_switch+0x710/0x710 [ 1028.291875] __should_failslab+0x124/0x180 [ 1028.296100] should_failslab+0x9/0x14 [ 1028.299890] kmem_cache_alloc_trace+0x2cb/0x780 [ 1028.304543] ? __kmalloc_node+0x33/0x70 [ 1028.308501] ? __kmalloc_node+0x33/0x70 [ 1028.312502] ? rcu_read_lock_sched_held+0x108/0x120 [ 1028.317524] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1028.322533] ? kvfree_rcu+0x20/0x20 [ 1028.326147] ? __kmalloc_node+0x47/0x70 [ 1028.330113] __list_lru_init+0x456/0x790 [ 1028.334164] ? list_lru_destroy+0x4c0/0x4c0 [ 1028.338473] ? mark_held_locks+0xc9/0x160 [ 1028.342609] ? __raw_spin_lock_init+0x1c/0x100 [ 1028.347177] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1028.352180] ? lockdep_init_map+0x9/0x10 [ 1028.356226] sget_userns+0x706/0xf20 [ 1028.359921] ? set_anon_super+0x20/0x20 [ 1028.363887] ? get_empty_filp.cold.7+0x3e/0x3e [ 1028.368539] ? destroy_unused_super.part.9+0x100/0x100 [ 1028.373804] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1028.378818] ? zap_class+0x720/0x720 [ 1028.382513] ? kmem_cache_alloc+0x12e/0x760 [ 1028.386821] ? copy_process.part.38+0x36bf/0x6ee0 [ 1028.391657] ? graph_lock+0x170/0x170 [ 1028.395444] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1028.400972] mount_ns+0x8f/0x1d0 [ 1028.404321] ? proc_get_inode+0x670/0x670 [ 1028.408458] proc_mount+0x73/0xa0 [ 1028.411897] mount_fs+0xae/0x328 [ 1028.415256] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1028.419824] ? may_umount+0xb0/0xb0 [ 1028.423436] ? kasan_check_read+0x11/0x20 [ 1028.427567] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1028.431960] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1028.436526] ? idr_alloc+0x1a0/0x1a0 [ 1028.440226] kern_mount_data+0x50/0xc0 [ 1028.444097] pid_ns_prepare_proc+0x1e/0x90 [ 1028.448315] alloc_pid+0x8cf/0xa50 [ 1028.451843] ? __change_pid+0x410/0x410 [ 1028.455800] ? ns_capable_common+0x13f/0x170 [ 1028.460197] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1028.465721] ? memset+0x31/0x40 [ 1028.468989] ? copy_thread_tls+0x265/0x800 [ 1028.473230] copy_process.part.38+0x36bf/0x6ee0 [ 1028.477907] ? __lock_acquire+0x7f5/0x5130 [ 1028.482694] ? lock_acquire+0x1dc/0x520 [ 1028.486652] ? alloc_set_pte+0x1077/0x16a0 [ 1028.490897] ? __cleanup_sighand+0x70/0x70 [ 1028.495120] ? alloc_set_pte+0x1077/0x16a0 [ 1028.499349] ? print_usage_bug+0xc0/0xc0 [ 1028.503397] ? lock_downgrade+0x8e0/0x8e0 [ 1028.507534] ? debug_check_no_locks_freed+0x310/0x310 [ 1028.512708] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1028.517884] ? print_usage_bug+0xc0/0xc0 [ 1028.521947] ? debug_check_no_locks_freed+0x310/0x310 [ 1028.527127] ? __lock_acquire+0x7f5/0x5130 [ 1028.531349] ? debug_check_no_locks_freed+0x310/0x310 [ 1028.536527] ? perf_trace_lock+0xd6/0x900 [ 1028.540665] ? print_usage_bug+0xc0/0xc0 [ 1028.544713] ? zap_class+0x720/0x720 [ 1028.548415] ? perf_trace_lock+0xd6/0x900 [ 1028.552546] ? perf_trace_lock+0xd6/0x900 [ 1028.556776] ? graph_lock+0x170/0x170 [ 1028.560568] ? lock_acquire+0x1dc/0x520 [ 1028.564538] ? perf_trace_lock+0xd6/0x900 [ 1028.568678] ? zap_class+0x720/0x720 [ 1028.572377] ? find_held_lock+0x36/0x1c0 [ 1028.576426] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1028.581951] ? _parse_integer+0x13b/0x190 [ 1028.586084] ? graph_lock+0x170/0x170 [ 1028.589873] ? perf_trace_lock+0xd6/0x900 [ 1028.594005] ? _kstrtoull+0x180/0x230 [ 1028.597809] ? _parse_integer+0x190/0x190 [ 1028.601944] ? zap_class+0x720/0x720 [ 1028.605649] ? find_held_lock+0x36/0x1c0 [ 1028.609703] ? graph_lock+0x170/0x170 [ 1028.613495] ? perf_trace_lock+0xd6/0x900 [ 1028.617630] ? find_held_lock+0x36/0x1c0 [ 1028.621682] ? lock_downgrade+0x8e0/0x8e0 [ 1028.625818] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1028.631339] ? proc_fail_nth_write+0x96/0x1f0 [ 1028.635824] ? find_held_lock+0x36/0x1c0 [ 1028.639872] _do_fork+0x291/0x12a0 [ 1028.643403] ? fork_idle+0x1a0/0x1a0 [ 1028.647127] ? __sb_end_write+0xac/0xe0 [ 1028.651092] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1028.656615] ? fput+0x130/0x1a0 [ 1028.659881] ? ksys_write+0x1a6/0x250 [ 1028.663667] ? SyS_read+0x30/0x30 [ 1028.667105] ? mm_fault_error+0x380/0x380 [ 1028.671243] SyS_clone+0x37/0x50 [ 1028.674594] ? sys_vfork+0x30/0x30 [ 1028.678120] do_syscall_64+0x29e/0x9d0 [ 1028.682011] ? vmalloc_sync_all+0x30/0x30 [ 1028.686150] ? _raw_spin_unlock_irq+0x27/0x70 [ 1028.690630] ? finish_task_switch+0x1ca/0x820 [ 1028.695109] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1028.700048] ? syscall_return_slowpath+0x30f/0x5c0 [ 1028.704966] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1028.710317] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1028.715150] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1028.720324] RIP: 0033:0x455259 [ 1028.723497] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1028.731190] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1028.738534] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1028.745789] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1028.753045] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1028.760297] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000021 [ 1028.771226] binder: BINDER_SET_CONTEXT_MGR already set [ 1028.785604] binder: 326:368 ioctl 40046207 0 returned -16 [ 1028.798521] binder_alloc: 326: binder_alloc_buf, no vma [ 1028.803985] binder: 326:335 transaction failed 29189/-3, size 0-0 line 2963 [ 1028.815577] binder_alloc: 326: binder_alloc_buf, no vma [ 1028.821078] binder: 326:368 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:55:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000000000000000f0ff", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:55:57 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:57 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000020008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:55:57 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:55:57 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x6, 0x0) 2018/04/10 12:55:57 executing program 7 (fault-call:0 fault-nth:34): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:57 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0xd}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:57 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80}}, 0x8) [ 1028.851836] binder: undelivered TRANSACTION_ERROR: 29189 [ 1028.857420] binder: undelivered TRANSACTION_ERROR: 29189 [ 1028.868895] binder: release 326:335 transaction 815 out, still active [ 1028.875567] binder: release 326:335 transaction 814 in, still active [ 1028.882125] binder: undelivered TRANSACTION_COMPLETE [ 1028.887296] binder: release 326:368 transaction 814 out, still active [ 1028.893942] binder: undelivered TRANSACTION_COMPLETE [ 1028.899114] binder: send failed reply for transaction 815, target dead [ 1028.905868] binder: send failed reply for transaction 814, target dead [ 1028.917324] FAULT_INJECTION: forcing a failure. [ 1028.917324] name failslab, interval 1, probability 0, space 0, times 0 [ 1028.929073] CPU: 0 PID: 379 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1028.935843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1028.945213] Call Trace: [ 1028.947811] dump_stack+0x1b9/0x294 [ 1028.951438] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1028.956624] ? __save_stack_trace+0x7e/0xd0 [ 1028.960946] should_fail.cold.4+0xa/0x1a [ 1028.965003] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1028.970104] ? save_stack+0x43/0xd0 [ 1028.973717] ? kasan_kmalloc+0xc4/0xe0 [ 1028.977604] ? kmem_cache_alloc_trace+0x152/0x780 [ 1028.982435] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1028.987610] ? __list_lru_init+0x456/0x790 [ 1028.991828] ? sget_userns+0x706/0xf20 [ 1028.995706] ? graph_lock+0x170/0x170 [ 1028.999496] ? kern_mount_data+0x50/0xc0 [ 1029.003543] ? pid_ns_prepare_proc+0x1e/0x90 [ 1029.007936] ? alloc_pid+0x8cf/0xa50 [ 1029.011637] ? copy_process.part.38+0x36bf/0x6ee0 [ 1029.016463] ? _do_fork+0x291/0x12a0 [ 1029.020157] ? SyS_clone+0x37/0x50 [ 1029.023686] ? find_held_lock+0x36/0x1c0 [ 1029.027742] ? __lock_is_held+0xb5/0x140 [ 1029.031803] ? check_same_owner+0x320/0x320 [ 1029.036115] ? rcu_note_context_switch+0x710/0x710 [ 1029.041040] __should_failslab+0x124/0x180 [ 1029.045269] should_failslab+0x9/0x14 [ 1029.049062] kmem_cache_alloc_trace+0x2cb/0x780 [ 1029.053801] ? __kmalloc_node+0x33/0x70 [ 1029.057759] ? __kmalloc_node+0x33/0x70 [ 1029.061723] ? rcu_read_lock_sched_held+0x108/0x120 [ 1029.066738] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1029.071745] ? kvfree_rcu+0x20/0x20 [ 1029.075357] ? __kmalloc_node+0x47/0x70 [ 1029.079326] __list_lru_init+0x456/0x790 [ 1029.083377] ? list_lru_destroy+0x4c0/0x4c0 [ 1029.087682] ? mark_held_locks+0xc9/0x160 [ 1029.091821] ? __raw_spin_lock_init+0x1c/0x100 [ 1029.096422] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1029.101432] ? lockdep_init_map+0x9/0x10 [ 1029.105479] sget_userns+0x706/0xf20 [ 1029.109178] ? set_anon_super+0x20/0x20 [ 1029.113139] ? get_empty_filp.cold.7+0x3e/0x3e [ 1029.117705] ? destroy_unused_super.part.9+0x100/0x100 [ 1029.122973] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1029.127980] ? save_stack+0x43/0xd0 [ 1029.131592] ? kasan_kmalloc+0xc4/0xe0 [ 1029.135462] ? kasan_slab_alloc+0x12/0x20 [ 1029.139592] ? kmem_cache_alloc+0x12e/0x760 [ 1029.143897] ? copy_process.part.38+0x36bf/0x6ee0 [ 1029.148733] ? graph_lock+0x170/0x170 [ 1029.152537] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1029.158064] mount_ns+0x8f/0x1d0 [ 1029.161415] ? proc_get_inode+0x670/0x670 [ 1029.165561] proc_mount+0x73/0xa0 [ 1029.169001] mount_fs+0xae/0x328 [ 1029.172367] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1029.176936] ? may_umount+0xb0/0xb0 [ 1029.180546] ? kasan_check_read+0x11/0x20 [ 1029.184678] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1029.189075] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1029.193642] ? idr_alloc+0x1a0/0x1a0 [ 1029.197346] kern_mount_data+0x50/0xc0 [ 1029.201220] pid_ns_prepare_proc+0x1e/0x90 [ 1029.205441] alloc_pid+0x8cf/0xa50 [ 1029.208971] ? __change_pid+0x410/0x410 [ 1029.212931] ? ns_capable_common+0x13f/0x170 [ 1029.217327] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1029.222865] ? memset+0x31/0x40 [ 1029.226140] ? copy_thread_tls+0x265/0x800 [ 1029.230369] copy_process.part.38+0x36bf/0x6ee0 [ 1029.235030] ? __lock_acquire+0x7f5/0x5130 [ 1029.239255] ? lock_acquire+0x1dc/0x520 [ 1029.243213] ? alloc_set_pte+0x1077/0x16a0 [ 1029.247447] ? __cleanup_sighand+0x70/0x70 [ 1029.251665] ? alloc_set_pte+0x1077/0x16a0 [ 1029.255892] ? print_usage_bug+0xc0/0xc0 [ 1029.259941] ? lock_downgrade+0x8e0/0x8e0 [ 1029.264079] ? debug_check_no_locks_freed+0x310/0x310 [ 1029.269254] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1029.274441] ? print_usage_bug+0xc0/0xc0 [ 1029.278500] ? debug_check_no_locks_freed+0x310/0x310 [ 1029.283678] ? __lock_acquire+0x7f5/0x5130 [ 1029.287902] ? debug_check_no_locks_freed+0x310/0x310 [ 1029.293087] ? print_usage_bug+0xc0/0xc0 [ 1029.297134] ? print_usage_bug+0xc0/0xc0 [ 1029.301183] ? graph_lock+0x170/0x170 [ 1029.304976] ? lock_acquire+0x1dc/0x520 [ 1029.308936] ? __fdget_pos+0x1a9/0x1e0 [ 1029.312809] ? graph_lock+0x170/0x170 [ 1029.316600] ? __lock_acquire+0x7f5/0x5130 [ 1029.320821] ? find_held_lock+0x36/0x1c0 [ 1029.324880] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1029.330414] ? _parse_integer+0x13b/0x190 [ 1029.334552] ? graph_lock+0x170/0x170 [ 1029.338340] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1029.343868] ? _kstrtoull+0x180/0x230 [ 1029.347655] ? _parse_integer+0x190/0x190 [ 1029.351789] ? graph_lock+0x170/0x170 [ 1029.355573] ? lock_release+0xa10/0xa10 [ 1029.359533] ? check_same_owner+0x320/0x320 [ 1029.363852] ? find_held_lock+0x36/0x1c0 [ 1029.367902] ? graph_lock+0x170/0x170 [ 1029.371694] ? lock_downgrade+0x8e0/0x8e0 [ 1029.375840] ? find_held_lock+0x36/0x1c0 [ 1029.379894] ? lock_downgrade+0x8e0/0x8e0 [ 1029.384034] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1029.389734] ? proc_fail_nth_write+0x96/0x1f0 [ 1029.394216] ? proc_cwd_link+0x1d0/0x1d0 [ 1029.398284] ? find_held_lock+0x36/0x1c0 [ 1029.402334] _do_fork+0x291/0x12a0 [ 1029.405866] ? fork_idle+0x1a0/0x1a0 [ 1029.409566] ? __lock_is_held+0xb5/0x140 [ 1029.413625] ? __sb_end_write+0xac/0xe0 [ 1029.417592] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1029.423113] ? fput+0x130/0x1a0 [ 1029.426382] ? ksys_write+0x1a6/0x250 [ 1029.430175] ? SyS_read+0x30/0x30 [ 1029.433612] ? mm_fault_error+0x380/0x380 [ 1029.437751] SyS_clone+0x37/0x50 [ 1029.441103] ? sys_vfork+0x30/0x30 [ 1029.444632] do_syscall_64+0x29e/0x9d0 [ 1029.448504] ? vmalloc_sync_all+0x30/0x30 [ 1029.452638] ? _raw_spin_unlock_irq+0x27/0x70 [ 1029.457122] ? finish_task_switch+0x1ca/0x820 [ 1029.461604] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1029.466527] ? syscall_return_slowpath+0x30f/0x5c0 [ 1029.471451] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1029.476810] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1029.481647] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1029.486843] RIP: 0033:0x455259 [ 1029.490029] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 2018/04/10 12:55:58 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f4], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:58 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000184008001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1029.497733] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1029.504987] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1029.512245] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1029.519501] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1029.526755] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000022 [ 1029.543629] binder: 391 RLIMIT_NICE not set 2018/04/10 12:55:58 executing program 7 (fault-call:0 fault-nth:35): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:55:58 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:58 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0x1400000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:55:58 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000308001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) [ 1029.679281] FAULT_INJECTION: forcing a failure. [ 1029.679281] name failslab, interval 1, probability 0, space 0, times 0 [ 1029.690606] CPU: 0 PID: 409 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1029.697367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1029.706726] Call Trace: [ 1029.709333] dump_stack+0x1b9/0x294 [ 1029.712973] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1029.718181] ? __save_stack_trace+0x7e/0xd0 [ 1029.722525] should_fail.cold.4+0xa/0x1a [ 1029.726600] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1029.731705] ? save_stack+0x43/0xd0 [ 1029.735322] ? kasan_kmalloc+0xc4/0xe0 [ 1029.739194] ? kmem_cache_alloc_trace+0x152/0x780 [ 1029.744028] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1029.749202] ? __list_lru_init+0x456/0x790 [ 1029.753424] ? sget_userns+0x706/0xf20 [ 1029.757299] ? graph_lock+0x170/0x170 [ 1029.761085] ? kern_mount_data+0x50/0xc0 [ 1029.765216] ? pid_ns_prepare_proc+0x1e/0x90 [ 1029.769609] ? alloc_pid+0x8cf/0xa50 [ 1029.773308] ? copy_process.part.38+0x36bf/0x6ee0 [ 1029.778133] ? _do_fork+0x291/0x12a0 [ 1029.781832] ? SyS_clone+0x37/0x50 [ 1029.785362] ? find_held_lock+0x36/0x1c0 [ 1029.789410] ? __lock_is_held+0xb5/0x140 [ 1029.793466] ? check_same_owner+0x320/0x320 [ 1029.797777] ? rcu_note_context_switch+0x710/0x710 [ 1029.802700] __should_failslab+0x124/0x180 [ 1029.806922] should_failslab+0x9/0x14 [ 1029.810709] kmem_cache_alloc_trace+0x2cb/0x780 [ 1029.815364] ? __kmalloc_node+0x33/0x70 [ 1029.819322] ? __kmalloc_node+0x33/0x70 [ 1029.823286] ? rcu_read_lock_sched_held+0x108/0x120 [ 1029.828294] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1029.833296] ? kvfree_rcu+0x20/0x20 [ 1029.836909] ? __kmalloc_node+0x47/0x70 [ 1029.840876] __list_lru_init+0x456/0x790 [ 1029.844929] ? list_lru_destroy+0x4c0/0x4c0 [ 1029.849236] ? mark_held_locks+0xc9/0x160 [ 1029.853372] ? __raw_spin_lock_init+0x1c/0x100 [ 1029.857937] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1029.862942] ? lockdep_init_map+0x9/0x10 [ 1029.866990] sget_userns+0x706/0xf20 [ 1029.870689] ? set_anon_super+0x20/0x20 [ 1029.874655] ? get_empty_filp.cold.7+0x3e/0x3e [ 1029.879221] ? destroy_unused_super.part.9+0x100/0x100 [ 1029.884487] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1029.889496] ? zap_class+0x720/0x720 [ 1029.893193] ? kmem_cache_alloc+0x12e/0x760 [ 1029.897501] ? copy_process.part.38+0x36bf/0x6ee0 [ 1029.902338] ? graph_lock+0x170/0x170 [ 1029.906124] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1029.911658] mount_ns+0x8f/0x1d0 [ 1029.915010] ? proc_get_inode+0x670/0x670 [ 1029.919151] proc_mount+0x73/0xa0 [ 1029.922590] mount_fs+0xae/0x328 [ 1029.926123] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1029.930692] ? may_umount+0xb0/0xb0 [ 1029.934302] ? kasan_check_read+0x11/0x20 [ 1029.938436] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1029.942828] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1029.947395] ? idr_alloc+0x1a0/0x1a0 [ 1029.951096] kern_mount_data+0x50/0xc0 [ 1029.954968] pid_ns_prepare_proc+0x1e/0x90 [ 1029.959189] alloc_pid+0x8cf/0xa50 [ 1029.962725] ? __change_pid+0x410/0x410 [ 1029.966683] ? ns_capable_common+0x13f/0x170 [ 1029.971106] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1029.976638] ? memset+0x31/0x40 [ 1029.979905] ? copy_thread_tls+0x265/0x800 [ 1029.984132] copy_process.part.38+0x36bf/0x6ee0 [ 1029.988792] ? __lock_acquire+0x7f5/0x5130 [ 1029.993024] ? lock_acquire+0x1dc/0x520 [ 1029.996988] ? alloc_set_pte+0x1077/0x16a0 [ 1030.001220] ? __cleanup_sighand+0x70/0x70 [ 1030.005442] ? alloc_set_pte+0x1077/0x16a0 [ 1030.009671] ? print_usage_bug+0xc0/0xc0 [ 1030.013746] ? lock_downgrade+0x8e0/0x8e0 [ 1030.017897] ? debug_check_no_locks_freed+0x310/0x310 [ 1030.023169] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1030.028349] ? print_usage_bug+0xc0/0xc0 [ 1030.032409] ? debug_check_no_locks_freed+0x310/0x310 [ 1030.037585] ? __lock_acquire+0x7f5/0x5130 [ 1030.041808] ? debug_check_no_locks_freed+0x310/0x310 [ 1030.046987] ? perf_trace_lock+0xd6/0x900 [ 1030.051129] ? print_usage_bug+0xc0/0xc0 [ 1030.055180] ? zap_class+0x720/0x720 [ 1030.058879] ? perf_trace_lock+0xd6/0x900 [ 1030.063016] ? perf_trace_lock+0xd6/0x900 [ 1030.067152] ? graph_lock+0x170/0x170 [ 1030.070941] ? lock_acquire+0x1dc/0x520 [ 1030.074901] ? perf_trace_lock+0xd6/0x900 [ 1030.079045] ? zap_class+0x720/0x720 [ 1030.082743] ? find_held_lock+0x36/0x1c0 [ 1030.086793] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1030.092317] ? _parse_integer+0x13b/0x190 [ 1030.096453] ? graph_lock+0x170/0x170 [ 1030.100240] ? perf_trace_lock+0xd6/0x900 [ 1030.104373] ? _kstrtoull+0x180/0x230 [ 1030.108157] ? _parse_integer+0x190/0x190 [ 1030.112291] ? zap_class+0x720/0x720 [ 1030.115996] ? find_held_lock+0x36/0x1c0 [ 1030.120052] ? graph_lock+0x170/0x170 [ 1030.123846] ? perf_trace_lock+0xd6/0x900 [ 1030.127983] ? find_held_lock+0x36/0x1c0 [ 1030.132044] ? lock_downgrade+0x8e0/0x8e0 [ 1030.136179] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1030.141701] ? proc_fail_nth_write+0x96/0x1f0 [ 1030.146191] ? find_held_lock+0x36/0x1c0 [ 1030.150243] _do_fork+0x291/0x12a0 [ 1030.153773] ? fork_idle+0x1a0/0x1a0 [ 1030.157488] ? __sb_end_write+0xac/0xe0 [ 1030.161449] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1030.166966] ? fput+0x130/0x1a0 [ 1030.170232] ? ksys_write+0x1a6/0x250 [ 1030.174028] ? SyS_read+0x30/0x30 [ 1030.177469] ? mm_fault_error+0x380/0x380 [ 1030.181604] SyS_clone+0x37/0x50 [ 1030.184955] ? sys_vfork+0x30/0x30 [ 1030.188482] do_syscall_64+0x29e/0x9d0 [ 1030.192353] ? vmalloc_sync_all+0x30/0x30 [ 1030.196487] ? _raw_spin_unlock_irq+0x27/0x70 [ 1030.200970] ? finish_task_switch+0x1ca/0x820 [ 1030.205452] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1030.210367] ? syscall_return_slowpath+0x30f/0x5c0 [ 1030.215285] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1030.220725] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1030.225559] entry_SYSCALL_64_after_hwframe+0x42/0xb7 2018/04/10 12:55:59 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:55:59 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x5, 0x0) [ 1030.230731] RIP: 0033:0x455259 [ 1030.233903] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1030.241599] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1030.248856] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1030.256109] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1030.263362] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1030.270615] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000023 2018/04/10 12:56:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:56:00 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:56:00 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000408001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:56:00 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0x100000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:56:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:00 executing program 7 (fault-call:0 fault-nth:36): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:56:00 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x8, 0x0) 2018/04/10 12:56:00 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80}}, 0x3) [ 1031.404988] FAULT_INJECTION: forcing a failure. [ 1031.404988] name failslab, interval 1, probability 0, space 0, times 0 [ 1031.416339] CPU: 0 PID: 442 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1031.423103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1031.432578] Call Trace: [ 1031.435188] dump_stack+0x1b9/0x294 [ 1031.438836] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1031.444057] ? __save_stack_trace+0x7e/0xd0 [ 1031.448414] should_fail.cold.4+0xa/0x1a [ 1031.452492] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1031.457618] ? save_stack+0x43/0xd0 [ 1031.461253] ? kasan_kmalloc+0xc4/0xe0 [ 1031.465145] ? kmem_cache_alloc_trace+0x152/0x780 [ 1031.469998] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1031.475201] ? __list_lru_init+0x456/0x790 [ 1031.479444] ? sget_userns+0x706/0xf20 [ 1031.483349] ? graph_lock+0x170/0x170 [ 1031.487159] ? kern_mount_data+0x50/0xc0 [ 1031.491227] ? pid_ns_prepare_proc+0x1e/0x90 [ 1031.495650] ? alloc_pid+0x8cf/0xa50 [ 1031.499371] ? copy_process.part.38+0x36bf/0x6ee0 [ 1031.504224] ? _do_fork+0x291/0x12a0 [ 1031.507956] ? SyS_clone+0x37/0x50 [ 1031.511511] ? find_held_lock+0x36/0x1c0 [ 1031.515586] ? __lock_is_held+0xb5/0x140 [ 1031.519671] ? check_same_owner+0x320/0x320 [ 1031.524012] ? rcu_note_context_switch+0x710/0x710 [ 1031.528964] __should_failslab+0x124/0x180 [ 1031.533213] should_failslab+0x9/0x14 [ 1031.537021] kmem_cache_alloc_trace+0x2cb/0x780 [ 1031.541695] ? __kmalloc_node+0x33/0x70 [ 1031.545669] ? __kmalloc_node+0x33/0x70 [ 1031.549653] ? rcu_read_lock_sched_held+0x108/0x120 [ 1031.554689] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1031.559721] ? kvfree_rcu+0x20/0x20 [ 1031.563360] ? __kmalloc_node+0x47/0x70 [ 1031.567356] __list_lru_init+0x456/0x790 [ 1031.571424] ? list_lru_destroy+0x4c0/0x4c0 [ 1031.575755] ? mark_held_locks+0xc9/0x160 [ 1031.579913] ? __raw_spin_lock_init+0x1c/0x100 [ 1031.584509] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1031.589543] ? lockdep_init_map+0x9/0x10 [ 1031.593609] sget_userns+0x706/0xf20 [ 1031.597319] ? set_anon_super+0x20/0x20 [ 1031.601297] ? get_empty_filp.cold.7+0x3e/0x3e [ 1031.605880] ? destroy_unused_super.part.9+0x100/0x100 [ 1031.611181] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1031.616241] ? save_stack+0x43/0xd0 [ 1031.619870] ? kasan_kmalloc+0xc4/0xe0 [ 1031.623757] ? kasan_slab_alloc+0x12/0x20 [ 1031.627903] ? kmem_cache_alloc+0x12e/0x760 [ 1031.632222] ? copy_process.part.38+0x36bf/0x6ee0 [ 1031.637162] ? graph_lock+0x170/0x170 [ 1031.640963] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1031.646508] mount_ns+0x8f/0x1d0 [ 1031.649876] ? proc_get_inode+0x670/0x670 [ 1031.654030] proc_mount+0x73/0xa0 [ 1031.657499] mount_fs+0xae/0x328 [ 1031.660967] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1031.665553] ? may_umount+0xb0/0xb0 [ 1031.669181] ? kasan_check_read+0x11/0x20 [ 1031.673331] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1031.677744] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1031.682336] ? idr_alloc+0x1a0/0x1a0 [ 1031.686064] kern_mount_data+0x50/0xc0 [ 1031.689966] pid_ns_prepare_proc+0x1e/0x90 [ 1031.694209] alloc_pid+0x8cf/0xa50 [ 1031.697775] ? __change_pid+0x410/0x410 [ 1031.701762] ? ns_capable_common+0x13f/0x170 [ 1031.706181] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1031.711732] ? memset+0x31/0x40 [ 1031.715024] ? copy_thread_tls+0x265/0x800 [ 1031.719277] copy_process.part.38+0x36bf/0x6ee0 [ 1031.723960] ? __lock_acquire+0x7f5/0x5130 [ 1031.728202] ? lock_acquire+0x1dc/0x520 [ 1031.732184] ? alloc_set_pte+0x1077/0x16a0 [ 1031.736441] ? __cleanup_sighand+0x70/0x70 [ 1031.740691] ? alloc_set_pte+0x1077/0x16a0 [ 1031.744944] ? print_usage_bug+0xc0/0xc0 [ 1031.749001] ? lock_downgrade+0x8e0/0x8e0 [ 1031.753147] ? debug_check_no_locks_freed+0x310/0x310 [ 1031.758345] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1031.763536] ? print_usage_bug+0xc0/0xc0 [ 1031.767605] ? debug_check_no_locks_freed+0x310/0x310 [ 1031.772783] ? __lock_acquire+0x7f5/0x5130 [ 1031.777016] ? debug_check_no_locks_freed+0x310/0x310 [ 1031.782209] ? print_usage_bug+0xc0/0xc0 [ 1031.786259] ? print_usage_bug+0xc0/0xc0 [ 1031.790311] ? graph_lock+0x170/0x170 [ 1031.794102] ? lock_acquire+0x1dc/0x520 [ 1031.798075] ? __fdget_pos+0x1a9/0x1e0 [ 1031.802012] ? graph_lock+0x170/0x170 [ 1031.805808] ? __lock_acquire+0x7f5/0x5130 [ 1031.810036] ? find_held_lock+0x36/0x1c0 [ 1031.814086] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1031.819613] ? _parse_integer+0x13b/0x190 [ 1031.823749] ? graph_lock+0x170/0x170 [ 1031.827540] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1031.833063] ? _kstrtoull+0x180/0x230 [ 1031.836858] ? _parse_integer+0x190/0x190 [ 1031.841007] ? graph_lock+0x170/0x170 [ 1031.844802] ? lock_release+0xa10/0xa10 [ 1031.848767] ? check_same_owner+0x320/0x320 [ 1031.853082] ? find_held_lock+0x36/0x1c0 [ 1031.857133] ? graph_lock+0x170/0x170 [ 1031.860922] ? lock_downgrade+0x8e0/0x8e0 [ 1031.865080] ? find_held_lock+0x36/0x1c0 [ 1031.869155] ? lock_downgrade+0x8e0/0x8e0 [ 1031.873387] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1031.878911] ? proc_fail_nth_write+0x96/0x1f0 [ 1031.883409] ? proc_cwd_link+0x1d0/0x1d0 [ 1031.887468] ? find_held_lock+0x36/0x1c0 [ 1031.891518] _do_fork+0x291/0x12a0 [ 1031.895048] ? fork_idle+0x1a0/0x1a0 [ 1031.898761] ? __lock_is_held+0xb5/0x140 [ 1031.902820] ? __sb_end_write+0xac/0xe0 [ 1031.906790] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1031.912310] ? fput+0x130/0x1a0 [ 1031.915578] ? ksys_write+0x1a6/0x250 [ 1031.919365] ? SyS_read+0x30/0x30 [ 1031.922805] ? mm_fault_error+0x380/0x380 [ 1031.926952] SyS_clone+0x37/0x50 [ 1031.930310] ? sys_vfork+0x30/0x30 [ 1031.933838] do_syscall_64+0x29e/0x9d0 [ 1031.937707] ? vmalloc_sync_all+0x30/0x30 [ 1031.941840] ? _raw_spin_unlock_irq+0x27/0x70 [ 1031.946321] ? finish_task_switch+0x1ca/0x820 [ 1031.950805] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1031.955722] ? syscall_return_slowpath+0x30f/0x5c0 [ 1031.960644] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1031.965998] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1031.970839] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1031.976016] RIP: 0033:0x455259 [ 1031.979192] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1031.986890] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1031.994144] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 2018/04/10 12:56:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4010000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:00 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80}}, 0x4) 2018/04/10 12:56:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2800000000000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803], 0x1}, 0x5}, 0x1c) [ 1032.001397] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1032.008654] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1032.015908] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000024 [ 1032.028562] binder: 448 RLIMIT_NICE not set [ 1032.276492] binder: 448 RLIMIT_NICE not set [ 1032.282557] binder: BINDER_SET_CONTEXT_MGR already set [ 1032.282577] binder: 445:448 ioctl c0306201 20004000 returned -14 [ 1032.287978] binder: 445:477 ioctl 40046207 0 returned -16 [ 1032.304609] binder_alloc: 445: binder_alloc_buf, no vma [ 1032.310121] binder: 445:477 transaction failed 29189/-3, size 0-0 line 2963 [ 1032.310127] binder_alloc: 445: binder_alloc_buf, no vma [ 1032.310155] binder: 445:478 transaction failed 29189/-3, size 0-0 line 2963 2018/04/10 12:56:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:56:01 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57e], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:01 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80}}, 0x200019d4) 2018/04/10 12:56:01 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000208001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:56:01 executing program 7 (fault-call:0 fault-nth:37): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:56:01 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0x200000000000000}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:56:01 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:56:01 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x7ffff000, 0x0) [ 1032.447302] binder: undelivered TRANSACTION_ERROR: 29189 [ 1032.452871] binder: undelivered TRANSACTION_ERROR: 29189 [ 1032.459543] binder: release 445:448 transaction 821 out, still active [ 1032.466395] binder: release 445:448 transaction 820 in, still active [ 1032.472976] binder: undelivered TRANSACTION_COMPLETE [ 1032.478131] binder: release 445:477 transaction 820 out, still active [ 1032.485358] binder: undelivered TRANSACTION_COMPLETE [ 1032.490511] binder: send failed reply for transaction 821, target dead 2018/04/10 12:56:01 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], 0x1}, 0x5}, 0x1c) [ 1032.497220] binder: send failed reply for transaction 820, target dead [ 1032.525254] FAULT_INJECTION: forcing a failure. [ 1032.525254] name failslab, interval 1, probability 0, space 0, times 0 [ 1032.531121] binder: 497 RLIMIT_NICE not set [ 1032.536541] CPU: 0 PID: 494 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1032.536552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1032.536565] Call Trace: [ 1032.559557] dump_stack+0x1b9/0x294 [ 1032.563196] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1032.568406] ? __save_stack_trace+0x7e/0xd0 [ 1032.572750] should_fail.cold.4+0xa/0x1a [ 1032.576820] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1032.581924] ? save_stack+0x43/0xd0 [ 1032.585559] ? kasan_kmalloc+0xc4/0xe0 [ 1032.589449] ? kmem_cache_alloc_trace+0x152/0x780 [ 1032.594299] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1032.599495] ? __list_lru_init+0x456/0x790 [ 1032.603721] ? sget_userns+0x706/0xf20 [ 1032.607604] ? graph_lock+0x170/0x170 [ 1032.611396] ? kern_mount_data+0x50/0xc0 [ 1032.615445] ? pid_ns_prepare_proc+0x1e/0x90 [ 1032.619838] ? alloc_pid+0x8cf/0xa50 [ 1032.623540] ? copy_process.part.38+0x36bf/0x6ee0 [ 1032.628369] ? _do_fork+0x291/0x12a0 [ 1032.632070] ? SyS_clone+0x37/0x50 [ 1032.635598] ? find_held_lock+0x36/0x1c0 [ 1032.639654] ? __lock_is_held+0xb5/0x140 [ 1032.643718] ? check_same_owner+0x320/0x320 [ 1032.648161] ? rcu_note_context_switch+0x710/0x710 [ 1032.653103] __should_failslab+0x124/0x180 [ 1032.657337] should_failslab+0x9/0x14 [ 1032.661132] kmem_cache_alloc_trace+0x2cb/0x780 [ 1032.665790] ? __kmalloc_node+0x33/0x70 [ 1032.669747] ? __kmalloc_node+0x33/0x70 [ 1032.673710] ? rcu_read_lock_sched_held+0x108/0x120 [ 1032.678733] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1032.683738] ? kvfree_rcu+0x20/0x20 [ 1032.687352] ? __kmalloc_node+0x47/0x70 [ 1032.691318] __list_lru_init+0x456/0x790 [ 1032.695375] ? list_lru_destroy+0x4c0/0x4c0 [ 1032.699695] ? mark_held_locks+0xc9/0x160 [ 1032.703830] ? __raw_spin_lock_init+0x1c/0x100 [ 1032.708400] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1032.713413] ? lockdep_init_map+0x9/0x10 [ 1032.717462] sget_userns+0x706/0xf20 [ 1032.721159] ? set_anon_super+0x20/0x20 [ 1032.725121] ? get_empty_filp.cold.7+0x3e/0x3e [ 1032.729691] ? destroy_unused_super.part.9+0x100/0x100 [ 1032.734954] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1032.739961] ? save_stack+0x43/0xd0 [ 1032.743580] ? kasan_kmalloc+0xc4/0xe0 [ 1032.747453] ? kasan_slab_alloc+0x12/0x20 [ 1032.751582] ? kmem_cache_alloc+0x12e/0x760 [ 1032.755890] ? copy_process.part.38+0x36bf/0x6ee0 [ 1032.760722] ? graph_lock+0x170/0x170 [ 1032.764512] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1032.770051] mount_ns+0x8f/0x1d0 [ 1032.773409] ? proc_get_inode+0x670/0x670 [ 1032.777543] proc_mount+0x73/0xa0 [ 1032.780984] mount_fs+0xae/0x328 [ 1032.784354] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1032.788940] ? may_umount+0xb0/0xb0 [ 1032.792550] ? kasan_check_read+0x11/0x20 [ 1032.796682] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1032.801076] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1032.805644] ? idr_alloc+0x1a0/0x1a0 [ 1032.809352] kern_mount_data+0x50/0xc0 [ 1032.813234] pid_ns_prepare_proc+0x1e/0x90 [ 1032.817455] alloc_pid+0x8cf/0xa50 [ 1032.820987] ? __change_pid+0x410/0x410 [ 1032.824949] ? ns_capable_common+0x13f/0x170 [ 1032.829348] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1032.834880] ? memset+0x31/0x40 [ 1032.838149] ? copy_thread_tls+0x265/0x800 [ 1032.842378] copy_process.part.38+0x36bf/0x6ee0 [ 1032.847040] ? __lock_acquire+0x7f5/0x5130 [ 1032.851264] ? lock_acquire+0x1dc/0x520 [ 1032.855232] ? alloc_set_pte+0x1077/0x16a0 [ 1032.859464] ? __cleanup_sighand+0x70/0x70 [ 1032.863684] ? alloc_set_pte+0x1077/0x16a0 [ 1032.867909] ? print_usage_bug+0xc0/0xc0 [ 1032.871957] ? lock_downgrade+0x8e0/0x8e0 [ 1032.876096] ? debug_check_no_locks_freed+0x310/0x310 [ 1032.881271] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1032.886455] ? print_usage_bug+0xc0/0xc0 [ 1032.890519] ? debug_check_no_locks_freed+0x310/0x310 [ 1032.895697] ? __lock_acquire+0x7f5/0x5130 [ 1032.899916] ? debug_check_no_locks_freed+0x310/0x310 [ 1032.905100] ? print_usage_bug+0xc0/0xc0 [ 1032.909147] ? print_usage_bug+0xc0/0xc0 [ 1032.913200] ? graph_lock+0x170/0x170 [ 1032.916989] ? lock_acquire+0x1dc/0x520 [ 1032.920955] ? __fdget_pos+0x1a9/0x1e0 [ 1032.924831] ? graph_lock+0x170/0x170 [ 1032.928626] ? __lock_acquire+0x7f5/0x5130 [ 1032.932851] ? find_held_lock+0x36/0x1c0 [ 1032.936910] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1032.942433] ? _parse_integer+0x13b/0x190 [ 1032.946581] ? graph_lock+0x170/0x170 [ 1032.950374] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1032.955896] ? _kstrtoull+0x180/0x230 [ 1032.959680] ? _parse_integer+0x190/0x190 [ 1032.963811] ? graph_lock+0x170/0x170 [ 1032.967600] ? lock_release+0xa10/0xa10 [ 1032.971579] ? check_same_owner+0x320/0x320 [ 1032.975890] ? find_held_lock+0x36/0x1c0 [ 1032.979941] ? graph_lock+0x170/0x170 [ 1032.983732] ? lock_downgrade+0x8e0/0x8e0 [ 1032.987871] ? find_held_lock+0x36/0x1c0 [ 1032.991926] ? lock_downgrade+0x8e0/0x8e0 [ 1032.996061] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1033.001588] ? proc_fail_nth_write+0x96/0x1f0 [ 1033.006070] ? proc_cwd_link+0x1d0/0x1d0 [ 1033.010119] ? find_held_lock+0x36/0x1c0 [ 1033.014168] _do_fork+0x291/0x12a0 [ 1033.017697] ? fork_idle+0x1a0/0x1a0 [ 1033.021396] ? __lock_is_held+0xb5/0x140 [ 1033.025453] ? __sb_end_write+0xac/0xe0 [ 1033.029413] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1033.034930] ? fput+0x130/0x1a0 [ 1033.038195] ? ksys_write+0x1a6/0x250 [ 1033.041982] ? SyS_read+0x30/0x30 [ 1033.045419] ? mm_fault_error+0x380/0x380 [ 1033.049558] SyS_clone+0x37/0x50 [ 1033.052908] ? sys_vfork+0x30/0x30 [ 1033.056437] do_syscall_64+0x29e/0x9d0 [ 1033.060309] ? vmalloc_sync_all+0x30/0x30 [ 1033.064440] ? _raw_spin_unlock_irq+0x27/0x70 [ 1033.068920] ? finish_task_switch+0x1ca/0x820 [ 1033.073402] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1033.078319] ? syscall_return_slowpath+0x30f/0x5c0 [ 1033.083240] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1033.088592] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1033.093424] entry_SYSCALL_64_after_hwframe+0x42/0xb7 2018/04/10 12:56:01 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000], 0x1}, 0x5}, 0x1c) [ 1033.098599] RIP: 0033:0x455259 [ 1033.101772] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1033.109465] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1033.116718] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1033.123975] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1033.131226] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1033.138482] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000025 2018/04/10 12:56:02 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000508001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:56:02 executing program 7 (fault-call:0 fault-nth:38): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:56:02 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8030000], 0x1}, 0x5}, 0x1c) [ 1033.280222] FAULT_INJECTION: forcing a failure. [ 1033.280222] name failslab, interval 1, probability 0, space 0, times 0 [ 1033.291538] CPU: 0 PID: 510 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1033.298290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1033.307636] Call Trace: [ 1033.310213] dump_stack+0x1b9/0x294 [ 1033.313830] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1033.319011] ? __save_stack_trace+0x7e/0xd0 [ 1033.323365] should_fail.cold.4+0xa/0x1a [ 1033.327489] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1033.332580] ? save_stack+0x43/0xd0 [ 1033.336193] ? kasan_kmalloc+0xc4/0xe0 [ 1033.340063] ? kmem_cache_alloc_trace+0x152/0x780 [ 1033.344889] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1033.350075] ? __list_lru_init+0x456/0x790 [ 1033.354300] ? sget_userns+0x706/0xf20 [ 1033.358186] ? graph_lock+0x170/0x170 [ 1033.361975] ? kern_mount_data+0x50/0xc0 [ 1033.366025] ? pid_ns_prepare_proc+0x1e/0x90 [ 1033.370420] ? alloc_pid+0x8cf/0xa50 [ 1033.374122] ? copy_process.part.38+0x36bf/0x6ee0 [ 1033.378952] ? _do_fork+0x291/0x12a0 [ 1033.382649] ? SyS_clone+0x37/0x50 [ 1033.386177] ? find_held_lock+0x36/0x1c0 [ 1033.390229] ? __lock_is_held+0xb5/0x140 [ 1033.394295] ? check_same_owner+0x320/0x320 [ 1033.398631] ? rcu_note_context_switch+0x710/0x710 [ 1033.403553] __should_failslab+0x124/0x180 [ 1033.407776] should_failslab+0x9/0x14 [ 1033.411560] kmem_cache_alloc_trace+0x2cb/0x780 [ 1033.416212] ? __kmalloc_node+0x33/0x70 [ 1033.420169] ? __kmalloc_node+0x33/0x70 [ 1033.424132] ? rcu_read_lock_sched_held+0x108/0x120 [ 1033.429140] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1033.434143] ? kvfree_rcu+0x20/0x20 [ 1033.437754] ? __kmalloc_node+0x47/0x70 [ 1033.441722] __list_lru_init+0x456/0x790 [ 1033.445771] ? list_lru_destroy+0x4c0/0x4c0 [ 1033.450079] ? mark_held_locks+0xc9/0x160 [ 1033.454214] ? __raw_spin_lock_init+0x1c/0x100 [ 1033.458782] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1033.463791] ? lockdep_init_map+0x9/0x10 [ 1033.467840] sget_userns+0x706/0xf20 [ 1033.471535] ? set_anon_super+0x20/0x20 [ 1033.475499] ? get_empty_filp.cold.7+0x3e/0x3e [ 1033.480067] ? destroy_unused_super.part.9+0x100/0x100 [ 1033.485335] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1033.490349] ? zap_class+0x720/0x720 [ 1033.494046] ? kmem_cache_alloc+0x12e/0x760 [ 1033.498353] ? copy_process.part.38+0x36bf/0x6ee0 [ 1033.503196] ? graph_lock+0x170/0x170 [ 1033.506983] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1033.512524] mount_ns+0x8f/0x1d0 [ 1033.515876] ? proc_get_inode+0x670/0x670 [ 1033.520011] proc_mount+0x73/0xa0 [ 1033.523457] mount_fs+0xae/0x328 [ 1033.526817] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1033.531387] ? may_umount+0xb0/0xb0 [ 1033.534997] ? kasan_check_read+0x11/0x20 [ 1033.539135] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1033.543529] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1033.548097] ? idr_alloc+0x1a0/0x1a0 [ 1033.551796] kern_mount_data+0x50/0xc0 [ 1033.555670] pid_ns_prepare_proc+0x1e/0x90 [ 1033.559890] alloc_pid+0x8cf/0xa50 [ 1033.563417] ? __change_pid+0x410/0x410 [ 1033.567373] ? ns_capable_common+0x13f/0x170 [ 1033.571768] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1033.577291] ? memset+0x31/0x40 [ 1033.580569] ? copy_thread_tls+0x265/0x800 [ 1033.584793] copy_process.part.38+0x36bf/0x6ee0 [ 1033.589450] ? __lock_acquire+0x7f5/0x5130 [ 1033.593674] ? lock_acquire+0x1dc/0x520 [ 1033.597633] ? alloc_set_pte+0x1077/0x16a0 [ 1033.601865] ? __cleanup_sighand+0x70/0x70 [ 1033.606082] ? alloc_set_pte+0x1077/0x16a0 [ 1033.610312] ? print_usage_bug+0xc0/0xc0 [ 1033.614369] ? lock_downgrade+0x8e0/0x8e0 [ 1033.618510] ? debug_check_no_locks_freed+0x310/0x310 [ 1033.623684] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1033.628859] ? print_usage_bug+0xc0/0xc0 [ 1033.632915] ? debug_check_no_locks_freed+0x310/0x310 [ 1033.638091] ? __lock_acquire+0x7f5/0x5130 [ 1033.642337] ? debug_check_no_locks_freed+0x310/0x310 [ 1033.647512] ? perf_trace_lock+0xd6/0x900 [ 1033.651650] ? print_usage_bug+0xc0/0xc0 [ 1033.655697] ? zap_class+0x720/0x720 [ 1033.659397] ? perf_trace_lock+0xd6/0x900 [ 1033.663529] ? perf_trace_lock+0xd6/0x900 [ 1033.667662] ? graph_lock+0x170/0x170 [ 1033.671451] ? lock_acquire+0x1dc/0x520 [ 1033.675409] ? perf_trace_lock+0xd6/0x900 [ 1033.679546] ? zap_class+0x720/0x720 [ 1033.683244] ? find_held_lock+0x36/0x1c0 [ 1033.687316] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1033.692838] ? _parse_integer+0x13b/0x190 [ 1033.696979] ? graph_lock+0x170/0x170 [ 1033.700765] ? perf_trace_lock+0xd6/0x900 [ 1033.704895] ? _kstrtoull+0x180/0x230 [ 1033.708681] ? _parse_integer+0x190/0x190 [ 1033.712817] ? zap_class+0x720/0x720 [ 1033.716516] ? find_held_lock+0x36/0x1c0 [ 1033.720564] ? graph_lock+0x170/0x170 [ 1033.724355] ? perf_trace_lock+0xd6/0x900 [ 1033.728491] ? find_held_lock+0x36/0x1c0 [ 1033.732547] ? lock_downgrade+0x8e0/0x8e0 [ 1033.736681] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1033.742200] ? proc_fail_nth_write+0x96/0x1f0 [ 1033.746688] ? find_held_lock+0x36/0x1c0 [ 1033.750751] _do_fork+0x291/0x12a0 [ 1033.754286] ? fork_idle+0x1a0/0x1a0 [ 1033.758016] ? __sb_end_write+0xac/0xe0 [ 1033.761981] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1033.767499] ? fput+0x130/0x1a0 [ 1033.770764] ? ksys_write+0x1a6/0x250 [ 1033.774554] ? SyS_read+0x30/0x30 [ 1033.777990] ? mm_fault_error+0x380/0x380 [ 1033.782132] SyS_clone+0x37/0x50 [ 1033.785481] ? sys_vfork+0x30/0x30 [ 1033.789012] do_syscall_64+0x29e/0x9d0 [ 1033.792887] ? vmalloc_sync_all+0x30/0x30 [ 1033.797026] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 1033.801855] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1033.806768] ? syscall_return_slowpath+0x30f/0x5c0 [ 1033.811688] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1033.817044] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1033.821878] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1033.827050] RIP: 0033:0x455259 [ 1033.830224] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1033.837918] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1033.845169] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1033.852429] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1033.859682] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1033.866935] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000026 2018/04/10 12:56:02 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:56:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="116348400000000000000000007f", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:56:03 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0x4d0, 0x0) 2018/04/10 12:56:03 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c700000000000000000300050000000000020000000000000000000000000000000e001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:56:03 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:03 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0x1400}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) 2018/04/10 12:56:03 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80}}, 0xe) 2018/04/10 12:56:03 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:56:03 executing program 7 (fault-call:0 fault-nth:39): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) [ 1034.790817] FAULT_INJECTION: forcing a failure. [ 1034.790817] name failslab, interval 1, probability 0, space 0, times 0 [ 1034.802123] CPU: 0 PID: 531 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1034.808883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1034.818222] Call Trace: [ 1034.820805] dump_stack+0x1b9/0x294 [ 1034.824428] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1034.829608] ? __save_stack_trace+0x7e/0xd0 [ 1034.833928] should_fail.cold.4+0xa/0x1a [ 1034.837982] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1034.843073] ? save_stack+0x43/0xd0 [ 1034.846685] ? kasan_kmalloc+0xc4/0xe0 [ 1034.850556] ? kmem_cache_alloc_trace+0x152/0x780 [ 1034.855395] ? __memcg_init_list_lru_node+0x17d/0x2c0 [ 1034.860568] ? __list_lru_init+0x456/0x790 [ 1034.864788] ? sget_userns+0x706/0xf20 [ 1034.868667] ? graph_lock+0x170/0x170 [ 1034.872514] ? kern_mount_data+0x50/0xc0 [ 1034.876563] ? pid_ns_prepare_proc+0x1e/0x90 [ 1034.880956] ? alloc_pid+0x8cf/0xa50 [ 1034.884657] ? copy_process.part.38+0x36bf/0x6ee0 [ 1034.889483] ? _do_fork+0x291/0x12a0 [ 1034.893193] ? SyS_clone+0x37/0x50 [ 1034.896724] ? find_held_lock+0x36/0x1c0 [ 1034.900785] ? __lock_is_held+0xb5/0x140 [ 1034.904845] ? check_same_owner+0x320/0x320 [ 1034.909153] ? rcu_note_context_switch+0x710/0x710 [ 1034.914085] __should_failslab+0x124/0x180 [ 1034.918310] should_failslab+0x9/0x14 [ 1034.922095] kmem_cache_alloc_trace+0x2cb/0x780 [ 1034.926749] ? __kmalloc_node+0x33/0x70 [ 1034.930706] ? __kmalloc_node+0x33/0x70 [ 1034.934668] ? rcu_read_lock_sched_held+0x108/0x120 [ 1034.939676] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1034.944685] ? kvfree_rcu+0x20/0x20 [ 1034.948299] ? __kmalloc_node+0x47/0x70 [ 1034.952266] __list_lru_init+0x456/0x790 [ 1034.956324] ? list_lru_destroy+0x4c0/0x4c0 [ 1034.960643] ? mark_held_locks+0xc9/0x160 [ 1034.964784] ? __raw_spin_lock_init+0x1c/0x100 [ 1034.969354] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1034.974370] ? lockdep_init_map+0x9/0x10 [ 1034.978428] sget_userns+0x706/0xf20 [ 1034.982125] ? set_anon_super+0x20/0x20 [ 1034.986091] ? get_empty_filp.cold.7+0x3e/0x3e [ 1034.990661] ? destroy_unused_super.part.9+0x100/0x100 [ 1034.995926] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1035.000934] ? save_stack+0x43/0xd0 [ 1035.004554] ? kasan_kmalloc+0xc4/0xe0 [ 1035.008424] ? kasan_slab_alloc+0x12/0x20 [ 1035.012554] ? kmem_cache_alloc+0x12e/0x760 [ 1035.016858] ? copy_process.part.38+0x36bf/0x6ee0 [ 1035.021692] ? graph_lock+0x170/0x170 [ 1035.025480] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1035.031009] mount_ns+0x8f/0x1d0 [ 1035.034372] ? proc_get_inode+0x670/0x670 [ 1035.038507] proc_mount+0x73/0xa0 [ 1035.041944] mount_fs+0xae/0x328 [ 1035.045304] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1035.049870] ? may_umount+0xb0/0xb0 [ 1035.053479] ? kasan_check_read+0x11/0x20 [ 1035.057611] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1035.062009] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1035.066583] ? idr_alloc+0x1a0/0x1a0 [ 1035.070285] kern_mount_data+0x50/0xc0 [ 1035.074163] pid_ns_prepare_proc+0x1e/0x90 [ 1035.078381] alloc_pid+0x8cf/0xa50 [ 1035.081910] ? __change_pid+0x410/0x410 [ 1035.085868] ? ns_capable_common+0x13f/0x170 [ 1035.090267] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1035.095788] ? memset+0x31/0x40 [ 1035.099055] ? copy_thread_tls+0x265/0x800 [ 1035.103280] copy_process.part.38+0x36bf/0x6ee0 [ 1035.107934] ? attach_entity_load_avg+0x830/0x830 [ 1035.112771] ? update_load_avg+0x2d9/0x2540 [ 1035.117074] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1035.122087] ? __cleanup_sighand+0x70/0x70 [ 1035.126305] ? alloc_set_pte+0x1077/0x16a0 [ 1035.130530] ? print_usage_bug+0xc0/0xc0 [ 1035.134576] ? graph_lock+0x170/0x170 [ 1035.138359] ? find_held_lock+0x36/0x1c0 [ 1035.142413] ? debug_check_no_locks_freed+0x310/0x310 [ 1035.147591] ? print_usage_bug+0xc0/0xc0 [ 1035.151639] ? graph_lock+0x170/0x170 [ 1035.155434] ? debug_check_no_locks_freed+0x310/0x310 [ 1035.160609] ? graph_lock+0x170/0x170 [ 1035.164397] ? __lock_acquire+0x7f5/0x5130 [ 1035.168618] ? debug_check_no_locks_freed+0x310/0x310 [ 1035.173807] ? print_usage_bug+0xc0/0xc0 [ 1035.177853] ? set_next_entity+0x2ae/0xaf0 [ 1035.182071] ? graph_lock+0x170/0x170 [ 1035.185858] ? update_load_avg+0x2540/0x2540 [ 1035.190255] ? lock_acquire+0x1dc/0x520 [ 1035.194211] ? __fdget_pos+0x1a9/0x1e0 [ 1035.198085] ? graph_lock+0x170/0x170 [ 1035.201872] ? __lock_acquire+0x7f5/0x5130 [ 1035.206092] ? find_held_lock+0x36/0x1c0 [ 1035.210140] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1035.215666] ? _parse_integer+0x13b/0x190 [ 1035.219800] ? graph_lock+0x170/0x170 [ 1035.223587] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1035.229109] ? _kstrtoull+0x180/0x230 [ 1035.232894] ? _parse_integer+0x190/0x190 [ 1035.237038] ? graph_lock+0x170/0x170 [ 1035.240823] ? lock_release+0xa10/0xa10 [ 1035.244783] ? check_same_owner+0x320/0x320 [ 1035.249093] ? find_held_lock+0x36/0x1c0 [ 1035.253152] ? graph_lock+0x170/0x170 [ 1035.256941] ? lock_downgrade+0x8e0/0x8e0 [ 1035.261080] ? find_held_lock+0x36/0x1c0 [ 1035.265133] ? lock_downgrade+0x8e0/0x8e0 [ 1035.269270] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1035.274796] ? proc_fail_nth_write+0x96/0x1f0 [ 1035.279278] ? proc_cwd_link+0x1d0/0x1d0 [ 1035.283324] ? __schedule+0x80f/0x1e40 [ 1035.287197] ? find_held_lock+0x36/0x1c0 [ 1035.291246] _do_fork+0x291/0x12a0 [ 1035.294783] ? fork_idle+0x1a0/0x1a0 [ 1035.298485] ? __lock_is_held+0xb5/0x140 [ 1035.302546] ? __sb_end_write+0xac/0xe0 [ 1035.306511] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1035.312035] ? fput+0x130/0x1a0 [ 1035.315308] ? ksys_write+0x1a6/0x250 [ 1035.319094] ? SyS_read+0x30/0x30 [ 1035.322530] ? mm_fault_error+0x380/0x380 [ 1035.326666] SyS_clone+0x37/0x50 [ 1035.330023] ? sys_vfork+0x30/0x30 [ 1035.333565] do_syscall_64+0x29e/0x9d0 [ 1035.337438] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 1035.342265] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1035.347183] ? syscall_return_slowpath+0x30f/0x5c0 [ 1035.352105] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1035.357462] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1035.362304] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1035.367477] RIP: 0033:0x455259 [ 1035.370653] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1035.378348] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1035.385604] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 2018/04/10 12:56:04 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:04 executing program 7 (fault-call:0 fault-nth:40): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) [ 1035.392858] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1035.400108] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1035.407379] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000027 [ 1035.420694] binder: 539 RLIMIT_NICE not set [ 1035.493177] FAULT_INJECTION: forcing a failure. [ 1035.493177] name failslab, interval 1, probability 0, space 0, times 0 [ 1035.504681] CPU: 0 PID: 553 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1035.511464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1035.520826] Call Trace: [ 1035.523403] dump_stack+0x1b9/0x294 [ 1035.527026] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1035.532206] ? finish_task_switch+0x1ca/0x820 [ 1035.536691] ? finish_task_switch+0x182/0x820 [ 1035.541176] should_fail.cold.4+0xa/0x1a [ 1035.545231] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1035.550324] ? __schedule+0x80f/0x1e40 [ 1035.554197] ? kern_mount_data+0x50/0xc0 [ 1035.558249] ? pid_ns_prepare_proc+0x1e/0x90 [ 1035.562652] ? __sched_text_start+0x8/0x8 [ 1035.566785] ? find_held_lock+0x36/0x1c0 [ 1035.570833] ? __lock_is_held+0xb5/0x140 [ 1035.574888] ? check_same_owner+0x320/0x320 [ 1035.579201] __should_failslab+0x124/0x180 [ 1035.583422] should_failslab+0x9/0x14 [ 1035.587209] kmem_cache_alloc_trace+0x2cb/0x780 [ 1035.591861] ? __kmalloc_node+0x33/0x70 [ 1035.595817] ? __kmalloc_node+0x33/0x70 [ 1035.599789] ? rcu_read_lock_sched_held+0x108/0x120 [ 1035.604793] __memcg_init_list_lru_node+0x17d/0x2c0 [ 1035.609797] ? kvfree_rcu+0x20/0x20 [ 1035.613409] ? __kmalloc_node+0x47/0x70 [ 1035.617373] __list_lru_init+0x456/0x790 [ 1035.621420] ? list_lru_destroy+0x4c0/0x4c0 [ 1035.625731] ? mark_held_locks+0xc9/0x160 [ 1035.629870] ? __raw_spin_lock_init+0x1c/0x100 [ 1035.634439] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1035.639442] ? lockdep_init_map+0x9/0x10 [ 1035.643489] sget_userns+0x706/0xf20 [ 1035.647189] ? set_anon_super+0x20/0x20 [ 1035.651151] ? get_empty_filp.cold.7+0x3e/0x3e [ 1035.655716] ? destroy_unused_super.part.9+0x100/0x100 [ 1035.660983] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1035.666000] ? zap_class+0x720/0x720 [ 1035.669704] ? kmem_cache_alloc+0x12e/0x760 [ 1035.674019] ? copy_process.part.38+0x36bf/0x6ee0 [ 1035.678855] ? graph_lock+0x170/0x170 [ 1035.682639] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1035.688163] mount_ns+0x8f/0x1d0 [ 1035.691513] ? proc_get_inode+0x670/0x670 [ 1035.695646] proc_mount+0x73/0xa0 [ 1035.699085] mount_fs+0xae/0x328 [ 1035.702442] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1035.707031] ? may_umount+0xb0/0xb0 [ 1035.710641] ? kasan_check_read+0x11/0x20 [ 1035.714772] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1035.719162] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1035.723743] ? idr_alloc+0x1a0/0x1a0 [ 1035.727443] kern_mount_data+0x50/0xc0 [ 1035.731320] pid_ns_prepare_proc+0x1e/0x90 [ 1035.735536] alloc_pid+0x8cf/0xa50 [ 1035.739063] ? __change_pid+0x410/0x410 [ 1035.743025] ? ns_capable_common+0x13f/0x170 [ 1035.747428] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1035.752963] ? memset+0x31/0x40 [ 1035.756233] ? copy_thread_tls+0x265/0x800 [ 1035.760455] copy_process.part.38+0x36bf/0x6ee0 [ 1035.765113] ? __lock_acquire+0x7f5/0x5130 [ 1035.769333] ? lock_acquire+0x1dc/0x520 [ 1035.773288] ? alloc_set_pte+0x1077/0x16a0 [ 1035.777524] ? __cleanup_sighand+0x70/0x70 [ 1035.781739] ? alloc_set_pte+0x1077/0x16a0 [ 1035.785961] ? print_usage_bug+0xc0/0xc0 [ 1035.790097] ? lock_downgrade+0x8e0/0x8e0 [ 1035.794232] ? debug_check_no_locks_freed+0x310/0x310 [ 1035.799414] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1035.804587] ? print_usage_bug+0xc0/0xc0 [ 1035.808640] ? debug_check_no_locks_freed+0x310/0x310 [ 1035.813815] ? __lock_acquire+0x7f5/0x5130 [ 1035.818040] ? debug_check_no_locks_freed+0x310/0x310 [ 1035.823217] ? perf_trace_lock+0xd6/0x900 [ 1035.827354] ? print_usage_bug+0xc0/0xc0 [ 1035.831401] ? zap_class+0x720/0x720 [ 1035.835103] ? perf_trace_lock+0xd6/0x900 [ 1035.839241] ? perf_trace_lock+0xd6/0x900 [ 1035.843380] ? graph_lock+0x170/0x170 [ 1035.847180] ? lock_acquire+0x1dc/0x520 [ 1035.851138] ? perf_trace_lock+0xd6/0x900 [ 1035.855272] ? zap_class+0x720/0x720 [ 1035.858987] ? find_held_lock+0x36/0x1c0 [ 1035.863041] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1035.868561] ? _parse_integer+0x13b/0x190 [ 1035.872692] ? graph_lock+0x170/0x170 [ 1035.876476] ? perf_trace_lock+0xd6/0x900 [ 1035.880608] ? _kstrtoull+0x180/0x230 [ 1035.884397] ? _parse_integer+0x190/0x190 [ 1035.888537] ? zap_class+0x720/0x720 [ 1035.892239] ? find_held_lock+0x36/0x1c0 [ 1035.896287] ? graph_lock+0x170/0x170 [ 1035.900077] ? perf_trace_lock+0xd6/0x900 [ 1035.904214] ? find_held_lock+0x36/0x1c0 [ 1035.908263] ? lock_downgrade+0x8e0/0x8e0 [ 1035.912399] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1035.917918] ? proc_fail_nth_write+0x96/0x1f0 [ 1035.922400] ? find_held_lock+0x36/0x1c0 [ 1035.926446] _do_fork+0x291/0x12a0 [ 1035.929972] ? fork_idle+0x1a0/0x1a0 [ 1035.933681] ? __sb_end_write+0xac/0xe0 [ 1035.937641] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1035.943160] ? fput+0x130/0x1a0 [ 1035.946430] ? ksys_write+0x1a6/0x250 [ 1035.950217] ? SyS_read+0x30/0x30 [ 1035.953667] ? mm_fault_error+0x380/0x380 [ 1035.957806] SyS_clone+0x37/0x50 [ 1035.961154] ? sys_vfork+0x30/0x30 [ 1035.964678] do_syscall_64+0x29e/0x9d0 [ 1035.968549] ? vmalloc_sync_all+0x30/0x30 [ 1035.972769] ? _raw_spin_unlock_irq+0x27/0x70 [ 1035.977266] ? finish_task_switch+0x1ca/0x820 [ 1035.981762] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1035.986690] ? syscall_return_slowpath+0x30f/0x5c0 [ 1035.991699] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1035.997048] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1036.001883] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1036.007063] RIP: 0033:0x455259 [ 1036.010333] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1036.018033] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1036.025283] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1036.032534] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1036.039791] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1036.047057] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000028 2018/04/10 12:56:05 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000160000000000000003000600000000000200000031ebf8c7000000000000000003000500000000000200000000000000000000000000000018001200020001030000000000000000100000000303000000000000000000001d0000010100c58a47566f8d45157c97ec3a0000000000000000000000000000"], 0x80}, 0x1}, 0x0) 2018/04/10 12:56:05 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2ff], 0x1}, 0x5}, 0x1c) 2018/04/10 12:56:05 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000000000)='}', 0x1, 0x0, &(0x7f0000606fe4)={0xa, 0x4e21, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x1c) listen(r0, 0x400000000007) r1 = accept(r0, &(0x7f0000000180), &(0x7f0000000200)=0x80) sendmmsg(r1, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="9d", 0x1}], 0x1, &(0x7f0000000340)}}], 0xffffffe0, 0x0) 2018/04/10 12:56:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000ffd0)={0x0, 0x0, &(0x7f000000f000), 0x1, 0x0, &(0x7f000000ef31)='b'}) mmap$binder(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000011f9d)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x16, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1163484000000000000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000000c0)}) 2018/04/10 12:56:05 executing program 7 (fault-call:0 fault-nth:41): clone(0x2000c100, &(0x7f0000000800), &(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) 2018/04/10 12:56:05 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000019c0)={@dev={0xfe, 0x80}}, 0x29c) 2018/04/10 12:56:05 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401000000000000]}, 0x10) shutdown(r0, 0x1) 2018/04/10 12:56:05 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}, {0xd00}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8) [ 1036.270223] FAULT_INJECTION: forcing a failure. [ 1036.270223] name failslab, interval 1, probability 0, space 0, times 0 [ 1036.281737] CPU: 0 PID: 568 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1036.288496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1036.297858] Call Trace: [ 1036.300464] dump_stack+0x1b9/0x294 [ 1036.304109] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1036.309333] should_fail.cold.4+0xa/0x1a [ 1036.313412] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1036.318531] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1036.324083] ? graph_lock+0x170/0x170 [ 1036.327890] ? perf_trace_lock+0xd6/0x900 [ 1036.332050] ? graph_lock+0x170/0x170 [ 1036.335858] ? ida_get_new_above+0x490/0xa10 [ 1036.340277] ? find_held_lock+0x36/0x1c0 [ 1036.344348] ? __lock_is_held+0xb5/0x140 [ 1036.348434] ? check_same_owner+0x320/0x320 [ 1036.352758] ? lock_downgrade+0x8e0/0x8e0 [ 1036.356893] ? __raw_spin_lock_init+0x1c/0x100 [ 1036.361463] ? rcu_note_context_switch+0x710/0x710 [ 1036.366375] ? find_held_lock+0x36/0x1c0 [ 1036.370425] __should_failslab+0x124/0x180 [ 1036.374648] should_failslab+0x9/0x14 [ 1036.378431] __kmalloc+0x2c8/0x760 [ 1036.381956] ? lock_downgrade+0x8e0/0x8e0 [ 1036.386093] ? register_shrinker+0x121/0x300 [ 1036.390497] register_shrinker+0x121/0x300 [ 1036.394720] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1036.399384] ? shrink_slab+0xc0/0xc0 [ 1036.403084] ? memcpy+0x45/0x50 [ 1036.406356] sget_userns+0xc78/0xf20 [ 1036.410068] ? set_anon_super+0x20/0x20 [ 1036.414040] ? get_empty_filp.cold.7+0x3e/0x3e [ 1036.418608] ? destroy_unused_super.part.9+0x100/0x100 [ 1036.423874] ? __alloc_pages_slowpath+0x2dc0/0x2dc0 [ 1036.428880] ? save_stack+0x43/0xd0 [ 1036.432489] ? kasan_kmalloc+0xc4/0xe0 [ 1036.436363] ? kasan_slab_alloc+0x12/0x20 [ 1036.440496] ? kmem_cache_alloc+0x12e/0x760 [ 1036.444803] ? copy_process.part.38+0x36bf/0x6ee0 [ 1036.449639] ? graph_lock+0x170/0x170 [ 1036.453434] mount_ns+0x8f/0x1d0 [ 1036.456787] ? proc_get_inode+0x670/0x670 [ 1036.460921] proc_mount+0x73/0xa0 [ 1036.464359] mount_fs+0xae/0x328 [ 1036.467718] vfs_kern_mount.part.34+0xd4/0x4d0 [ 1036.472287] ? may_umount+0xb0/0xb0 [ 1036.475898] ? kasan_check_read+0x11/0x20 [ 1036.480742] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1036.485135] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 1036.489701] ? idr_alloc+0x1a0/0x1a0 [ 1036.493403] kern_mount_data+0x50/0xc0 [ 1036.497277] pid_ns_prepare_proc+0x1e/0x90 [ 1036.501506] alloc_pid+0x8cf/0xa50 [ 1036.505042] ? __change_pid+0x410/0x410 [ 1036.509000] ? ns_capable_common+0x13f/0x170 [ 1036.513405] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1036.518927] ? memset+0x31/0x40 [ 1036.522197] ? copy_thread_tls+0x265/0x800 [ 1036.526423] copy_process.part.38+0x36bf/0x6ee0 [ 1036.531079] ? __lock_acquire+0x7f5/0x5130 [ 1036.535300] ? lock_acquire+0x1dc/0x520 [ 1036.539256] ? alloc_set_pte+0x1077/0x16a0 [ 1036.543486] ? __cleanup_sighand+0x70/0x70 [ 1036.547705] ? alloc_set_pte+0x1077/0x16a0 [ 1036.551930] ? print_usage_bug+0xc0/0xc0 [ 1036.555977] ? lock_downgrade+0x8e0/0x8e0 [ 1036.560115] ? debug_check_no_locks_freed+0x310/0x310 [ 1036.565289] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1036.570465] ? print_usage_bug+0xc0/0xc0 [ 1036.574525] ? debug_check_no_locks_freed+0x310/0x310 [ 1036.579703] ? __lock_acquire+0x7f5/0x5130 [ 1036.583922] ? debug_check_no_locks_freed+0x310/0x310 [ 1036.589106] ? print_usage_bug+0xc0/0xc0 [ 1036.593155] ? print_usage_bug+0xc0/0xc0 [ 1036.597210] ? graph_lock+0x170/0x170 [ 1036.601005] ? lock_acquire+0x1dc/0x520 [ 1036.604973] ? __fdget_pos+0x1a9/0x1e0 [ 1036.608847] ? graph_lock+0x170/0x170 [ 1036.612638] ? __lock_acquire+0x7f5/0x5130 [ 1036.616868] ? find_held_lock+0x36/0x1c0 [ 1036.620913] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1036.626438] ? _parse_integer+0x13b/0x190 [ 1036.630576] ? graph_lock+0x170/0x170 [ 1036.634361] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1036.639890] ? _kstrtoull+0x180/0x230 [ 1036.643677] ? _parse_integer+0x190/0x190 [ 1036.647809] ? graph_lock+0x170/0x170 [ 1036.651594] ? lock_release+0xa10/0xa10 [ 1036.655552] ? check_same_owner+0x320/0x320 [ 1036.659859] ? find_held_lock+0x36/0x1c0 [ 1036.663908] ? graph_lock+0x170/0x170 [ 1036.667697] ? lock_downgrade+0x8e0/0x8e0 [ 1036.671835] ? find_held_lock+0x36/0x1c0 [ 1036.675892] ? lock_downgrade+0x8e0/0x8e0 [ 1036.680036] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1036.685558] ? proc_fail_nth_write+0x96/0x1f0 [ 1036.690040] ? proc_cwd_link+0x1d0/0x1d0 [ 1036.694091] ? find_held_lock+0x36/0x1c0 [ 1036.698153] _do_fork+0x291/0x12a0 [ 1036.701686] ? fork_idle+0x1a0/0x1a0 [ 1036.706081] ? __lock_is_held+0xb5/0x140 [ 1036.710146] ? __sb_end_write+0xac/0xe0 [ 1036.714109] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1036.719631] ? fput+0x130/0x1a0 [ 1036.722902] ? ksys_write+0x1a6/0x250 [ 1036.726690] ? SyS_read+0x30/0x30 [ 1036.730735] ? mm_fault_error+0x380/0x380 [ 1036.734871] SyS_clone+0x37/0x50 [ 1036.738222] ? sys_vfork+0x30/0x30 [ 1036.741752] do_syscall_64+0x29e/0x9d0 [ 1036.745621] ? vmalloc_sync_all+0x30/0x30 [ 1036.749758] ? _raw_spin_unlock_irq+0x27/0x70 [ 1036.754241] ? finish_task_switch+0x1ca/0x820 [ 1036.758726] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1036.763641] ? syscall_return_slowpath+0x30f/0x5c0 [ 1036.768559] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1036.773915] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1036.778749] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1036.783921] RIP: 0033:0x455259 [ 1036.787093] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1036.794789] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1036.802044] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1036.809298] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 2018/04/10 12:56:05 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20001ffe], 0x1}, 0x5}, 0x1c) [ 1036.816554] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1036.823807] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000029 [ 1036.836228] binder: 575 RLIMIT_NICE not set [ 1036.842290] ================================================================== [ 1036.849964] BUG: KASAN: use-after-free in alloc_pid+0x9e8/0xa50 [ 1036.856011] Read of size 4 at addr ffff8801b73d42a8 by task syz-executor7/568 [ 1036.863267] [ 1036.864879] CPU: 0 PID: 568 Comm: syz-executor7 Not tainted 4.16.0+ #17 [ 1036.871608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1036.880940] Call Trace: [ 1036.883514] dump_stack+0x1b9/0x294 [ 1036.887129] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1036.892302] ? printk+0x9e/0xba [ 1036.895566] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 1036.900308] ? kasan_check_write+0x14/0x20 [ 1036.904527] print_address_description+0x6c/0x20b [ 1036.909349] ? alloc_pid+0x9e8/0xa50 [ 1036.913048] kasan_report.cold.7+0xac/0x2f5 [ 1036.917362] __asan_report_load4_noabort+0x14/0x20 [ 1036.922274] alloc_pid+0x9e8/0xa50 [ 1036.925799] ? __change_pid+0x410/0x410 [ 1036.929757] ? ns_capable_common+0x13f/0x170 [ 1036.934159] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1036.939678] ? memset+0x31/0x40 [ 1036.942951] ? copy_thread_tls+0x265/0x800 [ 1036.947178] copy_process.part.38+0x36bf/0x6ee0 [ 1036.951841] ? __lock_acquire+0x7f5/0x5130 [ 1036.956072] ? lock_acquire+0x1dc/0x520 [ 1036.960030] ? alloc_set_pte+0x1077/0x16a0 [ 1036.964252] ? __cleanup_sighand+0x70/0x70 [ 1036.968467] ? alloc_set_pte+0x1077/0x16a0 [ 1036.972687] ? print_usage_bug+0xc0/0xc0 [ 1036.976733] ? lock_downgrade+0x8e0/0x8e0 [ 1036.980869] ? debug_check_no_locks_freed+0x310/0x310 [ 1036.986047] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1036.991219] ? print_usage_bug+0xc0/0xc0 [ 1036.995272] ? debug_check_no_locks_freed+0x310/0x310 [ 1037.000445] ? __lock_acquire+0x7f5/0x5130 [ 1037.004663] ? debug_check_no_locks_freed+0x310/0x310 [ 1037.009843] ? print_usage_bug+0xc0/0xc0 [ 1037.013890] ? print_usage_bug+0xc0/0xc0 [ 1037.017942] ? graph_lock+0x170/0x170 [ 1037.021728] ? lock_acquire+0x1dc/0x520 [ 1037.025684] ? __fdget_pos+0x1a9/0x1e0 [ 1037.029553] ? graph_lock+0x170/0x170 [ 1037.033338] ? __lock_acquire+0x7f5/0x5130 [ 1037.037558] ? find_held_lock+0x36/0x1c0 [ 1037.041637] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1037.047332] ? _parse_integer+0x13b/0x190 [ 1037.051467] ? graph_lock+0x170/0x170 [ 1037.055251] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1037.060858] ? _kstrtoull+0x180/0x230 [ 1037.064642] ? _parse_integer+0x190/0x190 [ 1037.068787] ? graph_lock+0x170/0x170 [ 1037.072573] ? lock_release+0xa10/0xa10 [ 1037.076531] ? check_same_owner+0x320/0x320 [ 1037.080841] ? find_held_lock+0x36/0x1c0 [ 1037.084892] ? graph_lock+0x170/0x170 [ 1037.088682] ? lock_downgrade+0x8e0/0x8e0 [ 1037.092820] ? find_held_lock+0x36/0x1c0 [ 1037.096872] ? lock_downgrade+0x8e0/0x8e0 [ 1037.101010] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1037.106535] ? proc_fail_nth_write+0x96/0x1f0 [ 1037.111032] ? proc_cwd_link+0x1d0/0x1d0 [ 1037.115170] ? find_held_lock+0x36/0x1c0 [ 1037.119221] _do_fork+0x291/0x12a0 [ 1037.122758] ? fork_idle+0x1a0/0x1a0 [ 1037.126464] ? __lock_is_held+0xb5/0x140 [ 1037.130529] ? __sb_end_write+0xac/0xe0 [ 1037.134500] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1037.140026] ? fput+0x130/0x1a0 [ 1037.143308] ? ksys_write+0x1a6/0x250 [ 1037.147103] ? SyS_read+0x30/0x30 [ 1037.150549] ? mm_fault_error+0x380/0x380 [ 1037.154694] SyS_clone+0x37/0x50 [ 1037.158059] ? sys_vfork+0x30/0x30 [ 1037.161686] do_syscall_64+0x29e/0x9d0 [ 1037.165564] ? vmalloc_sync_all+0x30/0x30 [ 1037.169699] ? _raw_spin_unlock_irq+0x27/0x70 [ 1037.174209] ? finish_task_switch+0x1ca/0x820 [ 1037.178696] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1037.183630] ? syscall_return_slowpath+0x30f/0x5c0 [ 1037.188553] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1037.193911] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1037.198748] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1037.203923] RIP: 0033:0x455259 [ 1037.207100] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1037.214808] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1037.222067] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1037.229326] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1037.236597] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1037.243865] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000029 [ 1037.251158] [ 1037.252776] Allocated by task 568: [ 1037.256316] save_stack+0x43/0xd0 [ 1037.259760] kasan_kmalloc+0xc4/0xe0 [ 1037.263467] kasan_slab_alloc+0x12/0x20 [ 1037.267429] kmem_cache_alloc+0x12e/0x760 [ 1037.271565] copy_pid_ns+0x2c3/0xb40 [ 1037.275284] create_new_namespaces+0x48a/0x8f0 [ 1037.279858] copy_namespaces+0x3f7/0x4c0 [ 1037.283908] copy_process.part.38+0x353a/0x6ee0 [ 1037.288565] _do_fork+0x291/0x12a0 [ 1037.292096] SyS_clone+0x37/0x50 [ 1037.295453] do_syscall_64+0x29e/0x9d0 [ 1037.299343] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1037.304514] [ 1037.306124] Freed by task 575: [ 1037.309303] save_stack+0x43/0xd0 [ 1037.312740] __kasan_slab_free+0x11a/0x170 [ 1037.316969] kasan_slab_free+0xe/0x10 [ 1037.320753] kmem_cache_free+0x86/0x2d0 [ 1037.324717] delayed_free_pidns+0xaa/0xe0 [ 1037.328856] rcu_process_callbacks+0x941/0x15f0 [ 1037.333511] __do_softirq+0x2e0/0xaf5 [ 1037.337287] [ 1037.338902] The buggy address belongs to the object at ffff8801b73d4260 [ 1037.338902] which belongs to the cache pid_namespace of size 240 [ 1037.351724] The buggy address is located 72 bytes inside of [ 1037.351724] 240-byte region [ffff8801b73d4260, ffff8801b73d4350) [ 1037.363494] The buggy address belongs to the page: [ 1037.368407] page:ffffea0006dcf500 count:1 mapcount:0 mapping:ffff8801b73d4000 index:0x0 [ 1037.376539] flags: 0x2fffc0000000100(slab) [ 1037.380772] raw: 02fffc0000000100 ffff8801b73d4000 0000000000000000 000000010000000d [ 1037.388644] raw: ffffea00065c88a0 ffff8801d40af648 ffff8801d4681780 0000000000000000 [ 1037.396504] page dumped because: kasan: bad access detected [ 1037.402192] [ 1037.403831] Memory state around the buggy address: [ 1037.408761] ffff8801b73d4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1037.416116] ffff8801b73d4200: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb [ 1037.423461] >ffff8801b73d4280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1037.430799] ^ [ 1037.435447] ffff8801b73d4300: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 1037.442786] ffff8801b73d4380: fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1037.450121] ================================================================== [ 1037.457455] Disabling lock debugging due to kernel taint [ 1037.462879] Kernel panic - not syncing: panic_on_warn set ... [ 1037.462879] [ 1037.470234] CPU: 0 PID: 568 Comm: syz-executor7 Tainted: G B 4.16.0+ #17 [ 1037.478271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1037.487622] Call Trace: [ 1037.490199] dump_stack+0x1b9/0x294 [ 1037.493810] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1037.498983] ? lock_downgrade+0x8e0/0x8e0 [ 1037.503112] ? vprintk_default+0x28/0x30 [ 1037.507152] ? alloc_pid+0x9c0/0xa50 [ 1037.510849] panic+0x22f/0x4de [ 1037.514025] ? add_taint.cold.5+0x16/0x16 [ 1037.518165] ? add_taint.cold.5+0x5/0x16 [ 1037.522205] ? do_raw_spin_unlock+0x9e/0x2e0 [ 1037.526605] ? alloc_pid+0x9e8/0xa50 [ 1037.530302] kasan_end_report+0x47/0x4f [ 1037.534257] kasan_report.cold.7+0xc9/0x2f5 [ 1037.538565] __asan_report_load4_noabort+0x14/0x20 [ 1037.543473] alloc_pid+0x9e8/0xa50 [ 1037.546993] ? __change_pid+0x410/0x410 [ 1037.550964] ? ns_capable_common+0x13f/0x170 [ 1037.555364] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1037.560881] ? memset+0x31/0x40 [ 1037.564151] ? copy_thread_tls+0x265/0x800 [ 1037.568373] copy_process.part.38+0x36bf/0x6ee0 [ 1037.573026] ? __lock_acquire+0x7f5/0x5130 [ 1037.577239] ? lock_acquire+0x1dc/0x520 [ 1037.581192] ? alloc_set_pte+0x1077/0x16a0 [ 1037.585409] ? __cleanup_sighand+0x70/0x70 [ 1037.589626] ? alloc_set_pte+0x1077/0x16a0 [ 1037.593848] ? print_usage_bug+0xc0/0xc0 [ 1037.597899] ? lock_downgrade+0x8e0/0x8e0 [ 1037.602064] ? debug_check_no_locks_freed+0x310/0x310 [ 1037.607251] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 1037.612419] ? print_usage_bug+0xc0/0xc0 [ 1037.616479] ? debug_check_no_locks_freed+0x310/0x310 [ 1037.621653] ? __lock_acquire+0x7f5/0x5130 [ 1037.625867] ? debug_check_no_locks_freed+0x310/0x310 [ 1037.631037] ? print_usage_bug+0xc0/0xc0 [ 1037.635077] ? print_usage_bug+0xc0/0xc0 [ 1037.639123] ? graph_lock+0x170/0x170 [ 1037.642907] ? lock_acquire+0x1dc/0x520 [ 1037.646867] ? __fdget_pos+0x1a9/0x1e0 [ 1037.650737] ? graph_lock+0x170/0x170 [ 1037.654521] ? __lock_acquire+0x7f5/0x5130 [ 1037.658736] ? find_held_lock+0x36/0x1c0 [ 1037.662790] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1037.668316] ? _parse_integer+0x13b/0x190 [ 1037.672451] ? graph_lock+0x170/0x170 [ 1037.676235] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1037.681762] ? _kstrtoull+0x180/0x230 [ 1037.685543] ? _parse_integer+0x190/0x190 [ 1037.689675] ? graph_lock+0x170/0x170 [ 1037.693457] ? lock_release+0xa10/0xa10 [ 1037.697413] ? check_same_owner+0x320/0x320 [ 1037.701720] ? find_held_lock+0x36/0x1c0 [ 1037.705763] ? graph_lock+0x170/0x170 [ 1037.709545] ? lock_downgrade+0x8e0/0x8e0 [ 1037.713684] ? find_held_lock+0x36/0x1c0 [ 1037.717728] ? lock_downgrade+0x8e0/0x8e0 [ 1037.721859] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1037.727380] ? proc_fail_nth_write+0x96/0x1f0 [ 1037.731854] ? proc_cwd_link+0x1d0/0x1d0 [ 1037.735898] ? find_held_lock+0x36/0x1c0 [ 1037.739943] _do_fork+0x291/0x12a0 [ 1037.743468] ? fork_idle+0x1a0/0x1a0 [ 1037.747161] ? __lock_is_held+0xb5/0x140 [ 1037.751207] ? __sb_end_write+0xac/0xe0 [ 1037.755162] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1037.760675] ? fput+0x130/0x1a0 [ 1037.763941] ? ksys_write+0x1a6/0x250 [ 1037.767725] ? SyS_read+0x30/0x30 [ 1037.771167] ? mm_fault_error+0x380/0x380 [ 1037.775312] SyS_clone+0x37/0x50 [ 1037.778663] ? sys_vfork+0x30/0x30 [ 1037.782189] do_syscall_64+0x29e/0x9d0 [ 1037.786056] ? vmalloc_sync_all+0x30/0x30 [ 1037.790184] ? _raw_spin_unlock_irq+0x27/0x70 [ 1037.794658] ? finish_task_switch+0x1ca/0x820 [ 1037.799134] ? syscall_return_slowpath+0x5c0/0x5c0 [ 1037.804045] ? syscall_return_slowpath+0x30f/0x5c0 [ 1037.808957] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 1037.814322] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1037.819147] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1037.824315] RIP: 0033:0x455259 [ 1037.827484] RSP: 002b:00007fa2adbe2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1037.835178] RAX: ffffffffffffffda RBX: 00007fa2adbe36d4 RCX: 0000000000455259 [ 1037.842437] RDX: 00000000200008c0 RSI: 0000000020000800 RDI: 000000002000c100 [ 1037.849686] RBP: 000000000072bea0 R08: 0000000020000940 R09: 0000000000000000 [ 1037.856944] R10: 0000000020000900 R11: 0000000000000246 R12: 0000000000000013 [ 1037.864191] R13: 0000000000000051 R14: 00000000006f3838 R15: 0000000000000029 [ 1038.958827] Shutting down cpus with NMI [ 1038.963271] Dumping ftrace buffer: [ 1038.966785] (ftrace buffer empty) [ 1038.970469] Kernel Offset: disabled [ 1038.974068] Rebooting in 86400 seconds..