[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[   20.986616] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available)
[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   24.809487] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available)
[   25.325048] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available)
[   26.378572] random: nonblocking pool is initialized
Warning: Permanently added '10.128.0.4' (ECDSA) to the list of known hosts.
2018/03/26 17:09:55 fuzzer started
2018/03/26 17:09:55 dialing manager at 10.128.0.26:38065
[   36.479648] audit: type=1400 audit(1522084199.861:5): avc:  denied  { create } for  pid=3750 comm="syz-fuzzer" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
2018/03/26 17:10:00 kcov=true, comps=false
2018/03/26 17:10:01 executing program 0:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x2691d0877f1cca9b})

2018/03/26 17:10:01 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x10, 0x3, 0xc)
sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000017fdc)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0)

2018/03/26 17:10:01 executing program 7:
r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000fcdfe8)={0xaa})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f000086c000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1})
read(r0, &(0x7f0000465f8e)=""/114, 0x72)
ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000c22ff0)={&(0x7f000001d000/0xc00000)=nil, 0xc00000})

2018/03/26 17:10:01 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000013ff4)=@assoc_value, &(0x7f0000002000)=0x8)
getsockopt$inet_mreqn(r1, 0x0, 0x0, &(0x7f0000000080)={@rand_addr, @multicast1}, &(0x7f0000000040)=0xc)
mmap(&(0x7f0000000000/0x22000)=nil, 0x22000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
close(r0)

2018/03/26 17:10:01 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndtimer(&(0x7f00000b5ff1)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}})

2018/03/26 17:10:01 executing program 6:
perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f000079cff8)='./file0\x00', 0x0)
r0 = open(&(0x7f0000e70000)='./file0\x00', 0x0, 0x0)
lseek(r0, 0x2, 0x0)

2018/03/26 17:10:01 executing program 1:
mknod$loop(&(0x7f0000000040)='./file0\x00', 0x0, 0xffffffffffffffff)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)=@known='trusted.syz\x00', &(0x7f0000000100)='/vmnet0\x00', 0x11f, 0x0)

2018/03/26 17:10:01 executing program 2:
perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000006000)={0x7fffffff}, 0x8, 0x0)
sync()
accept4$unix(0xffffffffffffff9c, 0x0, &(0x7f0000000000)=0x384, 0x80800)
socketpair$inet(0x2, 0x80806, 0x0, &(0x7f0000000200))

[   38.533773] IPVS: Creating netns size=2552 id=1
[   38.622578] IPVS: Creating netns size=2552 id=2
[   38.664369] IPVS: Creating netns size=2552 id=3
[   38.730126] IPVS: Creating netns size=2552 id=4
[   38.808776] IPVS: Creating netns size=2552 id=5
[   38.913914] IPVS: Creating netns size=2552 id=6
[   39.048491] IPVS: Creating netns size=2552 id=7
[   39.198315] IPVS: Creating netns size=2552 id=8
[   43.037734] audit: type=1400 audit(1522084206.411:6): avc:  denied  { create } for  pid=5064 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1
2018/03/26 17:10:06 executing program 0:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x2691d0877f1cca9b})

2018/03/26 17:10:06 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open$cgroup(&(0x7f00000000c0)={0x1, 0x70, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

2018/03/26 17:10:06 executing program 3:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = inotify_init1(0x0)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
fcntl$getownex(r0, 0x10, &(0x7f000045fff8)={0x0, <r1=>0x0})
ptrace$setopts(0x4206, r1, 0x0, 0x0)

2018/03/26 17:10:06 executing program 4:
perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
lstat(&(0x7f0000001800)='./file0\x00', &(0x7f0000001840))
getgid()
lstat(&(0x7f0000002d40)='./file0\x00', &(0x7f0000002d80))
ptrace$getsig(0x4202, 0x0, 0x0, &(0x7f0000003040))
lstat(&(0x7f0000002f80)='./file0\x00', &(0x7f0000002fc0))
futex(&(0x7f000000cffc)=0x1, 0x800000000086, 0x0, &(0x7f0000000040)={0x77359400}, &(0x7f0000048000), 0x0)
r0 = gettid()
ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f00000031c0))
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000))
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0xffffffffffeffffe, 0x100000000000031, 0xffffffffffffffff, 0x0)
tkill(r0, 0x1000000000016)

2018/03/26 17:10:06 executing program 6:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00004ca000)={&(0x7f0000690000)={0x1c, 0xa, 0x100000000000006, 0x1, 0x0, 0x0, {}, [@nested={0x8, 0x1, [@generic="06"]}]}, 0x1c}, 0x1}, 0x0)

2018/03/26 17:10:06 executing program 7:
r0 = socket$inet(0x10, 0x3, 0x4)
sendmsg(r0, &(0x7f0000014000)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001300ff10fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d4c1cbc882b079881", 0x4c}], 0x1}, 0x0)

2018/03/26 17:10:06 executing program 2:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000fe2000)={@remote={0xfe, 0x80, [], 0xffffffffffffffff}, 0x0, 0x0, 0x20000000002, 0x1}, 0x20)

2018/03/26 17:10:06 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
dup2(r0, r1)

2018/03/26 17:10:07 executing program 7:
perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x8080a, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x5452, &(0x7f0000000000)={"65727370616e3000000000000200"})

2018/03/26 17:10:07 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$fou(&(0x7f0000001340)='fou\x00')
sendmsg$FOU_CMD_GET(r0, &(0x7f0000001400)={&(0x7f0000001300)={0x10}, 0xc, &(0x7f00000013c0)={&(0x7f0000001380)={0x18, r1, 0x221, 0x0, 0x0, {0x3}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4, 0x5}]}, 0x18}, 0x1}, 0x0)

2018/03/26 17:10:07 executing program 5:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f00000003c0)={'ipvs\x00'}, &(0x7f0000000400)=0x1e)

2018/03/26 17:10:07 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/ip6_flowlabel\x00')

2018/03/26 17:10:07 executing program 3:
r0 = socket$inet(0x2, 0x803, 0x5)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000680)={0x11, @multicast2=0xe0000002, 0x0, 0x0, 'lc\x00', 0x0, 0x8, 0x2c}, 0x2c)

2018/03/26 17:10:07 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000001700)='/dev/loop#\x00', 0xfffffffffffffffd, 0x0)
r1 = memfd_create(&(0x7f0000000000)='%\x00', 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1)
ioctl$LOOP_CLR_FD(r0, 0x4c01)

[   43.623645] audit: type=1400 audit(1522084207.001:7): avc:  denied  { write } for  pid=5187 comm="syz-executor6" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1
[   43.678265] syz-executor7 uses obsolete (PF_INET,SOCK_PACKET)
[   43.706384] audit: type=1400 audit(1522084207.081:8): avc:  denied  { write } for  pid=5210 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[   43.749757] audit: type=1400 audit(1522084207.131:9): avc:  denied  { read } for  pid=5210 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
2018/03/26 17:10:07 executing program 7:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)="6f6f6d5f61646a00aceb048ace6a7fe4299541856162c2caee4ddcec07751e2f54b9cbf0357fa60e7f8e7f6304370006f19190212c4a9e569adb10d57a4df1ac9de547a489ee151288214d250681714c92c72529697f2a774835bb6f09301d08f3c72fbbd90fe9775e40875adddc5c6c9f923b2d5899a66add2811c07319d9ddba60e2b798d5dbc662")
setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f00000002c0)={0x0, {{0xa, 0x4e23, 0x5, @loopback={0x0, 0x1}}}, 0x0, 0x8, [{{0xa, 0x4e20, 0x20, @mcast2={0xff, 0x2, [], 0x1}, 0x2709a7bf}}, {{0xa, 0x4e22, 0xff, @dev={0xfe, 0x80, [], 0x16}, 0x2}}, {{0xa, 0x4e23, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x4}}, {{0xa, 0x4e24, 0x3}}, {{0xa, 0x4e21, 0x20, @mcast2={0xff, 0x2, [], 0x1}, 0x40}}, {{0xa, 0x4e22, 0x1}}, {{0xa, 0x4e21, 0x3f, @local={0xfe, 0x80, [], 0xaa}, 0x400}}, {{0xa, 0x4e21, 0x8, @dev={0xfe, 0x80, [], 0xa}, 0x5}}]}, 0x490)
r1 = syz_open_procfs(0x0, &(0x7f0000000040)="2f65786500000000000035abe1e80d903e0d717ac1889a45e581c9e14a5c8f95f5d2968ae8c767e9d18fd69a")
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0xd, 0x20011, r1, 0x0)
pwrite64(r0, &(0x7f0000000280)='-', 0x1, 0x0)

2018/03/26 17:10:07 executing program 6:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
rt_sigprocmask(0x0, &(0x7f0000000080)={0xfffffffffffffffa}, 0x0, 0x8)
r0 = gettid()
timer_create(0x0, &(0x7f0000044000)={0x0, 0x17, 0x4, @tid=r0}, &(0x7f00008ec000))
timer_settime(0x0, 0x0, &(0x7f000004a000)={{0x0, 0x1}, {0x0, 0xe4c}}, &(0x7f0000040000))
rt_sigtimedwait(&(0x7f00004f3ff8)={0xffffffffffffffff}, &(0x7f0000a37000), &(0x7f0000685000)={0x77359400}, 0x8)

2018/03/26 17:10:07 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000680)={&(0x7f0000000180)={0x10}, 0xc, &(0x7f0000000640)={&(0x7f0000000380)=@updpolicy={0xb8, 0x1d, 0x11, 0x0, 0x0, {{@in=@remote={0xac, 0x14, 0x14, 0xbb}, @in=@remote={0xac, 0x14, 0x14, 0xbb}}}}, 0xb8}, 0x1}, 0x0)

2018/03/26 17:10:07 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x15, &(0x7f0000000040)={@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [{[], {0x8100}}], {@llc_tr={0x11, {@llc={0x0, 0x0, "ff"}}}}}, &(0x7f0000000100))

2018/03/26 17:10:07 executing program 2:
r0 = socket$inet_dccp(0x2, 0x6, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000003b00)={'erspan0\x00'})

2018/03/26 17:10:07 executing program 3:
r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/arp\x00')
pread64(r0, &(0x7f0000002440)=""/4096, 0x1000, 0x0)
socket(0x0, 0x0, 0x0)

2018/03/26 17:10:07 executing program 0:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f000007d000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
dup2(r1, r0)
rt_sigprocmask(0x0, &(0x7f00001b6ff8)={0xfffffffffffffffe}, 0x0, 0x8)
r2 = memfd_create(&(0x7f0000000000)='dev ', 0x0)
ftruncate(r2, 0x40001)
sendfile(r0, r2, &(0x7f000000a000), 0x2)

2018/03/26 17:10:07 executing program 5:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x78, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0x13, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0)

2018/03/26 17:10:07 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fremovexattr(r0, &(0x7f0000000040)=@known='system.posix_acl_default\x00')

2018/03/26 17:10:07 executing program 4:
r0 = socket$inet6(0xa, 0x2000000802, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback={0x0, 0x1}, 0x800, 0x0, 0xff, 0x1}, 0x20)
setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f000089b000)=0x1, 0x4)
sendmsg(r0, &(0x7f0000000380)={&(0x7f0000000040)=@in6={0xa, 0x4e24, 0x800, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000200), 0x0, &(0x7f00000001c0)=[{0x10}], 0x10}, 0x0)

2018/03/26 17:10:07 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = gettid()
capget(&(0x7f00000016c0)={0x19980330, r0}, &(0x7f0000001700))

2018/03/26 17:10:07 executing program 1:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f0000085000)='./control\x00', 0x28042, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000273ff6)='./control\x00', 0x80000c12)
readv(r1, &(0x7f0000b25000)=[{&(0x7f0000fb2000)=""/128, 0x80}], 0x1)
writev(r0, &(0x7f0000ecc000)=[{&(0x7f00000d9000)="f9", 0x1}], 0x1)

2018/03/26 17:10:07 executing program 7:
r0 = socket$inet(0x15, 0x5, 0x0)
bind$inet(r0, &(0x7f000001bff0)={0x2, 0x0, @loopback=0x7f000001}, 0x10)
r1 = perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
dup2(r1, r0)

2018/03/26 17:10:07 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x0, 0x2881)

2018/03/26 17:10:07 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip_mr_cache\x00')
sendfile(r0, r0, &(0x7f0000301ff8), 0xffffffff)

2018/03/26 17:10:07 executing program 0:
r0 = syz_open_dev$sndseq(&(0x7f0000049000)='/dev/snd/seq\x00', 0x0, 0x100000000008a002)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f000014d000)={0x0, 0x0, 0x0, "e06594d232d12448b0c30905cebdbd09c0a763e204c2a32152615df55d05092d3c12ddd25bad4d127eb802407bc091842621790b637ae5ed23d8b2adf92fc9dd"})
writev(r0, &(0x7f0000000280)=[{&(0x7f000093b000)="2900000018003109004a0001000c00070a0000000a00ff0680000002", 0x1c}], 0x1)

2018/03/26 17:10:07 executing program 2:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f000074f000)='syscall\x00')
pread64(r0, &(0x7f0000157f23)=""/221, 0xdd, 0x0)

[   43.897755] audit: type=1400 audit(1522084207.271:10): avc:  denied  { execute } for  pid=5232 comm="syz-executor7" path="/proc/166" dev="proc" ino=12516 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=dir permissive=1
2018/03/26 17:10:07 executing program 2:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='comm\x00')

2018/03/26 17:10:07 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x0, 0x2881)

2018/03/26 17:10:07 executing program 7:
r0 = syz_open_procfs(0x0, &(0x7f0000deaff6)='numa_maps\x00')
readv(r0, &(0x7f00000f9000)=[{&(0x7f0000242000)=""/2560, 0xa00}], 0x1)
readv(r0, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/146, 0x92}], 0x1)

2018/03/26 17:10:07 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00')
preadv(r0, &(0x7f0000b24fb0)=[{&(0x7f0000830000)=""/4096, 0x1000}], 0x1, 0x0)

2018/03/26 17:10:07 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x0, 0x0)
preadv(r0, &(0x7f00000008c0)=[{&(0x7f00000007c0)=""/255, 0xff}], 0x1, 0x0)

2018/03/26 17:10:07 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x10, 0x3, 0xc)
sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000017fdc)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0)
sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000000640)="2400000002031f001cfffd946fa2830020200a000900020002e7fcffffffa3a20404ff7e", 0x24}], 0x1}, 0x0)

2018/03/26 17:10:07 executing program 2:
r0 = socket$inet(0x2, 0x80001, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x3, 0xb28, [0x20000200, 0x0, 0x0, 0x20000c08, 0x20000c38], 0x0, &(0x7f00000001c0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'bcsf0\x00', 'bond0\x00', 'ip6_vti0\x00', 'ifb0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @link_local={0x1, 0x80, 0xc2}, [], 0x9a0, 0x9a0, 0x9d8, [@among={'among\x00', 0x898, {{0x0, 0x14ac00000, 0x0, {[], 0x3, [{[], @multicast2=0xe0000002}, {[], @rand_addr}, {[], @rand_addr}]}, {[], 0x7, [{[], @dev={0xac, 0x14, 0x14}}, {[], @remote={0xac, 0x14, 0x14, 0xbb}}, {[], @dev={0xac, 0x14, 0x14}}, {[], @rand_addr}, {[], @broadcast=0xffffffff}, {[], @multicast2=0xe0000002}, {[], @remote={0xac, 0x14, 0x14, 0xbb}}]}}}}, @stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], 0x0, 0x0, 0x0, 0x0, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}}}]}}, @arpreply={'arpreply\x00', 0x10, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x7, 0x0, 0x0, 'ip_vti0\x00', 'teql0\x00', 'vlan0\x00', 'gre0\x00', @random="6631168998f8", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz1\x00'}}}}]}]}, 0xb5c)

[   44.017897] capability: warning: `syz-executor4' uses 32-bit capabilities (legacy support in use)
2018/03/26 17:10:07 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000384ff7)='/dev/ppp\x00', 0x0, 0x0)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000001c0)=""/246)
ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000e9f000))

2018/03/26 17:10:07 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000ef5000)={0xa, 0x2}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000c7a000), 0x0, 0x30000001, &(0x7f0000b23000)={0xa, 0x2}, 0x1c)
sendto(r0, &(0x7f0000fca000), 0xfdbf12558da8f98b, 0x0, &(0x7f0000ec6f80)=@generic={0x0, "8921ef79394a92d7c3e502b2429f21f76f854ff1ff288cddc58d6adfd9b41c0428c73faa536977e8159391da5b5693610a5c3b99a7749776a4fa9fe9256804488862269804a60a2e793127079bcf9b9e7ec52d6fd2b6d28138b24ab90cec254620a715c57ebc136f04080036cfbfea78f5a737fa0892ab39813f23d30a5a"}, 0x80)

2018/03/26 17:10:07 executing program 3:
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000000a000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000a7dfff)}, 0xa00000400, 0xffffbffeffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f0000000040)='./file0\x00', &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f000000a000))

2018/03/26 17:10:07 executing program 5:
r0 = signalfd(0xffffffffffffffff, &(0x7f0000421000), 0x8)
r1 = dup(r0)
r2 = gettid()
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000029000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
readv(r1, &(0x7f0000000040)=[{&(0x7f0000000080)=""/4096, 0x6a8}], 0x1)
ioctl$int_in(r3, 0x5452, &(0x7f0000fc3000)=0x1)
fcntl$setsig(r3, 0xa, 0x12)
poll(&(0x7f0000b2c000)=[{r4}], 0x1, 0xfffffffffffffff8)
r5 = dup2(r3, r4)
fcntl$setown(r5, 0x8, r2)
ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f0000000040))
tkill(r2, 0x16)

2018/03/26 17:10:07 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0)
chroot(&(0x7f000009a000)='./file0\x00')
chdir(&(0x7f0000cd2ff8)='./file0\x00')
symlink(&(0x7f0000000140)='..', &(0x7f0000272ff7)='../file0\x00')
mount(&(0x7f0000fb6000)='./file0\x00', &(0x7f0000d78000)='.', &(0x7f0000000400)='ubifs\x00', 0x1004, 0x0)
chroot(&(0x7f0000000080)='../file0\x00')

2018/03/26 17:10:07 executing program 7:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00001f0ff8)={<r0=>0xffffffffffffffff})
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000300))

2018/03/26 17:10:07 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x10, 0x3, 0xc)
sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000017fdc)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0)
sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000000640)="2400000002031f001cfffd946fa2830020200a000900020002e7fcffffffa3a20404ff7e", 0x24}], 0x1}, 0x0)

2018/03/26 17:10:07 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={&(0x7f0000de2ff4)={0x10, 0xf}, 0xc, &(0x7f00004ca000)={&(0x7f0000690000)={0x14, 0x0, 0x6, 0x1}, 0x14}, 0x1}, 0x0)

[   44.113266] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'.
[   44.123341] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'.
[   44.138256] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'.
2018/03/26 17:10:07 executing program 7:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0)
write(r0, &(0x7f00000001c0)='0x2', 0x3)

2018/03/26 17:10:07 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc)

2018/03/26 17:10:07 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000240)='numa_maps\x00')
preadv(r0, &(0x7f00000014c0)=[{&(0x7f0000000100)=""/203, 0xcb}, {&(0x7f0000001300)=""/95, 0x5f}, {&(0x7f0000001380)=""/41, 0x29}, {&(0x7f0000001400)=""/160, 0xa0}], 0x4, 0x0)

[   44.190482] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies.  Check SNMP counters.
[   44.221550] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'.
2018/03/26 17:10:07 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
prctl$setmm(0x23, 0x5, &(0x7f0000ffe000/0x1000)=nil)

2018/03/26 17:10:07 executing program 0:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00000002c0))
r1 = syz_open_pts(r0, 0x0)
ioctl$TCSETSF(r1, 0x541a, &(0x7f0000062000))

2018/03/26 17:10:07 executing program 7:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x11, 0x803, 0x0)
mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20013, r0, 0x0)

2018/03/26 17:10:07 executing program 6:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f00003e4000)={&(0x7f0000e87000)={0x10}, 0xc, &(0x7f0000000000)={&(0x7f0000000400)=@getlink={0x30, 0x12, 0x209, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x10, 0x12, [@IFLA_INFO_KIND={0xc, 0x1, 'user{\x00'}]}]}, 0x30}, 0x1}, 0x0)

2018/03/26 17:10:07 executing program 1:
bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}}, 0x1c)
connect$inet6(0xffffffffffffffff, &(0x7f0000e78fe4)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}}, 0x1c)
r0 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r0, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2=0xe0000002}, 0x4}}, 0x2e)
sendmsg$nl_crypto(r0, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14}, 0xfff1}, 0x1}, 0x0)

2018/03/26 17:10:07 executing program 4:

2018/03/26 17:10:07 executing program 2:

2018/03/26 17:10:07 executing program 5:

[   44.245087] audit: type=1400 audit(1522084207.621:11): avc:  denied  { bind } for  pid=5340 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[   44.256242] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'.
2018/03/26 17:10:07 executing program 4:
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102})
ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000180)={0x20000000000002ac, &(0x7f0000000140)})

[   44.386463] IPv4: Oversized IP packet from 127.0.0.1
2018/03/26 17:10:07 executing program 5:

2018/03/26 17:10:07 executing program 2:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0)
fallocate(r0, 0x0, 0xffff, 0x4)
ftruncate(r0, 0x0)

2018/03/26 17:10:07 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x10, 0x3, 0x10)
sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000ff0)=[{&(0x7f00000000c0)="2300000024009115460700000009e001010000c2001000000b40000000000000323853", 0x23}], 0x1}, 0x0)

2018/03/26 17:10:07 executing program 0:

2018/03/26 17:10:07 executing program 6:

2018/03/26 17:10:07 executing program 4:

2018/03/26 17:10:07 executing program 7:

2018/03/26 17:10:07 executing program 1:

2018/03/26 17:10:07 executing program 5:

2018/03/26 17:10:07 executing program 0:

2018/03/26 17:10:07 executing program 1:

2018/03/26 17:10:07 executing program 4:

2018/03/26 17:10:07 executing program 2:

2018/03/26 17:10:07 executing program 6:

2018/03/26 17:10:07 executing program 7:

2018/03/26 17:10:07 executing program 5:

2018/03/26 17:10:07 executing program 2:

2018/03/26 17:10:07 executing program 3:

2018/03/26 17:10:07 executing program 1:

2018/03/26 17:10:07 executing program 4:

2018/03/26 17:10:07 executing program 0:

2018/03/26 17:10:07 executing program 5:

2018/03/26 17:10:07 executing program 6:

2018/03/26 17:10:08 executing program 7:

2018/03/26 17:10:08 executing program 5:

2018/03/26 17:10:08 executing program 3:

2018/03/26 17:10:08 executing program 2:

2018/03/26 17:10:08 executing program 1:

2018/03/26 17:10:08 executing program 0:

2018/03/26 17:10:08 executing program 4:

2018/03/26 17:10:08 executing program 6:

2018/03/26 17:10:08 executing program 7:

2018/03/26 17:10:08 executing program 1:

2018/03/26 17:10:08 executing program 3:

2018/03/26 17:10:08 executing program 2:

2018/03/26 17:10:08 executing program 6:
r0 = open(&(0x7f0000ae8ff8)='./file0\x00', 0x14104a, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000974fee)='/dev/input/event#\x00', 0x0, 0x101002)
write$evdev(r0, &(0x7f0000000080)=[{}, {}], 0xfcf2)
sendfile(r1, r0, &(0x7f0000000000), 0x100000001)

2018/03/26 17:10:08 executing program 4:

2018/03/26 17:10:08 executing program 0:

2018/03/26 17:10:08 executing program 5:

2018/03/26 17:10:08 executing program 3:

2018/03/26 17:10:08 executing program 1:

2018/03/26 17:10:08 executing program 2:

2018/03/26 17:10:08 executing program 7:

2018/03/26 17:10:08 executing program 4:

2018/03/26 17:10:08 executing program 5:

2018/03/26 17:10:08 executing program 2:

2018/03/26 17:10:08 executing program 3:

2018/03/26 17:10:08 executing program 0:

2018/03/26 17:10:08 executing program 7:

2018/03/26 17:10:08 executing program 1:

2018/03/26 17:10:08 executing program 2:

2018/03/26 17:10:08 executing program 3:

2018/03/26 17:10:08 executing program 1:

2018/03/26 17:10:08 executing program 0:

2018/03/26 17:10:08 executing program 7:

2018/03/26 17:10:08 executing program 4:

2018/03/26 17:10:08 executing program 6:

2018/03/26 17:10:08 executing program 5:

2018/03/26 17:10:08 executing program 2:

2018/03/26 17:10:08 executing program 5:

2018/03/26 17:10:08 executing program 0:

2018/03/26 17:10:08 executing program 7:

2018/03/26 17:10:08 executing program 3:

2018/03/26 17:10:08 executing program 1:

2018/03/26 17:10:08 executing program 2:

2018/03/26 17:10:08 executing program 6:

2018/03/26 17:10:08 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f00000001c0), 0x4)

2018/03/26 17:10:08 executing program 5:
r0 = memfd_create(&(0x7f0000ac5000)='\x00', 0x0)
write(r0, &(0x7f0000000000)='H', 0x1)
execveat(r0, &(0x7f0000ff7000)='./file0\x00', &(0x7f000038cff0), &(0x7f000034bff8)=[&(0x7f0000ff7000)="00000000000000060804002000fffc0c6565643b799365005f1b76"], 0x1000)

2018/03/26 17:10:08 executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)="2f70726f632f303f76732f73796e635f708072736973747a6d6f646500", 0x2, 0x0)

2018/03/26 17:10:08 executing program 1:
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0x400080}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket(0xa, 0x3, 0x1)
ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000001c0))

2018/03/26 17:10:08 executing program 6:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
r1 = epoll_create(0x9)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000ab9ff4))
ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000f66ffc)=0x80000004)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000))
r2 = syz_open_pts(r0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fdd000)=0x2)

2018/03/26 17:10:08 executing program 2:
r0 = socket$inet6(0xa, 0x2000000802, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback={0x0, 0x1}, 0x800, 0x0, 0xff, 0x1}, 0x20)
setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f000089b000)=0x1, 0x4)
sendmsg(r0, &(0x7f0000000380)={&(0x7f0000000040)=@in6={0xa, 0x4e24, 0x800, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="100000000100f8ffff01000000001000"], 0x10}, 0x0)

2018/03/26 17:10:08 executing program 7:

2018/03/26 17:10:08 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$cgroup_int(r0, &(0x7f0000000100)='hugetlb.2MB.max_usage_in_bytes\x00', 0x2, 0x0)
write$cgroup_int(r1, &(0x7f0000000280), 0x0)

2018/03/26 17:10:08 executing program 4:

2018/03/26 17:10:08 executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)="2f70726f632f303f76732f73796e635f708072736973747a6d6f646500", 0x2, 0x0)

2018/03/26 17:10:08 executing program 7:

2018/03/26 17:10:08 executing program 1:

2018/03/26 17:10:08 executing program 2:

2018/03/26 17:10:08 executing program 6:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={<r0=>0xffffffffffffffff})
connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8)
perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x4a, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
poll(&(0x7f0000000000)=[{r0, 0xc1a6}], 0x1, 0x0)

2018/03/26 17:10:08 executing program 5:

2018/03/26 17:10:08 executing program 4:
clone(0x200, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00008c8000), &(0x7f0000828ffe))
mknod(&(0x7f0000000000)='./file0\x00', 0x1000000000001040, 0x0)
execve(&(0x7f000007b000)='./file0\x00', &(0x7f0000000280), &(0x7f0000000580))
r0 = gettid()
r1 = syz_open_procfs(r0, &(0x7f0000653ff3)='attr/current\x00')
write(r1, &(0x7f0000000280), 0x0)
perf_event_open(&(0x7f0000aaa000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000a67000)='./file0\x00', 0x26102, 0x0)

2018/03/26 17:10:08 executing program 7:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f000001bfc8)={&(0x7f00007a9000)={0x10}, 0xc, &(0x7f000000b000)={&(0x7f00006c1000)=ANY=[@ANYBLOB="1c00000018002fe0192f8b4cb3a900000a0000f10000000600000000"], 0x1}, 0x1}, 0x0)

2018/03/26 17:10:08 executing program 1:
r0 = socket$inet(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10)
connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0xc)
sendmsg(r0, &(0x7f0000001240)={&(0x7f0000000080)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(cast6)\x00'}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000240)="a7863aae81ffed99d8f5251875ce81d21c55bda54f2afc0ecf2f306653d3425f86158e93394cbb609353ff7139537ed8594d67aa56441748e3a44b3936ec79b57e90702248ca1e725b806448119d9c843269e256f67d351350b35e28a5be34bf8cab5783d4907d61e21d33eef3d591bc2b4fcec56a101891372619c3f6d1c2451e21dd75045d16107226faad31cf8c7de2a35709aeee8a6670e2acdf00534d06f395fb0470bec4a0e99ba67d8ef31cfb0e734eaa45a4b7ca7608b615a8cfe340ed1a53ded41a06a8c5073e748361f052024e92c9aeaa3536cc7bef0754ff275208f8ccd6dfb033a44d5d1edd2464ab8a0a7f8229debf448fca0a533f3f6ac14c45b6719545a80c9fb95fd6079f0cd47e466fbd1f5d4e71dca7fa959c2dc91668b806990e02cfa74a0e6ac6c177ad4f68eac15994753889319104e31be7ed2c7e84eea55b31b7a6d8babc51d7d8a7c032306bedf7eea0c9386ba32a12001eb369e8264058967de41f85279be316d8ffcef8269ce061afbbc4e7b3bd6576b88afcfb9756f94eafc868354002950422afbc5bbc904621ac57398acd556c12a5b7c694bc29e382ec7f38fa9e5b528626efb351f4f358834ecdbab8a01c9317be67f78bcfca2ec73cc38f402eaadf327926ed58fb35432156133c588c75cb8ad69aaf992c6e0f112e7bb2a0796bf94231e5b9b24dca0dd20c5127ec3fa2a907e3a51c3497693107cdb195090cd75172dea4e48203d98582d8d8fad6dae0dc03caf99508b0d8837a8c83536138777af3c134d0ce8f5100d8ee4bfda0bf4694c3d62ee57de0c66f3c984aa015750e65a9b328fc148ad54af7287278507c724fd19dcd68b86a196ff6dc39a12e91bc9fe181f1cfbfa5cb9083928cb44fb68defb6583785e387bad62c1d104f18e625f7b9f591e3496242ad3d66f7ab0d807938827ed82e4dcbdfd910401eb3b9ee156609ae2ae92f77122060b800d0ec58c60111bae67b5fa977c8e900b0afd8ec8e0f69a87a93475a94353fe0cdfab659f2a0b1f5be440e36703aa138668562533aa69a17547c53f0351dfe9b95ec944d586c4d8f37d94fae523acc96ad3ac292bc309c23deb38f8341afd6bf97289ec0217f20561e92ffd6e1ada089819e01154e633ef41cfce49a79872eb0c250ce513fcb7a1b133cc89a6530b10b93995abf9c6af86e613964ff09a52f812814ab68b44dd06aff6eb385201bf203c82bd82684115ca51b14d7768a76bd68b9e19cc32ee969f7eaa9d658b4cd5f2add9b1f1677049d06c122473d1b300fb64ea153fc010ce5e57315d2eebe7364e33eb1685e5851e042b008993bc3cd79da798a57e3011685bc17121070d0a89e45d885f7873cddd91089dea2fb89d877a4c59762955204c7f3a5752a9d53e3e40749033ab8eff7c361b21a019e7c92e6f871f053b7bf4d4c52dde8397dd3b8097dd4908af09fdf933d4389cd4207d589995166dade26d3ee031b6a825ab109eb994ed85648a054f84743778e35190303b3c6d92b76e0d93ad8a4b52853aa8ab6aa6263c93a4b81fc60d4c68a92a8383c02327fd9fc68a34d9e8a96d1cd311172e016322083b9262c754f82728c0ba3f4cbfe9f06b80388db553b23c4b0fa040341bc1a19143e21ab9dc7b83828588cbcab277e5a66aa3adbcceb3f020eac58c9595763176162abbf0de287a0a839b59cd75c8e2edaae29efaeab6973b2abbaaab37ba71c1383e297768cd6b8db00533a2af9273b8577f23611966c665dd2b6f687f4dd7e878d0bf958d7efd86c4a9149dcb35683b3f171759c8fffe5e0788dd205ac2adf691ec9fb773c0d5f4b9d3471094ec0e951f1b19a79b9a233440af0d53949295269ed8f7c699762c5178ff1eab993043149e95149b78c52aefe6fba3c6a39292c661d7bf08e55f7a65e70a9264b96f6b022a7991134392375dccd74ceea3cf512952d05c72c511919127c07d00a08b4f34202da7d4b084e58543aab2d756affb4541c417cf8511fbe3e3728b4", 0x595}], 0x1, &(0x7f0000001740)}, 0x0)
sendmsg(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000002740)="8c62046fb348790bf1c1c79f5fe6e3d84a647d964264007d9e4803b4348137b152a3584cf166ffe3de4484f8582a1d44c28f95adcf71693fc391691d35bf69c66dbbb714fc10de8b9eb824b8bad00551561176f3c4b0fb9170ec72e92434bc1b3af9e771ccc87953861233da4d302460638b01348af4eb15721168c8e6bb4f211ceeb34380194f453e574a19839855d288e3253a2e65a59beb5e0a2f200f578f55bc8236abd405120895e4ce759870d9187a9e6352ceac240b9d113b88ea860212cfb8928b912782e83abb3d4ca77649dd758bdf10d9af8a87d775ac37f759253298d7d7bd1218867f6c84d1be20663f5f096eeac335a681b848050499ccf241d0329a1403cc8749708a2d9c968b37cd7f5ae9e210d5ead1c2de227c0327020b062716685651f81c1ae657e2dd4ebebcf61dc5c90335a3bb2fd917d21bbbd42b9f2e3c57b3c271cb27699d9a2842ce136c8bddd2ff45001c82fa5641474e48924df14fe294622ebf5b128563f4b0ecbd9f93cd41b37971bf476236a0ac518603d0c32a6756b6558c71eab4ed875d20320be3879e8a4dca98086d83ce6fca4a8ee361886b96544cf319a3bf03d207716e3c48b380d3504b80e54cc38c41caff6d35aae127acbc3c5335425fee0b6f1a1786857bc20456420f461f6f2bdf93b87eed7096b0c91165789fbb1c46afdb690a9bbbf1ad994ec31b260c4ca882663b995ae301134e61cc232b9f833533d7061f7b1d24c237a7a1ddc126df144620b95025bd329de6d930e96731d926752bd0370ac16a44ac4af1b431fd6450f2fb3ecb2dafbd02b5f06d0e7241a37da896e35fb0b2ad0f3242cf0e5b11c8c942c34e5b7671fa901a7950f2de4999b5272b2792f6cb88914794dfcc075fc7b9e42b613e61f7dfbea7b25c5004cc5b8ecbca9648936671fad8c0f6181edb07eaadf1238dedc3f884af68d869502d253d9e741ba1a05a554d1c92e5bde08b8ce3378f23ac6724b980484da3d292182710bc652a63f937df6b1b97d1ae659d0b45a95b9137053ac8fbdc549b80679039f3c43566416212aac5156ead51d7aaea3d55076bbec61df19c819e60cbb10adbc241f33f5413f94753e1fa85d86e1000001fbad919ef34afaf545e2a89187d632bbcbc6a96c6b09c42779663b7c1ddde101ecf5003cfe1992757c4d17121b6ce2370583a9dd49b9a81375c72265778453d499ad8b3914bc6b0dcba8c409888ad5e547a90ceb65f530b66044a13d000c59ddc2a362db90c33dee240b0f9b35f41a507a3e7585b26c1e3f44a6e8b291c9e774aa0f63677cfbd24bd498b1e82bc75302d7c059019ca95f7c9b0855a63a66e6d8ce7066992ef3ce9b04a5140cf65ef8094234dc23f34656df9b90ceb34c8b9d4624369fb26239e362171244398198b92a2c98e9c1b8cd95349a6eca3edea5ea8be0ec34aa2eb7d41196262c7f496adbd44c775a8067a9dc4eccd1e451874971d8d406175fef420f30f1e4dba07202be77a3ad15f9e6bf7b305966e70a988a843bf753b57075c616554dd0f0373dd238eec87d9ecbec18e32751ae0f87e6d5f5189abf29581d5aee8e2037f9dc6daad79144fba53d0b60dfd587d974e66789cf47e0dcbb68be8fd3ae596eeb244a9263bc8ad6240ef2351df29d4f4e2f718af34a0466f1508192876d46259e1cccd99460d2dffa6e825dff0668cf37cd77b01145bb0701aa263a4fd5c9698b379fd341a81837d8f17599f971ed4acf661aeb91ff30d20560a11b79056859ff98cfc61971e77f61889421ea0043884c6577b5f141189bb220f3cd11328fd1ddaaf64a4f7399ad3fe1f4253817ae54c6774dcccc0fae5118f9fb15e40855483b7a35aadde5f3c8be1ccb3582665d4420b72d69a6666d307a117d600e37b6c7826b69e6ab12276d4012ee6ad5d1a79955845a009af5d10d0d5e692035a30a045c900058ec82990e368dc40daa1e5cd33ed68a9888066615c8206afcbcaa459b1e8a49167272a74d00000000000", 0x594}], 0x1, &(0x7f0000004740)}, 0x0)

2018/03/26 17:10:08 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0)
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x84, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x30)

[   45.164124] syz-executor1 (5480) used greatest stack depth: 23544 bytes left
2018/03/26 17:10:08 executing program 2:

2018/03/26 17:10:08 executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)="2f70726f632f303f76732f73796e635f708072736973747a6d6f646500", 0x2, 0x0)

2018/03/26 17:10:08 executing program 6:

2018/03/26 17:10:08 executing program 7:

2018/03/26 17:10:08 executing program 3:

2018/03/26 17:10:08 executing program 5:

2018/03/26 17:10:08 executing program 1:

2018/03/26 17:10:08 executing program 4:

2018/03/26 17:10:08 executing program 2:
socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000c00))

2018/03/26 17:10:08 executing program 1:
r0 = socket$unix(0x1, 0x1, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000a92ff7)='net/unix\x00')
sendfile(r0, r1, &(0x7f0000000300)=0xfffffc, 0x10ff)

2018/03/26 17:10:08 executing program 7:
r0 = socket(0x1000000010, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000040)=@ipv6_delroute={0x1c, 0x19, 0x201, 0x0, 0x0, {0xa, 0x94}}, 0x316}, 0x1}, 0x0)

2018/03/26 17:10:08 executing program 6:
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xf1e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000040)={{0x0, @multicast1=0xe0000001, 0x4e22, 0x3, 'sh\x00', 0x6}, {@loopback=0x7f000001}}, 0x44)

2018/03/26 17:10:08 executing program 3:
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
mount(&(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, &(0x7f0000000400))

2018/03/26 17:10:08 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f00000006c0)={0x0, 0x0, 0x0, 'queue1\x00'})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0)

2018/03/26 17:10:08 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setgroups(0x0, &(0x7f00000003c0))

2018/03/26 17:10:08 executing program 5:
r0 = socket$inet6(0xa, 0x803, 0x7)
sendto$inet6(r0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c)
clock_gettime(0x0, &(0x7f0000000b80)={0x0, <r1=>0x0})
recvmmsg(r0, &(0x7f0000000b40)=[{{&(0x7f0000000040)=@rc, 0x80, &(0x7f0000000480)}}, {{&(0x7f00000004c0)=@pppol2tp={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @multicast1}}}, 0x80, &(0x7f0000000ac0), 0x0, &(0x7f0000000b00)=""/43, 0x2b}}], 0x2, 0x0, &(0x7f0000000bc0)={0x0, r1+10000000})

2018/03/26 17:10:08 executing program 7:
r0 = socket$packet(0x11, 0x3, 0x300)
sendmmsg(r0, &(0x7f0000005180)=[{{&(0x7f0000000000)=@nfc_llcp={0x27, 0x1, 0x0, 0x0, 0x0, 0x0, "be449820971e05a46e7f3193f48c4e10c1cb424c49f23af339988a7700ed2f8b8037b9a32de9862c620aedddf2e902c76d7034a7a0abe39879d340712cadb7"}, 0x80, &(0x7f0000000100), 0x0, &(0x7f00000012c0)}}], 0x1, 0x0)

2018/03/26 17:10:08 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000100)="f650aaf2115a5af2146c319c1588ed96", 0x10, 0xfffffffffffffffd)
keyctl$update(0x2, r0, &(0x7f0000000140)="5fbfa0dedc36443f2807a3f7b80c5b3f83366cae748f", 0x16)

2018/03/26 17:10:08 executing program 6:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendto$inet(r0, &(0x7f0000000100)="a9", 0x1, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10)
recvmmsg(r0, &(0x7f0000003bc0)=[{{&(0x7f0000000800)=ANY=[], 0x0, &(0x7f0000000040), 0x0, &(0x7f0000003ac0)=""/214, 0x7a}}], 0x1, 0x0, &(0x7f0000003c00))
listen(r0, 0x7)
accept4(r0, 0x0, &(0x7f0000000000)=0x31c, 0x0)

2018/03/26 17:10:08 executing program 0:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)="2f70726f632f303f76732f73796e635f708072736973747a6d6f646500", 0x2, 0x0)

2018/03/26 17:10:08 executing program 1:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x200000000000002, &(0x7f0000690ffc)=0x77, 0xfc)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00007f3ffb)='yeah\x00', 0x5)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10)
sendto$inet(r0, &(0x7f0000f53fff), 0xfffffffffffffc64, 0x20000802, &(0x7f000006d000)={0x2, 0x4e23}, 0x10)

2018/03/26 17:10:08 executing program 4:
r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x4000000004005)
ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "4134e475824fbfaeefb278580e4aedd886c0b629cd32c56ebff94329c3a32a4b8c171676b94083085709923fd77ead8ca0073183b09c62b90673944ded2f276e", "49710f290076931228cd8c92a1b9375555874f087c556b616155647a2732f399"})

2018/03/26 17:10:08 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}], 0x1c)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000107ff8)={0x0, 0x10040005}, 0x8)
connect$inet6(r0, &(0x7f00008c0000)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c)
setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000a0bff0)={0x0, 0xebe}, 0x8)

2018/03/26 17:10:08 executing program 5:
symlink(&(0x7f0000000380)='./file0/file0\x00', &(0x7f00000002c0)='./file0\x00')
syz_fuse_mount(&(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)

2018/03/26 17:10:08 executing program 2:
r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0)
ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00004fb000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, "acf42f48ef6ff65ec6f1b21626c8240b1655eaf512a8d15a16e87caa0f5aec8b04eb3ef9e365c6350f550e0e6f736e265abe1443385abcca5c894515b8307a8a", "3ff8000000001a0000015a86d4a42e53e2aa636053b1c18db1bca80a1ae0cb65adcbd3df5de03b96f78b55f6b9a12bbbb783950ee77f25fcde0df5506c142cd3", "e4391ec9e07e01113700010000000080001580d34e9ae8d3b20ac260004ca719"})

2018/03/26 17:10:08 executing program 3:
creat(&(0x7f000078dff8)='./file0\x00', 0x0)
mount(&(0x7f0000340ff8)='./file0\x00', &(0x7f0000ff8ff8)='./file0\x00', &(0x7f0000426000)='tmpfs\x00', 0x0, &(0x7f0000ece000))
dup2(0xffffffffffffffff, 0xffffffffffffffff)

2018/03/26 17:10:08 executing program 7:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='hybla\x00', 0x6)

2018/03/26 17:10:08 executing program 6:
r0 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r0, &(0x7f0000032fe4)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x8}, 0x1c)

2018/03/26 17:10:09 executing program 5:
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000e40fee)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)

2018/03/26 17:10:09 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0)
r1 = creat(&(0x7f00000005c0)='./file1\x00', 0x0)
r2 = dup3(r1, r0, 0x0)
fcntl$setstatus(r0, 0x4, 0x4000)
pwrite64(r2, &(0x7f0000000c00)="2a25b18c930bbd8d134f4581cfc35a43fc8ac5baf8ca551b317568acf0d577f4389907725e1f1619392fb96c1f0cd9afa731f6f1609a0ff60ec3566a2ae938cdcbd6d64dfe37a3e06d5ccc5a30b24e0f114053ab05f6ac1b04ca07ab95f3c71520b3c9cdf1bae368919ef6dc9de540104f1f995782e7b01e248b8af8d5090313decfa595fb3d3fb57da72bce1bb4558fc7dea0131472d2fd9ec225d21f7fb1dcc96315f36816415c745ac070eda6713d51541127641cc960b3bb0c82378c9c819a92f138deb1fadf65bc77b0a468a7c82c657e138a5ccd545384e60f9e8cb72e7e8696b84409ad9550003b78cf22b234251e1d547c151f6f9c9e9c5426c1acab284fdc52527b07f88921a91741f58332045e4a054f7003362213011bba10c196ec3ab5947eb312a05e3de279dba88e0d28a8bf08db785615d1eaee0a3c663f53033d8a50d9efe70141dadefdfe8ee359ec349dcd562cf75ca8e4fb608478c8488b9681a7a01c09dd0e4d016663259a453145f37058f6550720a4abcc476f2e3f4aa9b7bd531cbf14bf269a40b4aaf06d60f14c0883d0ba795e911c4ed1f874df405d3e9ba379a23f284501bf19d3ab1822e16af61a3c2529ca70dcd240f080c3b864f8bd93f329209cbb8c710f4ac173748ddc30f8fbad8ea77c1c82ca9cf24be70dff280896f77814aeb1390fec1635ade11ec2f49f6a0230f841eb07e9181ac02aef6823f72a07d5321af6bcc84e3b646701870dd6aa3e819e5245cd6d4c7cde1c94fe51071a3901be2a6a9a2a314ca56b8b877e3c38c55417d9d1018d15542692e696c33096a944f19125527656504f4ca08eae7e8828e14e546e93fc250d7f9dc030d813b90aacee65ca24debcc5d251517971f6383b5276f9f13cdb19d3df39b751906e108f36da10cad8211ed570409a17576212ced71591c429ec78bb44373e4b4027b127d52aec4c001f07861f940844915095a60a30f197b3e0e9ccccecaf5cb1fea4b7c7c14c79b78001d0e351bb7aa544114eab26b3627a135da0431a23d86e37b12a36d34a37361f2bba2a8821149bda94963b3981d0b9c0c9df98c3d486d835fbdf5df1682e9178266a6ed1515384ec57dec3e1b551825849e8cd569fdf3807b510faf94ef7ad743679e15c2f1f5a1e5b6dbde8cdc8f75258b0d23b24cf902bd288c68f8fa8f4b4c23b7243e663abe29f3247e145b7e6ff227ea02b9ef309b67612498a669663162e2a6bc9a210a1db4adc1ead091fdbe575a90088e6cf2c8396967935f0d59acae8427b9e4293c9e783e27925e44c3018752213fa9174063f6353a9b51390530d4564f0e20495773783590bd18b70c5c967931da13ba9609b2da3f30b9754bc4e261a11bf5d07530705c55c728d94e9e6bf4b799a0f0e976558d0754567670c6b81be919023a6a828b00fbc52211c2fabff6c176823c58e3e19bddc3df99aa464d9ebc003b9efc2fe5fc64f39c4a91f123cdece668fe446ae0cf3995053c59c44ccbe76aa8797dbe5955d8c167b1894a0c01d86e18537b55197701c6e22ddb40d870691f0fe196ffb2e0381077b96920dcf836561ac095ad6ea746561d70280353b87e6a1b2acc9b4f4f8b09ccf3303b0920d46ffc7f417bb154b9a4818a3490d321a148b0f650c6448ebae5206f262b01f0fd4623405c36090c8d30a4a37c38769c46eb4893ff38f6745a2fd23a78c791ac401b012dca830423047709caf4e818e39e56e1aac9f99d7801aecfcd430d6210554c910ee7663963ca06d3d66b608bb308c14b26771a9342fe6070a90548427c6f5d0db63cd5a4f8639a99e213b37311e0020acb51523e423eecdd4ad7b8d30a5d7705f6aed67b526879cb37c2a20e21f308ae1342957fcb71a4db2ced8fae510d89982f5ce8c10cb30d74eb238c05beaa5a8f521124ae8d2a99d3fdb9e7ded20ca6677d64e6bda8bf5ea350c0fb8773d55b7b530f5b2b5ad561ab35a5aca1d09dd8681ebb37ec5eef2ff947da839297469751f21127329d23468100ff6a2bd0556395aa090deed0f7b3dfbfba725eb9152bbc6e0e86392d8aa19c23137e60509f00da793f569a1b1cf089387bdbba3868da4c1b4b8f30d60de51907795c32a8ec1cc3d472f363050b50ac1979f18189da3965ddad5f945106184ba6d7f2b2acf", 0x600, 0x0)

2018/03/26 17:10:09 executing program 2:
mkdir(&(0x7f0000c4e000)='./file0\x00', 0x0)
r0 = open(&(0x7f0000032ff8)='./file0\x00', 0x0, 0x0)
mkdirat(r0, &(0x7f0000033ff8)='./file0\x00', 0x0)
mount(&(0x7f0000432ff2)='./file0/file0\x00', &(0x7f00003c9000)='./file0\x00', &(0x7f000010bff7)='configfs\x00', 0x1001, &(0x7f0000a06000))
r1 = syz_open_procfs(0x0, &(0x7f00000c3000)="6d6f756e74696e666f00a4")
sendfile(r1, r1, &(0x7f0000000040)=0x800000, 0x408)

2018/03/26 17:10:09 executing program 4:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x0, @loopback=0x7f000001}], 0x10)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000080)={0x0, 0x10, "937187ed09572169d84182634235aec2"}, &(0x7f0000000180)=0x18)

2018/03/26 17:10:09 executing program 7:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setpriority(0x0, 0x0, 0x4)

2018/03/26 17:10:09 executing program 0:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000ed4000)=0x78, 0x4)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10)
sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback=0x7f000001}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00003d1ffc)='bbr\x00', 0x4)
sendto$inet(r0, &(0x7f0000000bc0)="1e", 0x1, 0x0, &(0x7f00000000c0)={0x2}, 0x10)

2018/03/26 17:10:09 executing program 6:
perf_event_open(&(0x7f0000740000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000b86fff)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mlock2(&(0x7f00005ee000/0x800000)=nil, 0x800000, 0x0)
munlockall()

2018/03/26 17:10:09 executing program 1:
r0 = socket$inet(0x11, 0x40000000000803, 0x0)
recvmsg(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@pptp={0x0, 0x0, {0x0, @local}}, 0x20, &(0x7f0000000080)}, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x107, 0xf, &(0x7f00000001c0)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000100], 0x0, &(0x7f0000000040), &(0x7f0000000100)=[{}, {}, {}]}, 0xe0)
recvmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)=""/228, 0xe4}, {&(0x7f0000000200)=""/201, 0xfffffffffffffc50}], 0x2, &(0x7f00000000c0)=""/34, 0x22}, 0x0)
sendmsg(r0, &(0x7f000087dfc8)={&(0x7f000005e000)=@nfc_llcp={0x27, 0x9, 0x0, 0x0, 0x0, 0x0, "f0aeec0d840130e5c5485e44a7627f9a8864abed4d4460dd5b1a0182c6c84a143e64f31d1c11349c949054860b9c131950a610e2736612827582530c3c1df9"}, 0x60, &(0x7f0000000380), 0x9c}, 0x0)

2018/03/26 17:10:09 executing program 5:
mkdir(&(0x7f0000c4e000)='./file0\x00', 0x0)
mount(&(0x7f0000432ff2)='./file0/file0\x00', &(0x7f00003c9000)='./file0\x00', &(0x7f000010bff7)='configfs\x00', 0x0, &(0x7f0000a06000))
r0 = syz_open_procfs(0x0, &(0x7f00000c3000)="6d6f756e74696e666f00a4")
sendfile(r0, r0, &(0x7f0000000040)=0x800000, 0x408)

2018/03/26 17:10:09 executing program 7:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f000022d000)='./file0\x00', 0x0)
mount(&(0x7f0000212ff8)='./file0\x00', &(0x7f000001c000)='./file0\x00', &(0x7f0000982ff9)='mqueue\x00', 0x0, &(0x7f0000ebcffe))
r0 = creat(&(0x7f00004c1ff4)='./file0/bus\x00', 0x0)
lseek(r0, 0x0, 0x2)

2018/03/26 17:10:09 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00')
sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, r1, 0x109, 0x0, 0x0, {0x2}}, 0x14}, 0x1}, 0x0)

2018/03/26 17:10:09 executing program 4:
pipe(&(0x7f00005db000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
vmsplice(r0, &(0x7f00005e2000)=[{&(0x7f00002ef000)="f8", 0x1}], 0x1, 0x0)
r2 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000001000))
vmsplice(r1, &(0x7f00005d8000)=[{&(0x7f000021efe9)='3', 0x1}], 0x1, 0x0)

2018/03/26 17:10:09 executing program 0:
r0 = syz_open_dev$binder(&(0x7f00006a9ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001fd0)={0x44, 0x0, &(0x7f0000008f04)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000008fa8), &(0x7f0000004000)}}], 0x0, 0x0, &(0x7f0000008fc7)})
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1dd16de371f1d99e3b4d488546c2bbb067efde9e55e9d1048602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})

[   45.911331] audit: type=1400 audit(1522084209.291:12): avc:  denied  { set_context_mgr } for  pid=5603 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1
[   45.936812] binder: 5603:5609 ERROR: BC_REGISTER_LOOPER called without request
[   45.961675] binder_alloc: binder_alloc_mmap_handler: 5603 20000000-20002000 already mapped failed -16
[   45.976476] binder: BINDER_SET_CONTEXT_MGR already set
[   45.982305] binder: 5603:5609 ERROR: BC_REGISTER_LOOPER called without request
[   45.991490] binder: 5603:5604 ioctl 40046207 0 returned -16
[   46.981718] IPVS: Creating netns size=2552 id=9
2018/03/26 17:10:11 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000000))

2018/03/26 17:10:11 executing program 6:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/ashmem\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x910000)

2018/03/26 17:10:11 executing program 1:
r0 = socket$inet6(0xa, 0x400000000005, 0x0)
sendto$inet6(r0, &(0x7f0000000900), 0x0, 0x0, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c)

2018/03/26 17:10:11 executing program 7:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
uname(&(0x7f0000000040)=""/91)

2018/03/26 17:10:11 executing program 5:
unshare(0x8000400)
r0 = mq_open(&(0x7f000004b000)='/$cgrouplo\x00', 0x8c2, 0x0, &(0x7f000004b000)={0xffffffffffffffff, 0x1, 0x3})
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000289000))
mq_timedsend(r0, &(0x7f0000012000), 0x0, 0x0, &(0x7f0000036000))

2018/03/26 17:10:11 executing program 2:
unshare(0x20020000)
mkdir(&(0x7f00001a3000)='./file0\x00', 0x0)
mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000))
mount(&(0x7f0000c6bff8)='.', &(0x7f000092f000)='./file0\x00', &(0x7f00000003c0)='fusectl\x00', 0x0, &(0x7f000002f000))
poll(&(0x7f00007a7fe8), 0x0, 0x7f)
rmdir(&(0x7f0000d19000)='./file0\x00')

2018/03/26 17:10:11 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
request_key(&(0x7f0000000340)='id_resolver\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9673656c696e7578657468315d23656d3000", 0xffffffffffffffff)

2018/03/26 17:10:11 executing program 0:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x69}, 0x0, 0xffffffffffffffff, r0, 0x0)

2018/03/26 17:10:11 executing program 7:
r0 = socket$inet(0x10, 0x3, 0x0)
sendmsg(r0, &(0x7f0000014000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d4c1cbc882b079881", 0x4c}], 0x1}, 0x0)
syz_open_dev$tun(&(0x7f0000004440)='/dev/net/tun\x00', 0x0, 0x0)

2018/03/26 17:10:11 executing program 4:
r0 = syz_open_dev$binder(&(0x7f00006a9ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001fd0)={0x44, 0x0, &(0x7f0000008f04)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, &(0x7f0000008fa8), &(0x7f0000004000)=[0x0, 0x0, 0x0, 0x30]}}], 0x0, 0x0, &(0x7f0000008fc7)})
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1dd16de371f1d99e3b4d488546c2bbb067efde9e55e9d1048602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x14, 0x0, &(0x7f0000004000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4c, 0x0, &(0x7f000000bf80)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x222, 0x118, &(0x7f0000777000)=[@fd={0x66642a85}], &(0x7f000000b000)}}}], 0x0, 0x0, &(0x7f000053f000)})

2018/03/26 17:10:11 executing program 0:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000348f88)={0x2, 0x78, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, r0, 0x0)

2018/03/26 17:10:11 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f00004c6f8b)="6d6f756e74696e666f004388f750c83d14c4a3a9ac1488a477660ae763891738ac656bb3e891941f02f1265047502f6c2dd9f655ef7131eabf3110d638f0d2e6a49a2bc4a08d63e2da7af47e6c37972352875f125bcf3ea7f04b7b505b6a06beedb2a86e30a86bc0d37a6438b99a45ea22b1f4fb05")
readv(r0, &(0x7f000005a000)=[{&(0x7f0000d1d000)=""/203, 0x755}], 0x1)
mount(&(0x7f000000a000)='.', &(0x7f0000852000)='.', &(0x7f0000a60000)='ramfs\x00', 0x0, &(0x7f0000d1cfff)="d6")

2018/03/26 17:10:11 executing program 6:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r0, &(0x7f0000f6f000), 0x0, 0x20000004, &(0x7f0000cc7fe4)={0xa}, 0x1c)

[   47.954317] netlink: 8 bytes leftover after parsing attributes in process `syz-executor7'.
[   47.963825] netlink: 8 bytes leftover after parsing attributes in process `syz-executor7'.
[   47.982960] binder: 5800:5805 ERROR: BC_REGISTER_LOOPER called without request
[   47.984409] netlink: 8 bytes leftover after parsing attributes in process `syz-executor7'.
[   47.984462] netlink: 8 bytes leftover after parsing attributes in process `syz-executor7'.
[   48.010116] audit: type=1400 audit(1522084211.391:13): avc:  denied  { call } for  pid=5800 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1
[   48.035015] binder: 5800:5805 got transaction with invalid fd, -1
[   48.037580] SELinux:  unknown mount option
[   48.040013] SELinux:  unknown mount option
[   48.050091] binder: 5800:5805 transaction failed 29201/-9, size 546-280 line 3239
[   48.057901] binder: send failed reply for transaction 3 to 5800:5812
[   48.070653] binder_alloc: binder_alloc_mmap_handler: 5800 20000000-20002000 already mapped failed -16
[   48.081284] binder: BINDER_SET_CONTEXT_MGR already set
[   48.081294] binder: 5800:5812 ERROR: BC_REGISTER_LOOPER called without request
[   48.086781] binder: 5800:5812 unknown command 76
[   48.086788] binder: 5800:5812 ioctl c0306201 2000a000 returned -22
2018/03/26 17:10:11 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000000))

2018/03/26 17:10:11 executing program 0:
mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0)
mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000))
chroot(&(0x7f000009a000)='./file0\x00')
chdir(&(0x7f0000cd2ff8)='./file0\x00')
symlink(&(0x7f0000000140)='..', &(0x7f0000272ff7)='../file0\x00')
umount2(&(0x7f0000000040)='../file0\x00', 0x0)

2018/03/26 17:10:11 executing program 6:
r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0)
ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00004fb000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "acf42f48ef6ff65ec6f1b21626c8240b1655eaf512a8d15a16e87caa0f5aec8b04eb3ef9e365c6350f55010e6f736e26332f1443385abcca5c894515b8307a8a", "3ff800000000000000015a86d4a42e53e2aa636053b1c18db1bca80a1ae0cb65adcbd3df5de03b96f78b55f6b9a12bbbb783950ee77f25fcde0df5506c142cd3", "e4391ec9e07e01113700010000000080001580d34e9ae8d3b20ac260004ca719"})

2018/03/26 17:10:11 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/.et/ipv4/vs/pmtu_disc\x00', 0x2, 0x0)

2018/03/26 17:10:11 executing program 7:
capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000001fe8))
openat$ppp(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ppp\x00', 0x0, 0x0)

2018/03/26 17:10:11 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000017000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f000000d379)={&(0x7f00000000c0)={0x24, 0x26, 0x301, 0x0, 0x0, {}, [@nested={0x10, 0x0, [@generic="28fdf824473adbe6f7"]}]}, 0x24}, 0x1}, 0x0)

2018/03/26 17:10:11 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000b2000), 0x4)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4)
bind$inet(r0, &(0x7f0000490000)={0x2, 0x4e22, @loopback=0x7f000001}, 0x10)
sendto$inet(r0, &(0x7f0000a92000), 0x0, 0x800000020000000, &(0x7f0000303000)={0x2, 0x4e22, @loopback=0x7f000001}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000965fec)={0x0, 0x0, 0x7ffffffd, 0x10000007ffffffc}, 0x14)

2018/03/26 17:10:11 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x800000018, &(0x7f00000001c0)=0x7ff, 0x4)
sendto$inet6(r0, &(0x7f0000000200)="852baf474f9d844200ff6eaaeb41fa676af5ace451b619450be493fa134c5ead5fc8444f1a04267da95db4e597e8f369008bc3583da51fbd4e2d4c11d59fb91a0721d12d941a8e26931110980ef2d7eafb50367026ac0d85753aa0052113a17b499046929a8f3b02edafb6d9ee07fe103802cb2a77a00299999739544d6aff94fd7924be213405a9747b3c8f92116229244b07596c2887384c07fd3350775183cc10dc51c5932d7e941f5751f75219e2c6dd6186acc66c16f6780d6f1e5fe70cf892ff96e03677b14d805a64ddba6989d126b30a5117d5ade0b506fbf261e41dbe328510e099b0cf97b5ee5d357e85caf0fda73a7f3463b91358035ae14fe0636298bad998e7d1424901823bc4a7daa3aa5576c5b3e3c9f21d062f213d59564d3ed08411d8f95d13f5210b5ce95c113f4d182d497b309f9e13ebfe70a0c4d8bb206d9807a923cbf9d99da40bb6e8658ce3a864817ac02612b147f897c0d099a87ddccbf0d4324e721a4605d347de475ce9010d752536cebce1a354ac36045a6307910dea371f3830bb0db97c197500977181ad406604324f22852f9d72c189cee2f4edfa7d81f2c39f80bbfaad1882088a65ba84f6e13e03c3165989811864d49403a50a034425d80fa59eff0afe1ad755e345bf34074ff222602993c9bf18410caea4bc00b782a697c9e61dff66eca9997c12f8c757692e4d633cad24cf1fc58a9cfc533d8aa24add5fa8e8cb11154106488ff465711d30715dc5e7b0b882f9d41210d4b87bfa56566fbc00a0cc6fdd76bd36b6aac710ab88feb48ccc03e19c02434c3c8d3b841b2c5f08bfe65db4438a1553887c0d8ae13466c6b7709389eab792f0b41ffe02261120f2e3d9ba38049e29c01da7ed775956ad401920a58ca6252e5027794cb378199688eb952a6e5befcbea4a8f57dc875d081e8e1cd39007b943af415bf42bc560321d3e8f4aab841e186414a78b0668fd4086dc0d4f94cb99d0f7541332e42bb27af0489180289dd7602e1cab05ddbf6f49f9eb69099318507aa167f33ab0c36d5eefbba42ce93c8c140711e487efceae95fd379451e9b8b976cdd88bf4d6fe4da5b534003db1e5a3ec22a819aaa099c2ebcfc647b31e0dd305df6f2bdc226bb1cbc1a2a21a41541f871c61ec8e28db0c5d6bae6185e92d10fbce16505b96a861765cea0b51ced299a97dcb71f0f497732fb9ea0fc7c116db44eeeb704d50d3e2b6a18b5f4b37343f2d58a397e8f1202d41412f3d2f0876d5223a991705016d7b610a297632e5d9be5277cb5819ebc664170629b06ee58ec887d2946d5b51b6240213d577826074b01dc429018107dc0c59cade0e29f32861e9093846f5fd20ae0313cdba55ab7ecda6461d8be1eec5cf0626264cece4302fe44a663ce33599cc28c613616aa00599fdbb086b2589d3499cfc627d2efacb317a0f8592d64b8f4e698faa4f1759741e73fac4b9caf79915a72f364c641246e949f626ed3e82b03e60ebd9c4628a74f119c413777ace44cbda5e8b61ba5b4d02c4441d186e34bfa4f37b6b154d2e83a922f3956eba89e40c9e2480b92b16596e95fdbb55143ad2f61b1885fb2409c75f6a39545c8d7ec130a79e5243e1440c465002111e913f488fe941e2fcac0d7f340bd9e56027b0896c2feed62d58cee71c0a8f0406dc3417266cd7ed8764b16fa41c104ea1f73c851cebb98468006d1707a0d1e32803a818fcfe3ca399472d91522107b126be4f54ceee1d337347fbd0ac1dcdc06a3f5a075c58f2bb50ba47d3fb192edabd196a93a1eab7e2e7f2715a48483f16fc96eae90666db8cad29b218e4958fb610993e48cfd5469cf9e4e3f34515c80df69df6a91305efc0b77502e9a61765a12ccafdf2f9384c55e2587adbee9381b84d283e3ca3bb9503b74bf6e8620ad628a5083de354a12a0fbcff06e7f977fa7f8944b8d689c1d224be6a11ba45913e1665f6adfdbdc6e25f391a32dccc3eda64307ff92f8cf24a406c8535649363b1ef9f476c4ba6fb97a367e6da1d7a02222941f6d01200c819fa27fc2a67919ad601f5fb73a847e056e7b5487b8cb49307809cf1cb1e3cbe7719cfa034ad455f4368cc1924d55a3e2e7ad3a1bd03b38cbb1eb6272ccbb6d81893665820ba2324e925d95506be1e6281a22a3549105acdad9b350fcf8f95b5c02e65476621780d7140970473f742d045eab5a0521302edced5ab0ebaed4ce3a201f2a562b0998b3354efe463c5b03a2b3bad9ba531cef17da2856263ca1bbf4caebf835d13d9a99bedddd7fb87d99f1d1231b2162763719069fff0988b4de34c7a261673245af43bb44a81dece7db8f81e89d1b1fa033bb82b55e8a6ec5da99fa7c2c48e24f6915151deffc3c40aeb7dacfac8d33828d880ca5ed407113f2166adf0956984406e9790e3cadadcb02449d2253e5599fd8e552c1530ce6ac45f66520bbe0fdaf7ede7630e1bb3fcc6da10bafb13ac7bfd487062fa0c61b3be9c202a27e020f20e8d721b4667b098fba4af46eb34403dc5b328f0020d6d2c2bf6500806dba5ed2c6b1c4e937195eb7a4f39282fd25f6ec249f199443f1c6ff57f74de31e331a435099ef493fb6288dc69171648ed750ece674b9d9349ecbf1da2f67cf6f56ea04afccc3bbbf0f505b5d2a234a030dda55c18c09884c8c002eeb42ccb3be4cbfabdf327a0023e3967609480465e0909b83a23013252402bf1d36d79af938bbb581169dde4f653daa024aafe82ff3ca07db778499f7a1d3c67809fef35f7f1b13543ff0025d39bb75cb3693122acf77c63fb3bee21d59ca1649d8249073d36f99a2b3ca5bb23c32d8c30a6bf9f6d3e9bdc18d25218e2074b3fee101b7d3f317840deaf3710a9675708af563f871001fd9bf430b6b3121679b161149fd742169cd1d79cb41eec76b5b50c82dd06508268598133ebb8405e90d1a9f16809c8637fa5cd05b2beb3681577ae23fa4780efe7e531f027551bbfc61861f5fd7d6e69a89932b88d24f399080b229f4420b23f05c96ef798014a8a7f8bbb7501077b075255b3cd59579cf7c003d3339fe26b8df7cde88bc8d3aebd2b854b039573ebc1baa3436d77f017b505db2cffa8274b38bc89498f0b62465a1df5607159bd065c507a275265277675a415079eb220e70d1915a6d36800166b26054000e45839201bd75737ef38a3b36a1f1d95a1d3d9ee31fcd6e368fba3c9b08b35d04d8264fb62926d6a243017a6cc552b6cbd1645126aa0185f7a95e4b17996291503301c7a863e0a8cc1997eedf32ad5aae7c51697af9a602dc8ca4ebbe1791573d5e9c4605c5f476897fad4f35b56acbaac641d75df7ded3e68adca151cd313ce4e2128a0e1f572a30c6ebccc58c1bc113be9b1aea66e4c5ba98f3160c6330173a74bfb572d32348a462b73e076f9daf59d30dadb75149fa4679e97b967b5834712d0c69d322dd787805ccf114507ef6219de6161cf880a8f0b0a3a0375237e227b9f1cb9d9068615cac6523c5fd2c802a5faeee302ac93e7eae9f0377793ca3369ee05b208d708ce746b3e4fd38799c146426242d856fb596a4279cea53d8c9745345e94464266b3c75e4e7e6ad53633524dbe04791a0ab70a9e4e530e4cf41aa1b407f748ada018844d309c0d2c005b38b02799dd8279f9ad9636205191ac1fb225fb0f31dbd605e8eb8e7c471120d41242275f3c743299807a021f334a67c837ec9595b5bd2c254e1214221dcb2a53555e23263cd52629571e84367db9d65ce87dff4d807e0a00799506e716d3b5de79f8cd64b1af662043878a03b220eb43fe66945a80431a52621b06ac3015d97d8f92bfad82631dffdc9c1c9529a7fcece0884709fa024098b3ffa4420e98c2c3422ddf218347fe1e171550d2c71a47c90a21024139b57aec3f87e0b03b4ac66915d47cfc80f062d1a2232869d41e8b2e3432031ce51cc4724981f77eaad13d35be906d1b1e90d171160eb86c73ca468ff158a90e7ea06c6fde8013f26915eba73b89c2210def8108189bb857a14d2de4b371d0437135b969325149a03f6f274df28b142c0c07be3e008cb53e077de26d56773d8af1aadf56ca9821ce745fb624de7dffff36cd1ca6bb32c38db947e02e8472d9a9644762e7c3d50b78615363be21fe15afe8e0abd3cbc850e7602b468ac83d582ac3f817fd1b177be55a5eda98a81bdb73d76e8182002c30228044e3279fb832a0a2f507296d99697457e6b838d69136ee77475de928e5606a75100b690f3e850d54b8d2454a8af5c6cca20fe5f9e5fc7756d959e28ad7404866bf92d839dc71ae2a5777e32d71346e71c481a50d9593d3a5f0abcf7d83856da129f3b8d5da4a4622a4a69c37694a183f3bcdeb89df3cacbb12885758ceb88b8633495495403bcaf815bdf57457ea8bdf3a0e732715b4a99a6d8e24abab1feedecc066c82511f5a6f72bb869d4f0a20133db034bb157cb7a4fb61e9f418ec2f1b697a58d9e67547add6e6a1f4eccfd1bab9a219dfab0cb72bde41107ef9f55d090e7315e31d0d478abee694bf594498f981ff58cdef9d959ef69298781d36ae2fc12712843db191300494cf95144e4deeaa983986c2de6f76c91f5e48f2d0e72e2d42a0b6d5dfb76c8247d77f2ecc763d2bee8562dca236bcbad916ccd48da8e7b7e60e4c8d3f7dbb702cbcfd9183715d3f3c216af989f4124856547f49075d156eb1612d549e8ed5e5885ecf22c6940564ec35e6b4fccd8e20c2bdb2883b12328705d80d8b20766135fec7de397ef4d64d9d5f29123dbbbb5be660199cc1bfa96b6943a62b319ac65ee0d8a6a32acabf1b02c4fdef6c3eeb41e3d19455bc7dea59cda28d6524fb57116b3f6a080b55450710b5e19c0782362edfff3cac44701fe79e558bafef7eece5487361c79935cd305b66a1f84a194f49fde72074974c15dbee56d00b7a8f3f7e4c5d3099ecaa0ee6e6058f833de75f4dab500258a20894cfd91cab5f6c43b7d8b0e234546a313b91ec649fcb85c897175512a0d0152da184b6b6c3bb06662fd3b7f42e47bae806c14f8e29280017ec3cf32ce82db404b54067dcda9d9a2cea1971c3eee8be5e44cea787f3644216d533cfb1442f8d3ba411cdfb736bc1508661650d47a84f07b5426cfebd0a037750bb17899e1f81e4b36826d73b9bc16712333e14d14d0b33832b1077d839fed78a712e5d5c2b10ccf3b3d4d79f47368fe291de1b3bdf6dfbb9b8455681ca11df0ddf69c30e239491898e5ba6f61c660097f4245357273824ab2e5bc56a3f5989eb7b09f31f80b67701d39cdeb7c153b98b0acf9a362a95aa8ac610aa6c4cc21f8ba06741751cc90813883ec0ec05cbeabd46ef9f3cd22a5dc136e8b8c8b7179821f8e82fdc29b2733faea7d081ac1310867dab146ce5690eaea1dc83a66051a55cc26b301164f6eaaa2ed4d4ccdab9311b810c8941377ba2ae4d7aee9fb80d11f50a78bab5becfec8c866e5d5cd31bae991d0b4fdf10a5cb67939630d816a27e0a5f7832e1d55036bf9b50b98cfd88bfe77c77141a2290de24f08a90d0c490d3b06987be5dd8ab20a1348c3ecb77c8d4bc13d0fd8022c01630dfe8ba8b9b15c5afa54f", 0xf81, 0x4008000, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c)
sendmsg(r0, &(0x7f0000610fc8)={0x0, 0x0, &(0x7f00009f8000)=[{&(0x7f0000554000)="ed871662855a221fd992a577fbdaffdf106d2b390852d708e3222e840a192a958c1dd9e13872fa78e997e80959b7f421f9f0f45b881460485b48774cea67844c41433b0c7e6f62c07f9f79b62bb99aaf316cba5c293deb6d5f8fe4a59ebe0c0dd25823ca180b8ff5dcb1ded36a36676b9d5553d46bac52af6e96770e0fb01c0b3484fbacacc0be7f50a39b335644568536f33a7455b3adb64949d38dc94572a4b38a943bfd48b418e0fca0e0bc17df96fb2f41de06c37f0f563c5ccd8c109a2616bc1f5c5641881caab9bd54882659bb76065ec79ef000ac8d72416744d4b2ffc97fd35e7de5d6b49d29f8c714dc901b707d558953ecf4354331767b86e119595429a7266a4f5c17438969315c96afc010c3c14374da55de64627b1ed4183b5ada1cab6d0e54bb0c9616b73039533d4de08d51e06225b88d26ae693c6136241118db7983163c4cfdd871c770773825e0e99cad55b1230016d60eef7b195b4ce1879b6730c151657a219b8db3e58038b052b9bfd2dfcd0ca1b983ac7942a01f795e466a4bf30230d5216231206d784eba63d52cb00cffbb2914538cd39d47e5a55a379bc8131afa798fc4b8d7361caf048eb4f9ad3c304eaf12a2f24731975ec98b0497301e95bc73e588ab440c1b256f5312a6318a167879274a71ef3e48071f23118bab6fd6d968ce8f992b00d775699dad48884a6cad2829aaa2044e08040d43375fe478a2144ff1231cfb84d4dc27baf6f0d86c5ca3947b20c751cb37673d2af12a34798150e895fcdb118c6a68c9c14feb27a7e46569a0ab52a24f13e8802d19bb80a9ea69b78e0f7abe6798c7ba43fac4a156b81411188ec503f321121268fffe33afd443daa87b86eb55183a5c4eb2d570839859499d501f98cd1015c5cd2c9bf744d946f639a28c053036c2186953a1f260544b8b1e99ae1b88f2c58ffd9ee2ab206fbf3ac88d09b78c38f716111594c505ff885a08746957954229825db17f11b8cb252b60f0765d7d9902fc1edfd903dd71442b095c97bbf528275af44fbe52f24895c81cc27ec73494ce3d125e86e05e1c8d23b1a11d6271737c29f331e945d1fe858d24c98b5f1b2e9e003c841666a8f7b16a8c4df1a80b1efaf2e4d953471af5794d4d39754f7725f2dd4489b9c924792dde5ad7641fe63f69314895ae680c7d9803939872667edf2f58fd83a20f6d9d1fade8058b009f81f21be4eb202ff1b2cf579a82bf2199a2e222d62942730d04b3a83c239a5b0391721479f920e3c53ea4f05f548058ec0b5ef6531e0cfd1cfd666da4a2deee3c5447dbf4e2d6b82ead5224fde6092553aed2ae2babf393cf20859649b8082312d9197eb2794555166a7aa9f596284fd7cef37c3c1c835edfc46ddfaf0c69b8fd9d126142892acc050d46668d3a7d043443e28a302000ca52ad71a91ca9961c0f19392975ae269afb59961ce76a79537e21780addecde257520ad97301611bcf77af72a04d3b435fb656b97f33792fdc4318e4e058a0bdd5d936fa198bf29b3987f4415efcf35289ffee2fb6ef30265f75ba806df911ef8d5b9a6c2ad369cc06e82ec72905d671bb181ec10d104010fd57ba9ac12d5c48d8c95464a7862d38b5800e00d14015ebcf45eec48a4183527c56c5a34646420c8c72aa8459bb1f6cf6cd48b8b0f0f9fb5e886b4f57d1e614686030e8bd5b8842d7143be6ab2c3e9fc4766c13aad2adea36812fa2d11cfa45e3b0336673187eac8ed70b317fa142ff560ed94c1a8d714c83726baa7813b129aefbfb57bb4e47b8a20519965ff3c5606f7f9d2e02812cc203912e83a3726602354062f4b3e09732c9983b39f9051c10e96a8a3d5bc5cfe97f09b4b0d88a7738f56fa771609ddd691a6409075f48af38726eb8b839ec3dcfd25f35b8c6417865d4866bd577475b094452d22939d8b5673d874859b38c8d6eff75a47ca8c3896b8ee0d8328f7a6c3101263ec785ec2ad0c2ecf6e8d86651cde8305e29484edb14bb14bde2497ceca8236213d471f09381b662f9ea3ca13cd2d46602e3bde0d1875ae9b2c890eb21e0c5308349dfb081f01c8791ef276f5e875df409b59ec72e5839f2a899764f09deba81bba3651ab2aa7f0ae61af61516aaf079260126c7a6d1b01bee3e7e0b5d530c59e945f4a60294eee379aa95e8b9daa387275964b0862aab4caa7fe8b1ca69b40bea831f3404973fd6d85e1c5835e8a96132da936b9a198dc8a25dff23fbbde5b5e7afa1af260712c695bb99f34aadc9feda61eb0728f27ca0976bca39e8d2fab979d7735fa339676819032059af8aaeddc4909fe16ded594517f628717ed4b0fa5f278e19df58d33e63888fcacdcbf767efae0b0f1c0723dbd1e731791427a71f2a67b53ada14acaf561cef4ccf66a80181dab3a226e30760e367d34e80ca2e7ec22db727bce86f79b0dbce776cdcf8e401805a2fc18f47c712531c73a83740a268b14bbc0fd3e837f379e98c2ac924a95645f4f86d3f0144be3c613821a32daafd7fcc46349d9ef8c4af3f77f6abdb77a94117daba6b051fdc27062e2b80eeef6dc27593504aa10750555286ac00eae3becb900979f84c033d5b669af4c4bfa4a2b27bd66ae0185704bcdb70608f3051605fb362d8c4f31e2e5109e1bbfca2e3852a65b067887219de99fce70bfc74193d2d59d951e879da6cdce3b78c6a92fa17bda5bbf24757e38263bbf86aedee65bb37b20542c4b87aafd4166d33d820007f3ef6aa479e75ec940bc37f48e686ecd7e0b93da0ae9b1874cd544a4603b97a2acba36919546a4fba96e460ad703fd2eb6ae130833bc947bc404", 0x7d0}], 0x1, &(0x7f0000864bb8)}, 0x0)

[   48.086879] binder: 5800:5815 got reply transaction with no transaction stack
[   48.086895] binder: 5800:5815 transaction failed 29201/-71, size 546-280 line 2927
[   48.120249] binder: 5800:5805 ioctl 40046207 0 returned -16
[   48.128197] binder: undelivered TRANSACTION_ERROR: 29201
[   48.146919] binder: undelivered TRANSACTION_ERROR: 29190
2018/03/26 17:10:11 executing program 1:
r0 = memfd_create(&(0x7f0000ac5000)='\x00', 0x0)
write(r0, &(0x7f0000000740)='0q', 0x2)
execveat(r0, &(0x7f0000ff7000)='./file0\x00', &(0x7f000038cff0), &(0x7f000034bff8)=[&(0x7f0000ff7000)="00000000000000060804002000fffc0c6565643b799365005f1b76"], 0x1000)

2018/03/26 17:10:11 executing program 7:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0x0, <r0=>0x0})
sendmmsg(r0, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000003140)}}, {{&(0x7f0000000000)=@nfc={0x27}, 0x80, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0)

[   48.163578] binder: undelivered TRANSACTION_COMPLETE
[   48.175365] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/26 17:10:11 executing program 5:
ioprio_set$pid(0x2, 0x0, 0x4000)
r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0)
write$cgroup_pid(r1, &(0x7f0000000100)=ANY=[], 0x1023c)
fallocate(r0, 0x0, 0x0, 0x339)
fallocate(r1, 0x3, 0x7fff, 0x1a8)

2018/03/26 17:10:11 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000100)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=@ipv6_getmulticast={0x14, 0x3a, 0x711, 0x0, 0x0, {0xa}}, 0x14}, 0x1}, 0x0)

2018/03/26 17:10:11 executing program 3:
r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ppoll(&(0x7f0000000100)=[{r0}], 0x1, &(0x7f0000000180)={0x0, 0x989680}, &(0x7f00000001c0), 0x8)
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

2018/03/26 17:10:11 executing program 2:
r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x82)
r1 = memfd_create(&(0x7f0000000100)="74086e7500000000003b56f7d21943", 0x1)
pwritev(r1, &(0x7f0000f50f90)=[{&(0x7f0000000040)="aa", 0x1}], 0x1, 0x81006)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1)
sendfile(r0, r0, &(0x7f0000000080), 0x102000004)
ioctl$LOOP_CLR_FD(r0, 0x4c01)

2018/03/26 17:10:11 executing program 0:
r0 = memfd_create(&(0x7f00000000c0)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x0)
fcntl$setstatus(r0, 0x4, 0x42400)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x5011, r0, 0x0)

2018/03/26 17:10:11 executing program 7:
r0 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'bridge0\x00', &(0x7f0000000500)=ANY=[@ANYBLOB="03"]})

2018/03/26 17:10:11 executing program 1:
r0 = memfd_create(&(0x7f0000ac5000)='\x00', 0x0)
write(r0, &(0x7f0000000740)='0q', 0x2)
execveat(r0, &(0x7f0000ff7000)='./file0\x00', &(0x7f000038cff0), &(0x7f000034bff8)=[&(0x7f0000ff7000)="00000000000000060804002000fffc0c6565643b799365005f1b76"], 0x1000)

2018/03/26 17:10:11 executing program 6:
perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$usbmon(&(0x7f0000fd0ff3)='/dev/usbmon#\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0x9205, &(0x7f0000dde000))

2018/03/26 17:10:11 executing program 4:
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, "ca296ca9459908585ef630b620e7847f885b8d3f16c148df180a8ef857dae739562ed2504dee8232e09fadc9d5f41c60614749cd3fe0baa0fc7ef20838c05b2e", "2f793a3ff0ccdd7a246d336f4ffeaed342096e9789b8cb6a7a2e6a7a0ea6bf6d5cb82bda101fd792e974035c44a6f408314c62caf4af004f84d70f8158f1119f", "b654955c3982492d2e9ebd6bdc7237836ca4758a7fce021db6c250e8446f81f5"})

2018/03/26 17:10:11 executing program 7:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x280001, 0x0)
ppoll(&(0x7f0000000240)=[{r0}, {r1}], 0x2, &(0x7f0000000280), &(0x7f00000002c0), 0x8)

2018/03/26 17:10:11 executing program 6:

2018/03/26 17:10:11 executing program 5:
r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0)
ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00004fb000)={0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, "acf42f48ef6ff65ec6f1b21626c8240b1655eaf512a8d15a16e87caa0f5aec8b04eb3ef9e365c6350f55010e6f736e26332f1443385abcca5c894515b8307a8a", "3ff8000000001a0000015a86d4a42e53e2aa636053b1c18db1bca80a1ae0cb65adcbd3df5de03b96f78b55f6b9a12bbbb783950ee77f25fcde0df5506c142cd3", "e4391ec9e07e01113700010000000080001580d34e9ae8d3b20ac260004ca719"})

2018/03/26 17:10:11 executing program 1:
r0 = memfd_create(&(0x7f0000ac5000)='\x00', 0x0)
write(r0, &(0x7f0000000740)='0q', 0x2)
execveat(r0, &(0x7f0000ff7000)='./file0\x00', &(0x7f000038cff0), &(0x7f000034bff8)=[&(0x7f0000ff7000)="00000000000000060804002000fffc0c6565643b799365005f1b76"], 0x1000)

2018/03/26 17:10:11 executing program 0:
creat(&(0x7f000009aff8)='./file0\x00', 0x0)
acct(&(0x7f0000000180)='./file0\x00')

2018/03/26 17:10:11 executing program 4:
r0 = mq_open(&(0x7f000004b000)='/$cgrouplo\x00', 0x0, 0x0, &(0x7f000004b000)={0xffffffffffffffff, 0x1})
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000289000))

2018/03/26 17:10:11 executing program 2:
r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x82)
r1 = memfd_create(&(0x7f0000000100)="74086e7500000000003b56f7d21943", 0x1)
pwritev(r1, &(0x7f0000f50f90)=[{&(0x7f0000000040)="aa", 0x1}], 0x1, 0x81006)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1)
sendfile(r0, r0, &(0x7f0000000080), 0x102000004)
ioctl$LOOP_CLR_FD(r0, 0x4c01)

2018/03/26 17:10:11 executing program 6:
r0 = socket$inet_dccp(0x2, 0x6, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040))

2018/03/26 17:10:11 executing program 3:
perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x5, 0xffffffffffffffff, 0x0)

2018/03/26 17:10:11 executing program 7:

2018/03/26 17:10:11 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setpgid(0x0, 0x0)

2018/03/26 17:10:11 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000005c0)={0xd, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="04630440000000000563044001"], 0x0, 0x0, &(0x7f00000004c0)})

2018/03/26 17:10:11 executing program 3:
r0 = socket$inet6(0xa, 0x5, 0x0)
sendmsg(r0, &(0x7f0000000000)={&(0x7f0000013fe4)=@in6={0x2, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x80, &(0x7f0000013000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1f000000000000008400000002000000"], 0x10}, 0x0)

2018/03/26 17:10:11 executing program 4:

2018/03/26 17:10:11 executing program 5:

2018/03/26 17:10:11 executing program 2:

2018/03/26 17:10:11 executing program 6:

2018/03/26 17:10:11 executing program 4:

2018/03/26 17:10:11 executing program 5:

2018/03/26 17:10:11 executing program 7:

[   48.549108] binder: 5911:5917 Acquire 1 refcount change on invalid ref 1 ret -22
[   48.573446] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/26 17:10:12 executing program 6:

2018/03/26 17:10:12 executing program 2:

2018/03/26 17:10:12 executing program 0:

2018/03/26 17:10:12 executing program 5:

2018/03/26 17:10:12 executing program 7:

2018/03/26 17:10:12 executing program 3:

2018/03/26 17:10:12 executing program 4:

2018/03/26 17:10:12 executing program 1:

2018/03/26 17:10:12 executing program 2:

2018/03/26 17:10:12 executing program 0:

[   48.607745] binder: 5911:5924 Acquire 1 refcount change on invalid ref 1 ret -22
[   48.615342] binder: 5911:5917 ioctl 40046207 0 returned -16
2018/03/26 17:10:12 executing program 6:

2018/03/26 17:10:12 executing program 7:

2018/03/26 17:10:12 executing program 0:

2018/03/26 17:10:12 executing program 4:

2018/03/26 17:10:12 executing program 6:

2018/03/26 17:10:12 executing program 2:

2018/03/26 17:10:12 executing program 5:

2018/03/26 17:10:12 executing program 1:

2018/03/26 17:10:12 executing program 7:

2018/03/26 17:10:12 executing program 3:

2018/03/26 17:10:12 executing program 6:

2018/03/26 17:10:12 executing program 1:

2018/03/26 17:10:12 executing program 4:

2018/03/26 17:10:12 executing program 6:

2018/03/26 17:10:12 executing program 2:

2018/03/26 17:10:12 executing program 7:

2018/03/26 17:10:12 executing program 5:

2018/03/26 17:10:12 executing program 3:

2018/03/26 17:10:12 executing program 0:

2018/03/26 17:10:12 executing program 4:

2018/03/26 17:10:12 executing program 7:

2018/03/26 17:10:12 executing program 1:

2018/03/26 17:10:12 executing program 5:

2018/03/26 17:10:12 executing program 6:

2018/03/26 17:10:12 executing program 2:

2018/03/26 17:10:12 executing program 3:

2018/03/26 17:10:12 executing program 7:

2018/03/26 17:10:12 executing program 4:

2018/03/26 17:10:12 executing program 6:

2018/03/26 17:10:12 executing program 0:

2018/03/26 17:10:12 executing program 3:

2018/03/26 17:10:12 executing program 1:

2018/03/26 17:10:12 executing program 5:

2018/03/26 17:10:12 executing program 2:

2018/03/26 17:10:12 executing program 4:

2018/03/26 17:10:12 executing program 6:

2018/03/26 17:10:12 executing program 7:

2018/03/26 17:10:12 executing program 5:

2018/03/26 17:10:12 executing program 1:

2018/03/26 17:10:12 executing program 0:

2018/03/26 17:10:12 executing program 4:

2018/03/26 17:10:12 executing program 1:

2018/03/26 17:10:12 executing program 5:

2018/03/26 17:10:12 executing program 3:

2018/03/26 17:10:12 executing program 7:

2018/03/26 17:10:12 executing program 6:

2018/03/26 17:10:12 executing program 0:

2018/03/26 17:10:12 executing program 2:

2018/03/26 17:10:12 executing program 4:

2018/03/26 17:10:12 executing program 2:

2018/03/26 17:10:12 executing program 7:

2018/03/26 17:10:12 executing program 5:

2018/03/26 17:10:12 executing program 3:

2018/03/26 17:10:12 executing program 2:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x30, &(0x7f0000000000)={0x1fffffe, "73797a6b616c6c657230feffff0100"}, 0x292)

2018/03/26 17:10:12 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c)

2018/03/26 17:10:12 executing program 6:
r0 = epoll_create1(0x0)
r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000cf7ff4))
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000260000)})

2018/03/26 17:10:12 executing program 1:
syz_open_procfs(0x0, &(0x7f0000030ff8)='pagemap\x00')

2018/03/26 17:10:12 executing program 4:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TIOCSETD(r0, 0x541f, &(0x7f0000000000))

2018/03/26 17:10:12 executing program 5:
r0 = socket(0x1f, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000000), 0x4)

2018/03/26 17:10:12 executing program 3:
r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x2)
write$selinux_load(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="8cff7cf9300300005345204c696e7578489f42aed2fe0900000078378a03ecfa213443a38fa51a896767f60200000000000000dd"], 0x34)

[   49.126163] binder_alloc: 6000: binder_alloc_buf, no vma
[   49.142036] binder: 6000:6003 transaction failed 29189/-3, size 0-0 line 3134
2018/03/26 17:10:12 executing program 7:
r0 = syz_open_dev$evdev(&(0x7f00003b9fee)='/dev/input/event#\x00', 0xa2bd, 0x0)
ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000000)=""/168)

2018/03/26 17:10:12 executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000384ff7)='/dev/ppp\x00', 0x101002, 0x0)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000000)=""/246)
ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000e9f000)=0x600210)
pread64(r0, &(0x7f0000974f42)=""/190, 0xbe, 0x0)
pwritev(r0, &(0x7f0000161000)=[{&(0x7f0000d33000)="f5", 0x1}], 0x1, 0x0)

2018/03/26 17:10:12 executing program 4:
r0 = syz_open_dev$sg(&(0x7f0000265ff7)='/dev/sg#\x00', 0x0, 0x2)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$fuse(r0, &(0x7f000012f000)={0x50, 0x0, 0x0, @fuse_init_out={0x7, 0x1a}}, 0x50)
read(r0, &(0x7f00005c5fc7)=""/154, 0x23)

2018/03/26 17:10:12 executing program 2:
mkdir(&(0x7f0000014000)='./file0\x00', 0x0)
mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000c40000)='./file0\x00', &(0x7f0000014000)='ramfs\x00', 0x0, &(0x7f000000a000))
chroot(&(0x7f0000000140)='./file0\x00')
umount2(&(0x7f0000000180)='./file0\x00', 0x3)
mount(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='/', &(0x7f00000000c0)='9p\x00', 0x161001, 0x0)

2018/03/26 17:10:12 executing program 0:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
ioctl$sock_SIOCGIFCONF(r0, 0x8981, &(0x7f0000000140)=@req={0x28, &(0x7f0000000100)={'lo\x00', @ifru_names='bridge0\x00'}})

2018/03/26 17:10:12 executing program 3:
r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x2)
write$selinux_load(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="8cff7cf9300300005345204c696e7578489f42aed2fe0900000078378a03ecfa213443a38fa51a896767f60200000000000000dd"], 0x34)

2018/03/26 17:10:12 executing program 6:
mknod$loop(&(0x7f0000000040)='./file0\x00', 0x0, 0xffffffffffffffff)
setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)=@known='trusted.syz\x00', &(0x7f0000000100)='/vmnet0\x00', 0x11f, 0x0)
removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)=@known='trusted.syz\x00')

2018/03/26 17:10:12 executing program 5:
r0 = socket$inet(0x2, 0x6, 0x0)
getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x10d, 0x10, &(0x7f0000000000), &(0x7f0000000040)=0xc)

[   49.181256] binder: BINDER_SET_CONTEXT_MGR already set
[   49.197467] binder_alloc: 6000: binder_alloc_buf, no vma
[   49.201468] binder: 6000:6022 ioctl 40046207 0 returned -16
[   49.210724] binder: 6000:6019 transaction failed 29189/-3, size 0-0 line 3134
2018/03/26 17:10:12 executing program 3:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc))
r1 = syz_open_pts(r0, 0x0)
ioctl$TCSETAW(r1, 0x5407, &(0x7f00000000c0))

2018/03/26 17:10:12 executing program 4:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x38, &(0x7f0000000080)={0x0, 'ip6gretap0\x00'}, 0x3)

2018/03/26 17:10:12 executing program 2:
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40, 0x0)

2018/03/26 17:10:12 executing program 1:
r0 = socket$nl_generic(0x2, 0x3, 0x10)
bind$netlink(r0, &(0x7f00000001c0)={0x10}, 0xc)

2018/03/26 17:10:12 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

[   49.269348] binder: undelivered TRANSACTION_ERROR: 29189
[   49.309182] binder: undelivered TRANSACTION_ERROR: 29189
[   49.327426] audit: type=1400 audit(1522084212.701:14): avc:  denied  { transfer } for  pid=6051 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1
[   49.361075] binder: 6051:6053 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/26 17:10:12 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mknod(&(0x7f000086c000)='./file0\x00', 0x103d, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x2, 0x0)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

2018/03/26 17:10:12 executing program 1:
r0 = socket$nl_generic(0x2, 0x3, 0x10)
connect$netlink(r0, &(0x7f0000000000)=@kern={0x10}, 0x78)

2018/03/26 17:10:12 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40, 0x0)
lseek(r0, 0x0, 0x3)

2018/03/26 17:10:12 executing program 7:
r0 = getpgid(0x0)
sched_setaffinity(r0, 0x8, &(0x7f00009ad000))
pipe2(&(0x7f0000f61000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000bc8000)={0xaa})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x1c)
write$sndseq(r2, &(0x7f00000002c0)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"62dd50589e5fc28c058f5cab"}}], 0x30)
dup2(r1, r3)

2018/03/26 17:10:12 executing program 3:
request_key(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a}, &(0x7f0000000100)='ppp0!ppp1\x00', 0xfffffffffffffffb)

2018/03/26 17:10:12 executing program 4:
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c)
listen(r0, 0x1)
r1 = socket$inet6(0xa, 0x80006, 0x0)
connect$inet6(r1, &(0x7f0000000280)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c)
r2 = accept4$inet6(r0, &(0x7f0000000000), &(0x7f0000000040)=0x1c, 0x0)
sendmsg(r1, &(0x7f0000000240)={&(0x7f0000000100)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "8f1f8096e1c8ea93862ad72958ed181db48998bc608b77de39a203a339b0eb4e853604d465aa0b1fa59195e8d3b2e7183e41c2d7d47ca6d2357c7f0286ec24"}, 0x60, &(0x7f0000000200), 0x0, &(0x7f0000000780)}, 0x0)
sendmsg(r2, &(0x7f0000001340)={&(0x7f00000000c0)=ANY=[], 0x0, &(0x7f0000000140), 0x0, &(0x7f00000013c0)=ANY=[]}, 0x0)
sendmsg(r2, &(0x7f0000000680)={&(0x7f0000000180)=@nfc={0x27}, 0x80, &(0x7f0000000500), 0x0, &(0x7f0000001480)}, 0xc040)

2018/03/26 17:10:12 executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r0, &(0x7f0000aba000)={&(0x7f0000791000)={0x10}, 0xc, &(0x7f0000e2a000)={&(0x7f0000000040)={0x14, 0x4, 0xa, 0x1}, 0x14}, 0x1}, 0x0)

2018/03/26 17:10:12 executing program 0:

2018/03/26 17:10:12 executing program 0:
r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0)
ppoll(&(0x7f0000000000)=[{r0}], 0x1, &(0x7f0000000040)={0x77359400}, &(0x7f0000000080), 0x8)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, "706f72ff0700000000000000000000000000000000000000000000001f0000ffffffffffffffef000003ff00000000000012000000000000000000000600", 0xc3, 0x80003})
openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0)

2018/03/26 17:10:12 executing program 1:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
r1 = dup(r0)
getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000140)=ANY=[], &(0x7f0000000200))
ioctl$sock_netrom_TIOCINQ(r1, 0x541b, &(0x7f0000000000))

[   49.370877] binder: 6051:6053 transaction failed 29201/-22, size 40-16 line 3197
[   49.379741] binder: BINDER_SET_CONTEXT_MGR already set
[   49.385064] binder: 6051:6063 ioctl 40046207 0 returned -16
[   49.401932] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/26 17:10:12 executing program 2:
r0 = socket$inet(0x2, 0x4000000805, 0x0)
r1 = socket$inet_sctp(0x2, 0x3, 0x84)
r2 = dup3(r0, r1, 0x0)
setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000f8d000), 0x8)

2018/03/26 17:10:12 executing program 3:
syz_emit_ethernet(0x15, &(0x7f00000003c0)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [{[], {0x8100}}], {@llc={0x4, {@llc={0x0, 0x0, "ef"}}}}}, &(0x7f0000000000)={0x0, 0x3, [0x6, 0xc5]})

2018/03/26 17:10:12 executing program 5:
syz_emit_ethernet(0x2a, &(0x7f00006a4000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @random="6a47283c8678", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @multicast1=0xe0000001}, @igmp={0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}}}}}, &(0x7f0000aed000))

2018/03/26 17:10:12 executing program 6:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000100)={0x2, 0x5, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, [@sadb_sa={0x2, 0x1}]}, 0x20}, 0x1}, 0x0)

2018/03/26 17:10:12 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x3, 0x1)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000003000)={{{@in=@multicast2=0xe0000002, @in=@multicast1=0xe0000001}}, {{@in6}, 0x0, @in6=@loopback={0x0, 0x1}}}, 0xe8)

2018/03/26 17:10:12 executing program 7:
syz_emit_ethernet(0xc4, &(0x7f0000000100)={@random="781593786d38", @empty, [], {@ipx={0x8137, {0xffff, 0xb6, 0x0, 0x0, {@broadcast=0xffffffff, @current}, {@random, @current}, "b1ad160f57cbfabc8a83248750c70892309b551aa14c21d0aa4b6d0ea4da54f980eef42eb35080d1c2eb7846bd8217b9df7aaa6727b7d140a6ed38527314fac76bfd84803c440888f4786e246bf7ccc1eeb84c9f5e1f7b19508b83a438dacf49bcf08fe7976ca899f4e7aa9d58f88c963805f8fe71601a45a4a2c15ee44edbf9beeb1ccb2376783ae724d7a34362b67cffb4633749cbe6c7"}}}}, &(0x7f00000000c0))
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000384ff7)='/dev/ppp\x00', 0x0, 0x0)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000001c0)=""/246)

2018/03/26 17:10:12 executing program 5:
r0 = socket$inet(0x2, 0x6, 0x0)
getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x10d, 0x5, &(0x7f0000000000), &(0x7f0000000040)=0xc)

2018/03/26 17:10:12 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfd5000)=nil, 0xfd5000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
syz_fuse_mount(&(0x7f0000f65000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

2018/03/26 17:10:12 executing program 6:
syz_emit_ethernet(0x19b, &(0x7f0000000340)={@link_local={0x1, 0x80, 0xc2}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "32d2d9", 0x165, 0x2c, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @icmpv6=@param_prob={0x4, 0x0, 0x0, 0x0, {0x5, 0x6, "e6b416", 0x7fffffff, 0x11, 0x3b, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0xd}}, @remote={0xfe, 0x80, [], 0xbb}, [@hopopts={0x76, 0x3, [], [@jumbo={0xc2, 0x4, 0x630d}, @jumbo={0xc2, 0x4, 0x5}, @jumbo={0xc2, 0x4, 0xac}, @jumbo={0xc2, 0x4, 0x80000001}]}, @hopopts={0x0, 0xf, [], [@calipso={0x7, 0x18, {0x5, 0x4, 0x3f, 0x5, [0x5, 0x8]}}, @generic={0x100, 0x60, "f40347618b5f35cb6b9d5fab54ec30de9611b57870bde3cc3583e3db6a394fe23cdb3bd73181b74f3a8e3f6bf25f42f1d845bc6edb78f0eae8013cf467e045b5f0a9196da7fcf7b13b664c87091d99f05f94c6bb9656d1678cb1b914a0f4d39f"}]}], "ecb0a84fb3cd1e37f7a99baf6b7db5e71585e24a89869609643c18b8a3e3fb9101a259345216b2f45fcd4d726011c0c4a7bbf9d4a8afa9b8e26e29be588aeebdb5e2fdc2cd2a15ffc22a15f29b6f7b5d082e017aa477c6ba0b4d8997f915a65edd3f2effad3b614b3d38e69f43180a2a32fc8481d561067804b618d9556116311a33b71ab2bf5844fcaf2669a3"}}}}}}}, &(0x7f0000001580)={0x1, 0x3, [0x140, 0x4a8, 0x9ba, 0xe39]})

2018/03/26 17:10:12 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00001f0ff8)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
connect$unix(r0, &(0x7f0000000040)=@abs={0x1}, 0x6e)

2018/03/26 17:10:13 executing program 1:
socket(0x1a, 0x0, 0x0)

2018/03/26 17:10:13 executing program 0:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000001fcd)='wlan0*mime_type-trusted}&wlan0vmnet1.trusted{\\{GPL\x00', 0x0)
write(r0, &(0x7f0000001f23)="db42366e8ba45f9f", 0x8)
mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x4, 0x4011, r0, 0x0)
symlink(&(0x7f0000004000)='./file0\x00', &(0x7f0000002ff6)='./control\x00')
rename(&(0x7f0000005ff6)='./control\x00', &(0x7f0000004000)='./control\x00')

2018/03/26 17:10:13 executing program 7:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f0000085000)='./control\x00', 0x28042, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000273ff6)='./control\x00', 0x80000c12)
readv(r1, &(0x7f0000b25000)=[{&(0x7f0000fb2000)=""/128, 0x80}], 0x1)
writev(r0, &(0x7f0000ecc000)=[{&(0x7f00000d9000)="f9", 0x1}], 0x1)

2018/03/26 17:10:13 executing program 4:
symlink(&(0x7f0000000380)='./file0/file0\x00', &(0x7f00000002c0)='./file0\x00')
syz_fuse_mount(&(0x7f0000000000)='./file0\x00', 0x6000, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)

2018/03/26 17:10:13 executing program 3:
r0 = syz_open_procfs(0x0, &(0x7f00004c6f8b)='mounts\x00')
mkdir(&(0x7f0000000100)='./file0\x00', 0x0)
mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000001c0))
preadv(r0, &(0x7f00000023c0)=[{&(0x7f00000012c0)=""/4096, 0x1000}], 0x1, 0x0)

2018/03/26 17:10:13 executing program 2:
add_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000080), 0x0, 0xfffffffffffffff9)
timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000140))

2018/03/26 17:10:13 executing program 5:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c)
sendmmsg(r0, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f00000003c0)}}, {{&(0x7f00000004c0)=@in6={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000000680), 0x3ba, &(0x7f0000002000)=[{0x10, 0x29}], 0x10}}], 0x2, 0x8000)

2018/03/26 17:10:13 executing program 6:
r0 = socket$inet(0xa, 0x802, 0x0)
connect$netlink(r0, &(0x7f0000000200)=@kern={0x10}, 0xc)

2018/03/26 17:10:13 executing program 6:
capset(&(0x7f0000a31000)={0x19980330}, &(0x7f00009b3000))

2018/03/26 17:10:13 executing program 3:
r0 = socket$inet(0x2, 0x80003, 0x4)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x4, &(0x7f0000000000)={{0x1, @empty, 0x0, 0x0, 'rr\x00'}, {@dev={0xac, 0x14, 0x14}}}, 0x28)

2018/03/26 17:10:13 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000000380)={0x10}, 0x0)

2018/03/26 17:10:13 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r0, &(0x7f0000002fe4)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x7}, 0x1c)
sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004fe0)=[{&(0x7f0000000040)="cf1616ca7459", 0x6}], 0x1, &(0x7f0000006000)}, 0x0)

2018/03/26 17:10:13 executing program 2:
r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0)
r1 = memfd_create(&(0x7f0000000000)="74086e750000000000000000008c00", 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f00000002c0)="32b8a09164196e65c02bdbd1c3a4ae88ab8e3a6cc0f3a27e71a0bfba0334abce7accb13a038eb4abfda15d35b2d9321fb9199ea59be46c62bce0fbabc95bb796060fa8455f814f066ccf7c6d8210aa8892352cd4f03197050499a7aa64b1bc9e8deb349e5304f709024bb14ce78f73b780461033e4373a7520fea31a3ae8e1320e53c067b493858f7ec5b299c0ce81163c376361a47962582dedfd85502d036102e2ed9c3fb30023ce163c7e8e95917f648e591c92e2a83d86546d7253766f5a0b950016be4ecf3b2d1707c466a0cee1f7ff9e04cd91cc64eca7cd7e0507be3b604f7009b11c75165ec845e1ba643934b2f9385f5fb372c7b085cdbcb4906267abd71bc1b1d9f92dbefca7781ed830a5f573f491feb25f823287e8a0453dbc760b44020cfa298a9406a9216aa5b04b915030e90d8fdd4680aa54e185fad06745740cd2105d11f2de9a33d7d32ab6a7c5508bffc7eeb51479eca09c42a2ff9c6a829f02c705fbd54b412c289a174d6a9fe87a10bdc5df88a324d7751d30893a8e996b90191430448681ef8225bc4a2a974d2fa7d2763e2c37ef471aaa99c0cb441433b3ff78472ea2d037983aa2af2bc3da01aea9551bf9e77cfceadcab82fbd891bbf7e9e9c013f8b7ceaab9ed642c13c031aea9348de9cdc22064e93eb1056f08941614e7445c4b4b3fa9", 0x1eb}], 0x1, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1)
ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, "6df1733d7a8a242fd899e0633f5fcea8fb5a550ed80ebba4d909c7a124d8ac39add13dc93a80f22ff9fd35a844f3e8b5ade4e5935137af6fe251190634435dca", "6aaba7a936009867bd21673a08478220febadc5ca0c0caf1f4833b9ff18a89a285f049691fdaee090426b5018b54096bdaacf1e7a2fb27febc2e8d7b46599493", "ecd2881042e088581e6e599a5591e6c882e32e7ea6697b93d32112b2bc83d72a"})

2018/03/26 17:10:13 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x0, 0x0)
fcntl$setlease(r0, 0x400, 0x0)

2018/03/26 17:10:13 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x10, 0x803, 0x0)
close(r0)

2018/03/26 17:10:13 executing program 1:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x33, &(0x7f0000000000)={0x0, 'ip6_vti0\x00'}, 0x3)

2018/03/26 17:10:13 executing program 6:
request_key(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a}, &(0x7f0000000100)='ppp0!ppp1\x00', 0xfffffffffffffffb)
mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00006ee000)='/dev/rfkill\x00', 0x0, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e53fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000007fe0)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1})
readv(r0, &(0x7f00000a8ff0)=[{&(0x7f0000001fb2)=""/1, 0x1}], 0x1)
ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000007ffc)={&(0x7f0000000000/0x2000)=nil, 0x2000})

2018/03/26 17:10:13 executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000051cff6)='/dev/ptmx\x00', 0x0, 0x0)
r1 = gettid()
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000029000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
readv(r0, &(0x7f0000dcdff0)=[{&(0x7f0000cd8000)=""/1, 0x1}], 0x1)
ioctl$int_in(r2, 0x5452, &(0x7f0000b28000)=0x3c)
fcntl$setsig(r2, 0xa, 0x12)
poll(&(0x7f0000b2c000)=[{r3}], 0x1, 0xfffffffffffffff8)
r4 = dup2(r2, r3)
fcntl$setown(r4, 0x8, r1)
tkill(r1, 0x16)

2018/03/26 17:10:13 executing program 3:
r0 = socket$inet(0x2, 0x3, 0x1)
getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000040)=""/187, &(0x7f0000000100)=0xbb)

2018/03/26 17:10:13 executing program 7:
syz_open_procfs(0x0, &(0x7f00000002c0)='net/netlink\x00')

2018/03/26 17:10:13 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000003b000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETA(r0, 0x5402, &(0x7f0000feafec)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff})

2018/03/26 17:10:13 executing program 3:
mkdir(&(0x7f0000001000)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x2, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000a7dfff)}, 0xa00000400, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f000000a000))

2018/03/26 17:10:13 executing program 5:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x10d, 0xb, &(0x7f0000000080)={0x4000000, 'ip6gretap0\x00'}, 0x18)

2018/03/26 17:10:13 executing program 4:
syz_open_procfs(0x0, &(0x7f0000000180)='net/arp\x00')

2018/03/26 17:10:13 executing program 1:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendmsg$inet_sctp(r0, &(0x7f0000000340)={&(0x7f0000000080)=@in={0x2, 0x0, @rand_addr}, 0x10, &(0x7f0000000100), 0x0, &(0x7f0000000240)=[@init={0x18, 0x84}], 0x30}, 0x0)

2018/03/26 17:10:13 executing program 7:
r0 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, &(0x7f0000000000)={0x0, 0x6, 0x4})
mq_unlink(&(0x7f0000fc4ffb)='eth0\x00')
mq_timedsend(r0, &(0x7f00000e6000), 0x0, 0x0, &(0x7f0000e0b000))
mq_timedsend(r0, &(0x7f0000307ffd), 0x0, 0x0, &(0x7f0000fbc000))
close(r0)

2018/03/26 17:10:13 executing program 2:
r0 = socket$inet(0x2, 0x803, 0x5)
setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x2a, 0x0, 0x485)

2018/03/26 17:10:13 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x200002, 0x0)
fstat(r0, &(0x7f0000000080))

2018/03/26 17:10:13 executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000100)={&(0x7f0000f4dff4)={0x10}, 0x4d9, &(0x7f0000000040)={&(0x7f0000000080)=@migrate={0x15c, 0x21, 0x1, 0x0, 0x0, {{@in6=@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, @in6=@dev={0xfe, 0x80}}}, [@migrate={0x10c, 0x11}]}, 0x15c}, 0x1}, 0x0)

2018/03/26 17:10:13 executing program 3:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa, 0x80})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)

2018/03/26 17:10:13 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = epoll_create(0x4000000010011)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000336ff4))
dup3(r0, r2, 0x0)

2018/03/26 17:10:13 executing program 2:
syz_emit_ethernet(0x46, &(0x7f0000000700)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "c22df7", 0x10, 0x6c, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local={0xfe, 0x80, [], 0xaa}, {[], @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}}}}}}}, &(0x7f0000001780))

2018/03/26 17:10:13 executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000fe9ff6)='/dev/ptmx\x00', 0x0, 0x0)
r1 = epoll_create(0x10007fff)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040))
r2 = syz_open_pts(r0, 0x0)
syz_open_pts(r0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000))
dup3(r1, r0, 0x0)

2018/03/26 17:10:13 executing program 1:
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x2)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={"6966623000faffffffffffffff00", 0x4000000000000302})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201})
write$tun(r1, &(0x7f0000000200)=ANY=[], 0x0)

2018/03/26 17:10:13 executing program 6:
keyctl$join(0x17, &(0x7f0000000400)={0x73, 0x79, 0x7a})

2018/03/26 17:10:13 executing program 4:
mkdir(&(0x7f00000001c0)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr}], 0x30)
rename(&(0x7f0000000140)='./control/file0\x00', &(0x7f0000000180)='./file0\x00')
unlink(&(0x7f00000000c0)='./control\x00')
close(r0)

2018/03/26 17:10:13 executing program 7:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f00006a9ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)

2018/03/26 17:10:13 executing program 2:
r0 = socket$inet(0x2, 0x3, 0x7)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000740)=@filter={'filter\x00', 0xe, 0x4, 0x578, [0x0, 0x20000a00, 0x20000b68, 0x20000ed8], 0x0, &(0x7f0000000040), &(0x7f0000000a00)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x0, 0x0, 'bridge0\x00', 'bcsh0\x00', 'rose0\x00', 'dummy0\x00', @random="12d5bf80a62e", [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x70, 0xb8, 0xe8}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}]}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x2, [{{{0x3, 0x30, 0x0, 'lo\x00', 'erspan0\x00', 'vcan0\x00', 'bridge0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x108, 0x108, 0x140, [@physdev={'physdev\x00', 0x70, {{'bond0\x00', {}, 'ip_vti0\x00'}}}]}}, @common=@dnat={'dnat\x00', 0x10, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}}}}, {{{0x3, 0x0, 0x0, '\x00', 'rose0\x00', 'yam0\x00', 'sit0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @link_local={0x1, 0x80, 0xc2}, [], 0xa0, 0x1d0, 0x200, [@cgroup0={'cgroup\x00', 0x8}]}, [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:sendmail_exec_t:s0\x00'}}}]}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x19, 0x0, 0x0, 'tunl0\x00', 'ip6gre0\x00', 'ip6gre0\x00', 'bond0\x00', @random="7cc3eb406e48", [], @random="2741b33378a3", [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00', 0x1, 0x100000001, 0x5}}}}]}]}, 0x58c)

2018/03/26 17:10:13 executing program 6:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$sock_cred(r0, 0x1, 0x32, &(0x7f0000000480), 0xc)

2018/03/26 17:10:13 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040))

2018/03/26 17:10:13 executing program 3:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x13, &(0x7f0000000080)={0x0, 'ip6gretap0\x00'}, 0x3)

[   50.141735] binder: 6275:6280 got new transaction with bad transaction stack, transaction 17 has target 6275:0
[   50.166759] binder: 6275:6280 transaction failed 29201/-71, size 0-0 line 3038
[   50.168469] binder: 6275:6285 BC_INCREFS_DONE node 18 has no pending increfs request
[   50.186087] binder: BINDER_SET_CONTEXT_MGR already set
[   50.192742] binder: 6275:6287 ioctl 40046207 0 returned -16
[   50.199761] binder_alloc: 6275: binder_alloc_buf, no vma
[   50.205283] binder_alloc: 6275: binder_alloc_buf, no vma
[   50.205316] binder: 6275:6280 transaction failed 29189/-3, size 40-8 line 3134
[   50.220216] binder: 6275:6285 transaction failed 29189/-3, size 0-0 line 3134
[   50.228811] binder: 6275:6285 BC_INCREFS_DONE u00000000204edf8a no match
2018/03/26 17:10:13 executing program 2:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000b61000)={0x0, 0xb}, 0x10)

2018/03/26 17:10:13 executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendmmsg$inet_sctp(r0, &(0x7f000093eee8)=[{&(0x7f0000000080)=@in={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000200)="96", 0x1}], 0x1, &(0x7f0000000400)}, {&(0x7f0000000000)=@in={0x2, 0x0, @multicast2=0xe0000002}, 0x10, &(0x7f000093e000), 0x0, &(0x7f000093ef10)=[@sndinfo={0x20, 0x84, 0x2}], 0x30}], 0x2, 0x8200040c3)

2018/03/26 17:10:13 executing program 0:
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_tcp_int(r0, 0x6, 0x800000000000000b, &(0x7f0000013000), &(0x7f0000012000)=0x4)

2018/03/26 17:10:13 executing program 6:
r0 = socket(0x40000000015, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f00000001c0)=@ethtool_regs={0xf}})

2018/03/26 17:10:13 executing program 3:
add_key(&(0x7f0000000000)='pkcs7_test\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f00000000c0)="9f9f", 0x2, 0xffffffffffffffff)

2018/03/26 17:10:13 executing program 4:
socket$nl_generic(0x2, 0xa, 0x10)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00')

2018/03/26 17:10:13 executing program 1:
r0 = perf_event_open(&(0x7f000057e000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000a17fff)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000000)={0x1, 0x0, [0x0]})

2018/03/26 17:10:13 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040))

[   50.242741] binder: undelivered TRANSACTION_ERROR: 29189
[   50.249711] binder: release 6275:6280 transaction 17 out, still active
[   50.256696] binder: send failed reply for transaction 17, target dead
2018/03/26 17:10:13 executing program 3:
r0 = socket$inet(0x2, 0x3, 0x1d)
sendmmsg(r0, &(0x7f0000006780)=[{{&(0x7f0000000340)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x19}}, 0x80, &(0x7f00000000c0), 0x0, &(0x7f0000000040)}}, {{&(0x7f0000000100)=@in={0x2, 0x0, @rand_addr}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000000)="990db42d", 0x4}], 0x1}}], 0x2, 0x0)

2018/03/26 17:10:13 executing program 1:
unshare(0x20000400)

2018/03/26 17:10:13 executing program 0:
r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0xffffffffffffffa1, 0x8002)
write$evdev(r0, &(0x7f0000000000), 0x9d)
r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x2)
write$sndseq(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw8={"228e38521bdb4c526aeb66b8"}}], 0x30)

2018/03/26 17:10:13 executing program 6:
r0 = socket$inet(0x2, 0x1, 0x0)
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f000000bcc0)=0x1)
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f000000b9c0)='/dev/rfkill\x00', 0x4100, 0x0)
getpeername$packet(r0, &(0x7f000000ba00)={0x0, 0x0, <r2=>0x0, 0x0, 0x0, 0x0, @random}, &(0x7f000000ba40)=0x14)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f000000ba80)={{{@in6=@ipv4={[], [], @multicast2}, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f000000bb80)=0xe8)
setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f000000bbc0)={{{@in=@rand_addr=0x410, @in6=@remote={0xfe, 0x80, [], 0xbb}, 0x4e20, 0x0, 0x4e20, 0x0, 0x2, 0x80, 0x80, 0xff, r2, r3}, {0x4, 0x6, 0xfffffffffffff800, 0x800, 0x235, 0x8, 0x3}, {0x1, 0x10001, 0x7fff}}, {{@in6=@ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}}, 0x0, @in=@dev={0xac, 0x14, 0x14}}}, 0xe8)
bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e20, @rand_addr}, 0x10)
connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='vcan0\x00', 0x10)
sendmsg(r0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[], 0x0, &(0x7f0000000400)=[{&(0x7f0000002940)='u', 0x1}], 0x1, &(0x7f0000000500)}, 0x0)
sendmsg(r0, &(0x7f00000003c0)={&(0x7f0000000240)=@pppoe={0x18, 0x0, {0x0, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 'bpq0\x00'}}, 0x80, &(0x7f0000001480)=[{&(0x7f0000000480)='\x00', 0x1}], 0x1}, 0x80)
sendmmsg(r0, &(0x7f000000b880)=[{{&(0x7f00000019c0)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'authenc(vmac(camellia-asm),ctr-serpent-avx)\x00'}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000001a40)="ba852f88e1bca42accdd843e98643f9813ca391c236efba44b3f9c03842f0e5a3dbc051f6bb16d7e3532", 0x2a}], 0x1, &(0x7f0000001b80)=[{0xb0, 0x10f, 0x5, "48ea0fd8498bb6d69ebe89b5d7fe4906247313b46b78ee38b19589bfbab8c1e3763f776ca717021f05622263b30a1c13721fc74da8cb70d67e19c0288075acf2740ca78b82151c0853d8f1c4ea9846ac75a8c6064c8cdae55c035568f674de7e2949f0e7136a4f97d4c0988d6836744367a75394e79ad11edab3b61cb5b3d1cc0506360ae81babe3eff30765a232a13babf532fc8598b11d08eea887c870a4"}], 0xb0, 0x40010}, 0x8000}], 0x1, 0x0)

2018/03/26 17:10:13 executing program 5:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x2000000000001, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000f679f4)=0x8, 0x449)
getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000501000)=""/95, &(0x7f0000f12000)=0x5f)

2018/03/26 17:10:13 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r0, 0x29, 0x1b, &(0x7f0000000000)="61b5e5ad353106456f9a75498d2c76a821e445c4", 0x14)

[   50.310864] binder: 6290:6298 got new transaction with bad transaction stack, transaction 24 has target 6290:0
[   50.335800] binder: 6290:6312 BC_INCREFS_DONE node 25 has no pending increfs request
[   50.346222] binder: 6290:6298 transaction failed 29201/-71, size 0-0 line 3038
2018/03/26 17:10:13 executing program 1:
unshare(0x20000400)

2018/03/26 17:10:13 executing program 2:
sched_getattr(0x0, &(0x7f0000000040), 0x30, 0x0)

2018/03/26 17:10:13 executing program 0:
r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0xffffffffffffffa1, 0x8002)
write$evdev(r0, &(0x7f0000000000), 0x9d)
r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x2)
write$sndseq(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw8={"228e38521bdb4c526aeb66b8"}}], 0x30)

2018/03/26 17:10:13 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040))

2018/03/26 17:10:13 executing program 3:
mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x4, 0x44031, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)

2018/03/26 17:10:13 executing program 4:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000384ff7)='/dev/ppp\x00', 0x0, 0x0)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000001c0)=""/246)
ioctl$PPPIOCSFLAGS(r0, 0x40107447, &(0x7f0000e9f000))

[   50.422770] binder: release 6290:6298 transaction 24 out, still active
[   50.447692] binder: send failed reply for transaction 24, target dead
[   50.490832] binder: 6338:6341 got new transaction with bad transaction stack, transaction 29 has target 6338:0
[   50.508908] binder: 6338:6341 transaction failed 29201/-71, size 0-0 line 3038
2018/03/26 17:10:13 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x6, 0x0)
connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14}}, 0x10)

2018/03/26 17:10:13 executing program 6:
r0 = socket$inet(0x2, 0x3, 0x7)
setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00006cdffb)="8907040000", 0x5)
sendmmsg(r0, &(0x7f0000005c00)=[{{&(0x7f00000000c0)=@in={0x2, 0x0, @multicast1=0xe0000001}, 0x80, &(0x7f00000002c0), 0x0, &(0x7f0000000300)}}, {{&(0x7f00000035c0)=@in={0x2}, 0x80, &(0x7f0000005700), 0x0, &(0x7f0000005740), 0x71}}], 0x2, 0x0)

2018/03/26 17:10:13 executing program 1:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0)
finit_module(r0, &(0x7f0000000500)='eth0!:[cpusetbdev\x00', 0x0)

2018/03/26 17:10:13 executing program 0:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/ashmem\x00', 0x0, 0x0)
ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x0)

2018/03/26 17:10:13 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000140)='environ\x00')
preadv(r0, &(0x7f0000b24fb0)=[{&(0x7f0000830000)=""/4096, 0x1000}], 0x1, 0x0)

2018/03/26 17:10:13 executing program 2:
r0 = socket$inet6(0xa, 0x1, 0x8010000000000084)
setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000040)={0x0, 0x0, 0x81}, 0x8)

2018/03/26 17:10:13 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040))

2018/03/26 17:10:13 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000001700)='/dev/loop#\x00', 0xfffffffffffffffd, 0x0)

[   50.537914] binder: release 6338:6341 transaction 29 out, still active
[   50.548557] binder: send failed reply for transaction 29, target dead
2018/03/26 17:10:14 executing program 6:
r0 = socket$inet(0x2, 0x3, 0x5)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000002c0)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000100, 0x0, 0x0, 0x20000130, 0x20000160], 0x0, &(0x7f0000000000), &(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffff000000000000aaaaaaaa0000000000000000000070000000cb000000f80000004c45440000000000000000000000000000000000000000000000000000000000280000000000000073797a31000000000000000000000000000000000000000000000000000000000000000000000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaa00000000fcffffff00000000"]}, 0x208)

2018/03/26 17:10:14 executing program 3:
r0 = fanotify_init(0x0, 0x0)
ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f00000005c0)=""/4096)

2018/03/26 17:10:14 executing program 1:
r0 = socket$inet6(0xa, 0x2000000000001, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x2, &(0x7f0000f679f4)=0x8000010, 0x516)
getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000501000)=""/95, &(0x7f0000f12000)=0x5f)

2018/03/26 17:10:14 executing program 0:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000100)=""/246)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0)
ioctl$EVIOCGPROP(r1, 0x4004743d, &(0x7f0000000600)=""/246)

2018/03/26 17:10:14 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndseq(&(0x7f00001aaff3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'})
r1 = memfd_create(&(0x7f0000857fff)='\t', 0x0)
r2 = syz_open_dev$sndseq(&(0x7f000011c000)='/dev/snd/seq\x00', 0x0, 0x8000000000102)
dup2(r2, r1)
write$sndseq(r1, &(0x7f0000d81fd0)=[{0x22, 0x0, 0x0, 0x3fd}], 0x30)

2018/03/26 17:10:14 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0)
ioctl(r0, 0x4000000002283, &(0x7f0000139000))

2018/03/26 17:10:14 executing program 2:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000b2000), 0x4)
bind$inet(r0, &(0x7f0000490000)={0x2, 0x2, @loopback=0x7f000001}, 0x10)
sendto$inet(r0, &(0x7f0000482000), 0x0, 0x800000120000001, &(0x7f0000e45ff0)={0x2, 0x2, @loopback=0x7f000001}, 0x10)

2018/03/26 17:10:14 executing program 4:
modify_ldt$write(0x1, &(0x7f0000000040)={0xd9e}, 0x10)
modify_ldt$write(0x1, &(0x7f0000000080), 0x10)

[   50.911373] binder: 6390:6396 got new transaction with bad transaction stack, transaction 34 has target 6390:0
[   50.925507] binder: 6390:6396 transaction failed 29201/-71, size 0-0 line 3038
2018/03/26 17:10:14 executing program 6:
r0 = socket$inet6(0xa, 0x805, 0x0)
sendto$inet6(r0, &(0x7f0000000040)="d3", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0xf}, 0x1c)
getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000080), &(0x7f0000000180)=0x8)

2018/03/26 17:10:14 executing program 2:
r0 = socket(0x1e, 0x2, 0x0)
connect$ipx(r0, &(0x7f0000000040)={0x4, 0x0, 0x6, "8b4506aadb68"}, 0x10)

2018/03/26 17:10:14 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndseq(&(0x7f00001aaff3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'})
r1 = memfd_create(&(0x7f0000857fff)='\t', 0x0)
r2 = syz_open_dev$sndseq(&(0x7f000011c000)='/dev/snd/seq\x00', 0x0, 0x8000000000102)
dup2(r2, r1)
write$sndseq(r1, &(0x7f0000d81fd0)=[{0x22, 0x0, 0x0, 0x3fd}], 0x30)

2018/03/26 17:10:14 executing program 4:
modify_ldt$write(0x1, &(0x7f0000000040)={0xd9e}, 0x10)
modify_ldt$write(0x1, &(0x7f0000000080), 0x10)

2018/03/26 17:10:14 executing program 1:
r0 = socket$l2tp(0x18, 0x1, 0x1)
getsockname(r0, &(0x7f0000000080)=@generic, &(0x7f0000000000)=0x80)

2018/03/26 17:10:14 executing program 3:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000040)=@add_del={0x2, &(0x7f0000000000)='gretap0\x00'})

2018/03/26 17:10:14 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:14 executing program 0:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000040)={0x0, {{0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}}}, 0x0, 0x2}, 0x90)

2018/03/26 17:10:14 executing program 1:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00008e5000)={0x0, 0x0, 0x0, 0x1}, 0x8)

2018/03/26 17:10:14 executing program 0:
fanotify_mark(0xffffffffffffffff, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000100)='./file0\x00')

2018/03/26 17:10:14 executing program 3:
r0 = socket$inet(0xa, 0x80005, 0x0)
setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x84, 0x9, 0x0, 0x0)

[   50.962639] binder: release 6390:6396 transaction 34 out, still active
[   50.973037] binder: send failed reply for transaction 34, target dead
2018/03/26 17:10:14 executing program 4:
r0 = socket$inet(0x10, 0x3, 0x8000000000c)
sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000017fdc)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0)
sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000000640)="2400000002031f001cfffd946fa2830020200a000900020002e700000200a3a20404ff7e", 0x24}], 0x1}, 0x0)

2018/03/26 17:10:14 executing program 5:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)

2018/03/26 17:10:14 executing program 2:
r0 = add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a}, &(0x7f0000000180)="84", 0x1, 0xfffffffffffffffd)
request_key(&(0x7f0000000240)='user\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000040)='user\x00', r0)

2018/03/26 17:10:14 executing program 6:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='0x2', 0x3)

[   51.051639] binder: 6418:6424 got new transaction with bad transaction stack, transaction 39 has target 6418:0
[   51.084318] binder: 6418:6424 transaction failed 29201/-71, size 0-0 line 3038
[   51.091595] netlink: 4 bytes leftover after parsing attributes in process `syz-executor4'.
2018/03/26 17:10:14 executing program 2:
syz_open_dev$sndtimer(&(0x7f0000014000)='/dev/snd/timer\x00', 0x0, 0x0)

2018/03/26 17:10:14 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/tcp\x00')
preadv(r0, &(0x7f0000b24fb0)=[{&(0x7f0000830000)=""/4096, 0x1000}], 0x1, 0x0)

2018/03/26 17:10:14 executing program 5:
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000fe0)={{&(0x7f0000013000/0xe000)=nil, 0xe000}, 0x1})
pselect6(0x40, &(0x7f0000011fc0), &(0x7f0000011000), &(0x7f0000003000), &(0x7f0000013000), &(0x7f0000001ff8)={&(0x7f0000012000), 0x8})
ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000004ff0)={&(0x7f0000011000/0x3000)=nil, 0x3000})
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)

2018/03/26 17:10:14 executing program 0:
r0 = signalfd4(0xffffffffffffffff, &(0x7f000029bff8), 0x8, 0x0)
r1 = getpid()
r2 = gettid()
readv(r0, &(0x7f0000939000)=[{&(0x7f0000fc7000)=""/128, 0x80}], 0x1)
tgkill(r1, r2, 0x3)

2018/03/26 17:10:14 executing program 6:
perf_event_open(&(0x7f000001d000)={0x200000002, 0x78, 0x5d, 0x108000001}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

2018/03/26 17:10:14 executing program 3:
r0 = syz_open_dev$loop(&(0x7f0000001700)='/dev/loop#\x00', 0x0, 0x0)
r1 = memfd_create(&(0x7f0000000000)='%\x00', 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1)

[   51.092429] netlink: 4 bytes leftover after parsing attributes in process `syz-executor4'.
[   51.094139] netlink: 4 bytes leftover after parsing attributes in process `syz-executor4'.
[   51.098712] netlink: 4 bytes leftover after parsing attributes in process `syz-executor4'.
[   51.214163] binder: release 6418:6424 transaction 39 out, still active
[   51.225067] binder: send failed reply for transaction 39, target dead
[   51.231123] FAULT_FLAG_ALLOW_RETRY missing 30
[   51.231133] CPU: 0 PID: 6462 Comm: syz-executor5 Not tainted 4.4.124-g851fb4d #18
[   51.231138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   51.231149]  0000000000000000 f0e79df210ddc096 ffff8800b5f578a0 ffffffff81d0663d
[   51.231159]  ffff8800aed68c00 1ffff10016beaf21 ffff8800b5f57a28 0000000000000000
[   51.231168]  0000000000000000 ffff8800b5f57a50 ffffffff81607b85 ffffffff81237770
[   51.231170] Call Trace:
[   51.231183]  [<ffffffff81d0663d>] dump_stack+0xc1/0x124
[   51.231192]  [<ffffffff81607b85>] handle_userfault+0x715/0xf50
[   51.231203]  [<ffffffff81237770>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[   51.231213]  [<ffffffff81607470>] ? userfaultfd_ioctl+0x2040/0x2040
[   51.231222]  [<ffffffff814a175d>] ? handle_mm_fault+0xb5d/0x3190
[   51.231229]  [<ffffffff814a351e>] ? handle_mm_fault+0x291e/0x3190
[   51.231236]  [<ffffffff814a3538>] handle_mm_fault+0x2938/0x3190
[   51.231244]  [<ffffffff814a0c00>] ? copy_page_range+0x1480/0x1480
[   51.231252]  [<ffffffff810dcc50>] ? __do_page_fault+0x780/0xa00
[   51.231258]  [<ffffffff8148c4a7>] ? vmacache_find+0x57/0x290
[   51.231265]  [<ffffffff810dc82b>] __do_page_fault+0x35b/0xa00
[   51.231272]  [<ffffffff810dcef7>] do_page_fault+0x27/0x30
[   51.231280]  [<ffffffff8377ab08>] page_fault+0x28/0x30
[   51.231289]  [<ffffffff81d31fd6>] ? copy_user_generic_unrolled+0x86/0xc0
[   51.231296]  [<ffffffff8161e3f6>] ? compat_SyS_pselect6+0x1b6/0x570
[   51.231309]  [<ffffffff8161e240>] ? compat_SyS_old_select+0x230/0x230
[   51.231316]  [<ffffffff8157aa2f>] ? __fd_install+0x25f/0x5f0
[   51.231326]  [<ffffffff812e3039>] ? compat_SyS_futex+0x1f9/0x2a0
[   51.231334]  [<ffffffff8157a7d0>] ? get_unused_fd_flags+0xd0/0xd0
[   51.231342]  [<ffffffff812e2e40>] ? compat_SyS_get_robust_list+0x300/0x300
[   51.231351]  [<ffffffff81006b47>] ? do_fast_syscall_32+0xd7/0x8a0
[   51.231359]  [<ffffffff8161e240>] ? compat_SyS_old_select+0x230/0x230
2018/03/26 17:10:14 executing program 1:
r0 = socket$inet(0x2, 0x805, 0x0)
bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10)

2018/03/26 17:10:14 executing program 2:
r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
fallocate(r0, 0x0, 0x10000, 0x2)
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x2, 0x11, r0, 0x0)
getpeername$ax25(0xffffffffffffffff, &(0x7f0000008140), &(0x7f0000008180)=0x10)
r1 = open(&(0x7f0000011ffa)='./bus\x00', 0x0, 0x0)
fadvise64(r1, 0x0, 0x63, 0x4)

2018/03/26 17:10:14 executing program 6:
prctl$setmm(0x23, 0x9, &(0x7f0000ffc000/0x4000)=nil)

2018/03/26 17:10:14 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/tcp\x00')
preadv(r0, &(0x7f0000b24fb0)=[{&(0x7f0000830000)=""/4096, 0x1000}], 0x1, 0x0)

2018/03/26 17:10:14 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:14 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
poll(&(0x7f0000000140), 0x7e, 0x9)

2018/03/26 17:10:14 executing program 3:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'tunl0\x00', <r1=>0x0})
ioctl$sock_SIOCGIFINDEX(r0, 0x891c, &(0x7f0000000000)={'bond0\x00', r1})

2018/03/26 17:10:14 executing program 0:
r0 = socket$nl_generic(0x2, 0xa, 0x10)
connect$netlink(r0, &(0x7f0000000000)=@kern={0x10}, 0xc)

[   51.231367]  [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0
[   51.231376]  [<ffffffff8377b06a>] sysenter_flags_fixed+0xd/0x17
2018/03/26 17:10:14 executing program 6:
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000013e95), 0x4)
close(0xffffffffffffffff)

2018/03/26 17:10:14 executing program 5:
mkdir(&(0x7f0000d3bff8)='./file0\x00', 0x0)
r0 = open(&(0x7f0000b2cff8)='./file0\x00', 0x0, 0x0)
mkdirat(r0, &(0x7f000050d000)='./file0\x00', 0x0)
unlinkat(r0, &(0x7f000057d000)='./file0\x00', 0x200)

2018/03/26 17:10:14 executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000eb9fff), 0xfffffd65, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000080)={0x0, &(0x7f0000000040)}, 0x10)

[   51.482951] binder: 6483:6487 got new transaction with bad transaction stack, transaction 44 has target 6483:0
[   51.505329] binder: 6483:6487 transaction failed 29201/-71, size 0-0 line 3038
[   51.522707] binder: release 6483:6487 transaction 44 out, still active
2018/03/26 17:10:14 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:14 executing program 1:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00006f3ff0)='/dev/sequencer2\x00', 0x0, 0x0)
ioctl$KDGKBLED(r0, 0xc074510c, &(0x7f0000000000))

[   51.530104] binder: send failed reply for transaction 44, target dead
[   51.580606] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[   51.596299] binder: 6510:6514 got new transaction with bad transaction stack, transaction 49 has target 6510:0
[   51.615245] binder: 6510:6514 transaction failed 29201/-71, size 0-0 line 3038
2018/03/26 17:10:15 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_generic(r0, &(0x7f000000d000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f000000d379)={&(0x7f000000c1a8)={0x14, 0x13, 0x21}, 0x14}, 0x1}, 0x0)

2018/03/26 17:10:15 executing program 5:
openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0)

2018/03/26 17:10:15 executing program 0:
perf_event_open$cgroup(&(0x7f0000000080)={0x5, 0x1a2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000040), 0x8}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

2018/03/26 17:10:15 executing program 6:
r0 = socket$inet(0x2, 0x6, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x3c1, 0x2, 0x280, [0x20000680], 0x0, &(0x7f0000000340), &(0x7f0000000680)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x0, 0x0, 'gre0\x00', 'ip6_vti0\x00', 'nr0\x00', '\x00', @link_local={0x1, 0x80, 0xc2}, [], @link_local={0x1, 0x80, 0xc2}, [], 0xe0, 0xe0, 0x110, [@time={'time\x00', 0x18}, @state={'state\x00', 0x8}]}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1, 0x0, 0x1, [{{{0xf, 0x0, 0x0, 'vcan0\x00', 'sit0\x00', 'lo\x00', 'gretap0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0xa8, 0xe0}, [@snat={'snat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2}}}}]}, @arpreply={'arpreply\x00', 0x10, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}}]}]}, 0x2ac)

2018/03/26 17:10:15 executing program 1:
r0 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffc)
keyctl$read(0xb, r0, &(0x7f0000000200)=""/36, 0x24)

2018/03/26 17:10:15 executing program 3:
syz_open_procfs(0x0, &(0x7f0000000000)='net/udp6\x00')

2018/03/26 17:10:15 executing program 2:
ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0086426, &(0x7f00001f8000)={0x0, &(0x7f00006b6000)})
sysinfo(&(0x7f0000ba8000)=""/218)

2018/03/26 17:10:15 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:15 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f00002e9000)='task\x00')
fchdir(r0)
syz_fuseblk_mount(&(0x7f0000976000)='./file0\x00', &(0x7f0000000000)='./0ile0/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)

[   51.624833] binder: 6510:6514 BC_INCREFS_DONE u0000000000000000 node 48 cookie mismatch 0000000000000001 != 0000000000000000
[   51.645358] binder: release 6510:6514 transaction 49 out, still active
[   51.654862] binder: send failed reply for transaction 49, target dead
2018/03/26 17:10:15 executing program 4:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='0x2', 0x3)

2018/03/26 17:10:15 executing program 0:
memfd_create(&(0x7f0000000040)='userloppp1ptoc\'\x00', 0x6)

2018/03/26 17:10:15 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x2, 0x1, 0x0)
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000044d000))
clock_gettime(0x0, &(0x7f0000000100)={0x0, <r2=>0x0})
ppoll(&(0x7f00000000c0)=[{r1}, {r0}], 0x2, &(0x7f0000000140)={0x0, r2+10000000}, &(0x7f0000000180), 0x8)

[   51.700022] binder: 6525:6533 got new transaction with bad transaction stack, transaction 54 has target 6525:0
[   51.713739] binder: 6525:6533 transaction failed 29201/-71, size 0-0 line 3038
[   51.743529] binder: 6525:6538 BC_INCREFS_DONE u0000000000000000 node 53 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:15 executing program 2:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
bind$inet6(r0, &(0x7f0000fa8fe4)={0xa, 0x3}, 0x1c)
sendto$inet6(r0, &(0x7f0000ab4f8e)="97", 0x1, 0x0, &(0x7f0000aaa000)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in=@loopback, @in6=@mcast1}}, {{@in6}, 0x0, @in6=@mcast2}}, &(0x7f0000000400)=0xe8)
r1 = dup(r0)
ioctl$sock_bt(r1, 0x8907, &(0x7f0000005d80))
recvfrom(r0, &(0x7f00001b4f1e)=""/226, 0xfffffffffffffe49, 0x0, 0x0, 0x0)

2018/03/26 17:10:15 executing program 3:
r0 = socket$inet(0x2, 0x803, 0x5)
setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x3, 0x7fffffffefff, 0x3)

2018/03/26 17:10:15 executing program 6:
socketpair$inet(0x1e, 0x5, 0x0, &(0x7f0000001ff8)={<r0=>0x0})
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000000)={0x0, {{0x2, 0x0, @loopback=0x7f000001}}}, 0x90)

2018/03/26 17:10:15 executing program 0:
delete_module(&(0x7f0000000000)='wlan0\'&\x00', 0x0)

2018/03/26 17:10:15 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0)

2018/03/26 17:10:15 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00')

2018/03/26 17:10:15 executing program 1:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x11, &(0x7f0000000000)={0x0, 'ip6_vti0\x00'}, 0x18)

2018/03/26 17:10:15 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:15 executing program 0:
r0 = perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
flistxattr(r0, &(0x7f0000000080), 0x0)

[   51.797377] binder: release 6525:6533 transaction 54 out, still active
[   51.805772] binder: send failed reply for transaction 54, target dead
2018/03/26 17:10:15 executing program 3:
r0 = socket$inet6(0x10, 0x3, 0x0)
sendmsg(r0, &(0x7f0000002fc8)={&(0x7f0000016000)=@nl=@kern={0x10}, 0x80, &(0x7f0000014000)=[{&(0x7f0000018000)="5500000018007fb1b72d1cb2a4a280a80a06050000a84302a7052369250009000800001c010000000600050002000000000000dc1338d544000a9b84226eb75afb83de448daa7227c43ab8220000060cec4fab91d4", 0x55}], 0x1, &(0x7f0000006000)}, 0x0)

2018/03/26 17:10:15 executing program 5:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00001f0ff8)={<r0=>0xffffffffffffffff})
fgetxattr(r0, &(0x7f0000000040)=@known='security.capability\x00', &(0x7f0000000080)=""/52, 0x34)

2018/03/26 17:10:15 executing program 4:
r0 = socket$nl_generic(0x2, 0x3, 0x10)
connect$netlink(r0, &(0x7f00000000c0)=@unspec, 0xc)
connect$netlink(r0, &(0x7f00000002c0)=@unspec, 0xc)

2018/03/26 17:10:15 executing program 6:
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f000039c000), 0x4)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040), 0xfd7c)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x31, 0xffffffffffffffff, 0x0)

[   51.843796] binder: 6558:6564 got new transaction with bad transaction stack, transaction 59 has target 6558:0
[   51.874271] binder: 6558:6564 transaction failed 29201/-71, size 0-0 line 3038
[   51.882397] binder: 6558:6573 BC_INCREFS_DONE u0000000000000000 node 58 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:15 executing program 1:
r0 = socket$inet(0xa, 0x80005, 0x0)
setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x84, 0x14, 0x0, 0x0)

[   51.928295] netlink: 17 bytes leftover after parsing attributes in process `syz-executor3'.
2018/03/26 17:10:15 executing program 5:
r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000080)='M', 0x1, 0xffffffffffffffff)
keyctl$chown(0x7, r0, 0x0, 0x0)

2018/03/26 17:10:15 executing program 0:
r0 = socket(0x1f, 0x80003, 0x1)
write(r0, &(0x7f0000000140)="3ea56334", 0x4)

2018/03/26 17:10:15 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00')
preadv(r0, &(0x7f0000b24fb0)=[{&(0x7f0000830000)=""/4096, 0x1000}], 0x1, 0x0)

2018/03/26 17:10:15 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f000074f000)='syscall\x00')
pread64(r0, &(0x7f0000157f23)=""/221, 0xdd, 0x0)

2018/03/26 17:10:15 executing program 3:
r0 = syz_open_procfs(0x0, &(0x7f0000d04000)='clear_refs\x00')
writev(r0, &(0x7f0000000040)=[{&(0x7f0000514fff)='3', 0x1}], 0x1)

2018/03/26 17:10:15 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:15 executing program 1:
mkdir(&(0x7f00002b2000)='./file0\x00', 0x0)
mount(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='mqueue\x00', 0x0, &(0x7f0000000000))
r0 = open(&(0x7f0000f04ff8)='./file0\x00', 0x0, 0x0)
lseek(r0, 0x6, 0x0)

2018/03/26 17:10:15 executing program 6:
getpgid(0x0)
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
rmdir(&(0x7f00000000c0)='./control\x00')
umount2(&(0x7f0000000040)='./control/file1\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000140)='./control\x00', &(0x7f0000000180)='./control/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r0)

[   51.978899] binder: release 6558:6564 transaction 59 out, still active
[   51.999244] binder: send failed reply for transaction 59, target dead
2018/03/26 17:10:15 executing program 5:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000f13000)={0xa, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c)
bind$inet6(r0, &(0x7f0000000580)={0xa, 0x2, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x1}, 0x1c)

2018/03/26 17:10:15 executing program 3:
getpgid(0x0)
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
rmdir(&(0x7f00000000c0)='./control\x00')
umount2(&(0x7f0000000040)='./control/file1\x00', 0x0)
close(r0)

2018/03/26 17:10:15 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open$cgroup(&(0x7f00000000c0)={0x1, 0x70, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

[   52.045112] binder: 6607:6610 BC_INCREFS_DONE node 65 has no pending increfs request
2018/03/26 17:10:15 executing program 0:
setrlimit(0x40000000000008, &(0x7f00000a3ff0)={0x0, 0x100000000020})

2018/03/26 17:10:15 executing program 2:
mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, &(0x7f0000000000)={0x0, 0x6, 0x4})
mq_unlink(&(0x7f0000fc4ffb)='eth0\x00')

2018/03/26 17:10:15 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:15 executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x101005, 0x0)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f000082ef0a)=""/246)
pwritev(r0, &(0x7f0000f65000)=[{&(0x7f0000000080)="80fd02002000", 0x6}], 0x1, 0x0)

[   52.088367] binder: release 6607:6610 transaction 64 out, still active
[   52.102148] binder: unexpected work type, 4, not freed
2018/03/26 17:10:15 executing program 4:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0)
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x84, 0x14, &(0x7f0000000000), &(0x7f0000000040)=0x30)

2018/03/26 17:10:15 executing program 0:
syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr, @multicast1=0xe0000001}, @icmp=@address_reply={0x8}}}}}, &(0x7f0000000040)={0x0, 0x4, [0x0, 0x493]})

2018/03/26 17:10:15 executing program 5:
r0 = socket$inet(0x2, 0x840000000003, 0x2)
setsockopt$inet_int(r0, 0x0, 0x32, &(0x7f0000000040), 0x4)

[   52.134774] binder: undelivered TRANSACTION_COMPLETE
[   52.163804] binder: send failed reply for transaction 64, target dead
[   52.173431] binder: 6639:6643 BC_INCREFS_DONE node 69 has no pending increfs request
[   52.196721] binder: release 6639:6643 transaction 68 out, still active
[   52.204249] binder: unexpected work type, 4, not freed
[   52.220093] binder: undelivered TRANSACTION_COMPLETE
[   52.237200] binder: send failed reply for transaction 68, target dead
2018/03/26 17:10:15 executing program 2:
r0 = socket$inet6(0xa, 0x80005, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00004af000)={0x0, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0xffffffa4], 0x1}}}, {{0xa}}}, 0x108)

2018/03/26 17:10:15 executing program 5:
syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x33, 0x0, @rand_addr, @multicast1=0xe0000001}, @icmp=@address_reply={0x8}}}}}, &(0x7f0000000040)={0x0, 0x4, [0x0, 0x493]})

2018/03/26 17:10:15 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0605345, &(0x7f0000000240)={{}, 'port1\x00'})

2018/03/26 17:10:15 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:15 executing program 4:
r0 = syz_open_dev$sg(&(0x7f0000265ff7)='/dev/sg#\x00', 0x0, 0x2)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$fuse(r0, &(0x7f000012f000)={0x50, 0x0, 0x0, @fuse_init_out={0x7, 0x1a}}, 0x50)

2018/03/26 17:10:15 executing program 0:
r0 = socket$inet(0x15, 0x5, 0x0)
bind$inet(r0, &(0x7f000001bff0)={0x2, 0x0, @loopback=0x7f000001}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000040)=0x1ff, 0x4)
recvmsg(r0, &(0x7f0000000340)={&(0x7f0000000000)=@rc, 0xa, &(0x7f0000000280), 0x0, &(0x7f00000002c0)=""/98, 0x62}, 0x0)
connect$inet(r0, &(0x7f0000024ff0)={0x2, 0x0, @loopback=0x7f000001}, 0x10)
sendmsg(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000180)}, 0x0)

2018/03/26 17:10:15 executing program 3:
getpgid(0x0)
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
rmdir(&(0x7f00000000c0)='./control\x00')
umount2(&(0x7f0000000040)='./control/file1\x00', 0x0)
close(r0)

2018/03/26 17:10:15 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00002dfff8)='pagemap\x00')
preadv(r0, &(0x7f0000b24fb0)=[{&(0x7f0000830000)=""/4096, 0x1000}], 0x1, 0x0)

2018/03/26 17:10:15 executing program 5:
r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x2)
read(r0, &(0x7f0000fb6000)=""/28, 0x1c)
r1 = getpid()
sched_setaffinity(r1, 0x8, &(0x7f0000000200)=0x2)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a})
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1})
write$sndseq(r0, &(0x7f0000000240)=[{0xffff, 0x0, 0x0, 0x0, @time, {}, {}, @result}], 0x30)

2018/03/26 17:10:15 executing program 1:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0x40082406, &(0x7f00000000c0)=ANY=[@ANYBLOB="0a6ddf54c385ba9188568083fb4a3fb652093360507eda"])

2018/03/26 17:10:15 executing program 6:
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)

2018/03/26 17:10:15 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f000039c000)=0x400000000000001, 0x4)
setsockopt$sock_int(r0, 0x1, 0x4000000000000008, &(0x7f000066e000), 0x12c)
setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000383000)=0x1, 0x4)
sendto$inet(r0, &(0x7f0000482000), 0xffffffffffffff56, 0x800000120000401, &(0x7f0000e45ff0)={0x2, 0x0, @loopback=0x7f000001}, 0x10)

2018/03/26 17:10:15 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:15 executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='illinois\x00', 0x132)

[   52.305367] binder: 6663:6669 BC_INCREFS_DONE u0000000000000000 node 71 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:15 executing program 2:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@broute={'broute\x00', 0x20, 0x4, 0x438, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000000), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'sit0\x00', 'lo\x00', 'bpq0\x00', 'syzkaller0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], 0x118, 0x180, 0x1b0, [@ip6={'ip6\x00', 0x50, {{@mcast2={0xff, 0x2, [], 0x1}, @loopback={0x0, 0x1}}}}, @vlan={'vlan\x00', 0x8}]}, [@common=@redirect={'redirect\x00', 0x8}, @common=@dnat={'dnat\x00', 0x10}]}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x9, 0x0, 0x0, 'lo\x00', 'yam0\x00', 'vlan0\x00', 'ip6gretap0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x138, 0x180, 0x1f8, [@pkttype={'pkttype\x00', 0x8}, @physdev={'physdev\x00', 0x70, {{'vlan0\x00', {}, 'bridge0\x00'}}}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}]}, @common=@nflog={'nflog\x00', 0x50, {{0x0, 0x0, 0x0, 0x0, 0x0, "7e688d291dcb3e77e5b1ad9df809d3bd82954ddcf2323ba03fdb515f45b0a01db4531d1ed126f81913c3d3b01debac240809fdb8758f24272e8b2c892e784317"}}}}]}]}, 0x440)

2018/03/26 17:10:15 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x10e, 0xb, &(0x7f0000000500)={{0x0, @multicast1=0xe0000001, 0x0, 0x0, 'sed\x00'}, {@loopback=0x7f000001}}, 0x3)

2018/03/26 17:10:15 executing program 6:
r0 = socket$inet(0x2, 0x6, 0x0)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1=0xe0000001}, 0x10)

2018/03/26 17:10:15 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000f0c000)='clear_refs\x00')
mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x44031, 0xffffffffffffffff, 0x0)
pwrite64(r0, &(0x7f0000000000)="b4", 0x1, 0x0)

2018/03/26 17:10:15 executing program 2:
r0 = socket$inet(0x2, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x4, &(0x7f0000000080), 0xc)

2018/03/26 17:10:15 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000d18ffc)=0x8001, 0x4)

2018/03/26 17:10:15 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0xffffff75, 0x0, &(0x7f0000ef7000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff4a, 0xfffffffffffffdf9, &(0x7f0000dbcfe8)=[@fd={0x66642a85}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/03/26 17:10:15 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast2=0xe0000002}, 0x10)

2018/03/26 17:10:15 executing program 5:
prctl$intptr(0x2a, 0x0)

2018/03/26 17:10:15 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

[   52.436533] binder: 6705:6714 BC_INCREFS_DONE u0000000000000000 node 72 cookie mismatch 0000000000000001 != 0000000000000000
[   52.442231] audit: type=1400 audit(1522084215.821:15): avc:  denied  { setopt } for  pid=6709 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
2018/03/26 17:10:15 executing program 4:
r0 = socket(0x10, 0x802, 0x0)
write(r0, &(0x7f0000000000)="240000001a0025f0006bb404feff141c020b5aff6e10b500cc0800030001000000000000", 0x24)

2018/03/26 17:10:15 executing program 1:
r0 = open(&(0x7f00004b8ff8)='./file0\x00', 0x28042, 0x0)
write$evdev(r0, &(0x7f0000000100)=[{{0x0, 0x7530}}], 0xffffff9e)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0)

2018/03/26 17:10:15 executing program 0:
socketpair$ipx(0x4, 0x2, 0x0, &(0x7f0000dc1ff8))
mprotect(&(0x7f00002b1000/0xc00000)=nil, 0xc00000, 0x7)

2018/03/26 17:10:15 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:15 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000018ff4)={0x10}, 0xc, &(0x7f0000013ff1)={&(0x7f0000000140)={0x20, 0x26, 0x1, 0x0, 0x0, {0x1}, [@typed={0xc, 0x0, @u64=0xffff800b}]}, 0x20}, 0x1}, 0x0)

[   52.533356] binder: 6723:6727 transaction failed 29189/-22, size -182--519 line 3011
[   52.551144] binder: 6729:6735 BC_INCREFS_DONE u0000000000000000 node 74 cookie mismatch 0000000000000001 != 0000000000000000
[   52.568745] binder_alloc: binder_alloc_mmap_handler: 6723 20000000-20002000 already mapped failed -16
2018/03/26 17:10:15 executing program 6:
perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x1f, 0x80003, 0x1)
getsockname$inet(r0, &(0x7f00000000c0)={0x0, 0x0, @broadcast}, &(0x7f0000000040)=0x10)

2018/03/26 17:10:15 executing program 5:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='0x2\n', 0x4)

2018/03/26 17:10:16 executing program 1:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3}, 0x1c)

2018/03/26 17:10:16 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
kexec_load(0x0, 0x0, &(0x7f0000000040), 0x0)

2018/03/26 17:10:16 executing program 4:
mkdir(&(0x7f0000001000)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, @perf_bp={&(0x7f0000a7dfff)}, 0x2000000a00000400, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f000000a000))

[   52.620983] netlink: 8 bytes leftover after parsing attributes in process `syz-executor4'.
[   52.650850] binder: 6755:6761 transaction failed 29189/-22, size 40-8 line 3011
2018/03/26 17:10:16 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:16 executing program 3:
pipe2(&(0x7f0000989000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0)
write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
writev(r2, &(0x7f0000000440), 0x0)
dup2(r0, r1)

2018/03/26 17:10:16 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c)
listen(r0, 0x40000000000005)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c)

[   52.674785] binder: undelivered TRANSACTION_ERROR: 29189
[   52.685748] binder: undelivered TRANSACTION_ERROR: 29189
[   52.725633] binder: 6770:6774 transaction failed 29189/-22, size 40-8 line 3011
[   52.758489] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:16 executing program 0:
r0 = socket$inet(0xa, 0x6, 0x0)
bind$netlink(r0, &(0x7f0000000280)={0x10}, 0xc)

2018/03/26 17:10:16 executing program 6:
r0 = memfd_create(&(0x7f0000001380)='bdev#cgroup@\x00', 0x0)
r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0)
dup2(r1, r0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000000c0)={0x0, 0x0, 0x0, "71756575651966e0ca00000000000000000000000000000b00e3001b000000000000000400080000000001000000000000000000000000000000f3feffb20300"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0)

2018/03/26 17:10:16 executing program 2:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x1, 0x0)
write$sndseq(r0, &(0x7f00000002c0)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x0, 0x0, 0x5}}], 0x30)

2018/03/26 17:10:16 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:16 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f00002e9000)='task\x00')
fchdir(r0)
syz_fuseblk_mount(&(0x7f0000976000)='./file0\x00', &(0x7f0000000000)="2e2f66696c6530e566696c653000", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)

2018/03/26 17:10:16 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getrusage(0x1, &(0x7f0000000040))

2018/03/26 17:10:16 executing program 5:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f00004b1000)='./file0\x00', 0x0)
mount(&(0x7f00009eb000)='./file0/file0\x00', &(0x7f0000c1bff8)='./file0\x00', &(0x7f0000a6f000)='nfs4\x00', 0x0, &(0x7f0000dedf2f)='vE')

2018/03/26 17:10:16 executing program 3:
r0 = socket$inet6(0xa, 0x805, 0x0)
setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000140)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x90)

[   52.855902] binder: 6808:6810 transaction failed 29189/-22, size 40-8 line 3011
2018/03/26 17:10:16 executing program 1:
r0 = socket$inet(0x2, 0x4000000805, 0x0)
r1 = socket$inet_sctp(0x2, 0x5, 0x84)
r2 = dup3(r0, r1, 0x0)
sendmmsg(r2, &(0x7f00000079c0)=[{{&(0x7f0000000380)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14}}, 0x80, &(0x7f0000000b00)=[{&(0x7f0000000a80)='\x00', 0x1}], 0x1, &(0x7f0000000b80)}}], 0x1, 0x0)

2018/03/26 17:10:16 executing program 6:
r0 = socket$inet(0x2, 0x80003, 0x4)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0xd, &(0x7f0000000000)={{0x0, @empty, 0x0, 0x0, 'rr\x00'}, {@dev={0xac, 0x14, 0x14}}}, 0x44)

2018/03/26 17:10:16 executing program 4:
r0 = socket$inet(0xa, 0x6, 0x0)
write(0xffffffffffffffff, &(0x7f0000000040)="0d3e3edee0a721c0cc00e259e1991f1addd847b178b5b812b16f56f7456ee5ad5b73324d6818669652175ba50f7471300f08e9084b161281594543a904a77b8a5c749c141bcb4b49c80ce72b8f194717", 0x50)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x30, &(0x7f0000000000)={0x0, 'syzkaller0\x00'}, 0x292)

2018/03/26 17:10:16 executing program 2:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0)
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x84, 0x76, &(0x7f0000000000), &(0x7f0000000040)=0x30)

2018/03/26 17:10:16 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:16 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000017000)=0xfffff7fffffffffd, 0x4)
listen(r0, 0x0)

2018/03/26 17:10:16 executing program 5:
pipe2(&(0x7f0000f61000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x1c)
ioctl$int_in(r1, 0x5452, &(0x7f0000affff8)=0x7)
dup2(r0, r2)

2018/03/26 17:10:16 executing program 3:
nanosleep(&(0x7f0000000200)={0x0, 0x1c9c380}, &(0x7f0000000040))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
mlock(&(0x7f00001bf000/0x600000)=nil, 0x600000)
ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x0)

[   52.897748] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:16 executing program 6:
r0 = socket$inet(0x10, 0x3, 0x4)
sendmsg(r0, &(0x7f0000014000)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001400ff09fffefd956fa283b70aa6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d4c1cbc882b079881", 0x4c}], 0x1}, 0x0)

2018/03/26 17:10:16 executing program 0:
r0 = gettid()
timer_create(0x0, &(0x7f0000d7afa8)={0x0, 0x12, 0x0, @thr={&(0x7f0000572000), &(0x7f0000180000)}}, &(0x7f00002f5000))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x1c9c380}, {0x0, 0x9}}, &(0x7f00004c2000))
clone(0x0, &(0x7f0000000000), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
tkill(r0, 0x1000000000016)

2018/03/26 17:10:16 executing program 2:
r0 = syz_open_dev$sg(&(0x7f0000223ff7)='/dev/sg#\x00', 0x0, 0x0)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x8012, r0, 0x0)
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)

2018/03/26 17:10:16 executing program 6:
socketpair$inet6(0xa, 0x3, 0xff, &(0x7f0000000180))

[   52.979884] binder_alloc: 6835: binder_alloc_buf, no vma
[   52.995618] binder: 6835:6854 BC_INCREFS_DONE u0000000000000000 node 78 cookie mismatch 0000000000000001 != 0000000000000000
[   52.999816] binder: 6835:6844 transaction failed 29189/-3, size 40-8 line 3134
2018/03/26 17:10:16 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}})

2018/03/26 17:10:16 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x200, 0x0)

2018/03/26 17:10:16 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000100))

2018/03/26 17:10:16 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:16 executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc))
r1 = syz_open_pts(r0, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0)
dup3(r1, r0, 0x0)
pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8})

2018/03/26 17:10:16 executing program 0:
keyctl$restrict_keyring(0x12, 0x0, &(0x7f00000000c0)='ceph\x00', &(0x7f0000000140)='\x00')

2018/03/26 17:10:16 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}})

2018/03/26 17:10:16 executing program 5:
pipe2(&(0x7f0000f61000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x1c)
ioctl$int_in(r1, 0x5452, &(0x7f0000affff8)=0x7)
dup2(r0, r2)

[   53.098188] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:16 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPVS_CMD_DEL_SERVICE(r0, &(0x7f0000003bc0)={&(0x7f0000002740)={0x10}, 0xc, &(0x7f0000003b80)={&(0x7f0000002780)={0x14, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x400000, 0x10a}, 0x0)

2018/03/26 17:10:16 executing program 6:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
pivot_root(&(0x7f0000000040)='./control\x00', &(0x7f0000000080)='./control\x00')
close(0xffffffffffffffff)

2018/03/26 17:10:16 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}})

[   53.177313] binder_alloc: 6894: binder_alloc_buf, no vma
[   53.194799] binder: 6894:6896 transaction failed 29189/-3, size 40-8 line 3134
[   53.216535] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:16 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
unshare(0x20000400)
getsockopt$inet6_tcp_int(r0, 0x6, 0x8, &(0x7f0000006ffc), &(0x7f0000009ffc)=0x4)

2018/03/26 17:10:16 executing program 2:
r0 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'bcsh0\x00', 0x2})
ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000180)={0x0, 0x1, [@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}]})

2018/03/26 17:10:16 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}})

2018/03/26 17:10:16 executing program 5:
timer_create(0x8, &(0x7f0000044000)={0x0, 0x0, 0x1}, &(0x7f00000000c0))

2018/03/26 17:10:16 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x3, &(0x7f0000004240))

2018/03/26 17:10:16 executing program 3:
r0 = socket$inet(0x28, 0x1, 0x0)
connect$netlink(r0, &(0x7f0000000040)=@unspec, 0xc)

2018/03/26 17:10:16 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:16 executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc))
r1 = syz_open_pts(r0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fdd000)=0x3)
ioctl$KDGETMODE(r1, 0x541a, &(0x7f0000000040))

2018/03/26 17:10:16 executing program 1:
getgroups(0x0, &(0x7f0000002b80))

2018/03/26 17:10:16 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}})

2018/03/26 17:10:16 executing program 6:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x13, &(0x7f0000000080)={0x803, 'ip6gretap0\x00'}, 0x18)

2018/03/26 17:10:16 executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc))
r1 = syz_open_pts(r0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fdd000)=0x3)
ioctl$KDGETMODE(r1, 0x541a, &(0x7f0000000040))

2018/03/26 17:10:16 executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x7ff)
bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000f6f000), 0x0, 0x20000004, &(0x7f0000cc7fe4)={0xa, 0x4e22}, 0x1c)

[   53.315563] binder_alloc: 6919: binder_alloc_buf, no vma
[   53.337505] binder: 6919:6930 transaction failed 29189/-3, size 40-8 line 3134
2018/03/26 17:10:16 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f00000c5ff7)='/dev/sg#\x00', 0x0, 0x0)
ioctl(r0, 0x1275, &(0x7f0000007000))

[   53.363666] binder: undelivered TRANSACTION_ERROR: 29189
[   53.388287] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
2018/03/26 17:10:16 executing program 7:
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)={<r0=>0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r0, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:16 executing program 3:
r0 = memfd_create(&(0x7f0000001fcd)='wlan0*mime_type-trusted}&wlan0vmnet1.trusted{\\{GPL\x00', 0x0)
write(r0, &(0x7f0000001f23)="db42366e", 0x4)
mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x4, 0x4011, r0, 0x0)
symlink(&(0x7f0000004000)='./file0\x00', &(0x7f0000002ff6)='./control\x00')

2018/03/26 17:10:16 executing program 4:
r0 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}})

2018/03/26 17:10:16 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={&(0x7f0000de2ff4)={0x10, 0xf}, 0xc, &(0x7f00004ca000)={&(0x7f0000690000)={0x14, 0x0, 0x6, 0x1}, 0x14}, 0x1}, 0x0)

2018/03/26 17:10:16 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f00000c5ff7)='/dev/sg#\x00', 0x0, 0x0)
ioctl(r0, 0x1275, &(0x7f0000007000))

2018/03/26 17:10:16 executing program 5:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00007a0000)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000003300)=[{{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000100)}}, {{&(0x7f0000001300)=@un=@abs={0x1}, 0x8, &(0x7f0000001440), 0x2bb, &(0x7f0000000040)}}], 0x2, 0x0)

2018/03/26 17:10:16 executing program 6:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setpriority(0x2, 0x0, 0x0)

2018/03/26 17:10:16 executing program 2:
r0 = socket$inet(0x2, 0x2, 0x0)
getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x88, 0x65, &(0x7f0000000100)=""/8, &(0x7f0000000140)=0x8)

2018/03/26 17:10:16 executing program 2:
perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x1f, 0x5, 0x0)
setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000000), 0x1)

2018/03/26 17:10:16 executing program 4:
r0 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}})

2018/03/26 17:10:16 executing program 7:
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)={<r0=>0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r0, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:16 executing program 5:
request_key(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a}, &(0x7f0000000240)='}selinux]security:eth0,-{\x00', 0xfffffffffffffffd)

2018/03/26 17:10:16 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f0000007ff7)='net/icmp\x00')
close(r0)

2018/03/26 17:10:16 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0)='IPVS\x00')
sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000500)={&(0x7f0000000400)={0x10}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x14, r1, 0x307, 0x0, 0x0, {0xb}}, 0x14}, 0x1}, 0x0)

2018/03/26 17:10:16 executing program 6:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000e95fe0)={@remote={0xfe, 0x80, [], 0xffffffffffffffff}}, 0x20)

2018/03/26 17:10:16 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$sock_cred(r0, 0x1, 0x35, &(0x7f0000000480), 0xc)

2018/03/26 17:10:16 executing program 5:
request_key(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a}, &(0x7f0000000240)='}selinux]security:eth0,-{\x00', 0xfffffffffffffffd)

2018/03/26 17:10:16 executing program 1:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000013ff4)=@assoc_value, &(0x7f0000002000)=0x8)
getsockopt$inet_mreqn(r1, 0x0, 0x0, &(0x7f0000000080)={@rand_addr, @multicast1}, &(0x7f0000000040)=0xc)
mmap(&(0x7f0000000000/0x22000)=nil, 0x22000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
close(r0)

2018/03/26 17:10:16 executing program 4:
r0 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000944fa8))

2018/03/26 17:10:16 executing program 7:
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)={<r0=>0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r0, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:16 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x406000, 0x0)

2018/03/26 17:10:17 executing program 2:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000e33ff8)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000b91ffc)=0x7, 0x4)

2018/03/26 17:10:17 executing program 1:
mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0)
mount(&(0x7f0000001180)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='hugetlbfs\x00', 0x0, &(0x7f0000000040))

2018/03/26 17:10:17 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$usbmon(&(0x7f0000fd0ff3)='/dev/usbmon#\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0x80089203, &(0x7f0000dde000))

2018/03/26 17:10:17 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x0, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:17 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getpgrp(0x0)

2018/03/26 17:10:17 executing program 3:
mkdir(&(0x7f000000dff6)='./control\x00', 0x0)
r0 = open(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
mkdirat(r0, &(0x7f0000044ff6)='./control\x00', 0x0)
renameat2(r0, &(0x7f0000036ff6)='./control\x00', r0, &(0x7f0000036000)='./file0\x00', 0x4)

2018/03/26 17:10:17 executing program 4:
mkdir(&(0x7f0000000200)='./file0\x00', 0x0)
mount(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='rpc_pipefs\x00', 0x0, &(0x7f00000001c0))

2018/03/26 17:10:17 executing program 0:
r0 = open(&(0x7f0000085000)='./control\x00', 0x28042, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000273ff6)='./control\x00', 0x80000c12)
sched_setaffinity(0x0, 0xfffffffffffffeeb, &(0x7f0000fb8ff8))
writev(r0, &(0x7f0000ecc000)=[{&(0x7f00000d9000)="f9", 0x1}], 0x1)

2018/03/26 17:10:17 executing program 1:
r0 = syz_open_dev$sndseq(&(0x7f0000cab5b3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'port0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40005})

2018/03/26 17:10:17 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x12013, r0, 0x0)
syz_open_dev$tun(&(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0)

2018/03/26 17:10:17 executing program 5:
r0 = socket$inet6(0xa, 0x1, 0x8010000000000084)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000001000), 0x4)
sendto$inet6(r0, &(0x7f0000b31000)="f9", 0x1, 0x0, &(0x7f00009e1000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c)
listen(r0, 0x87)
accept4(r0, &(0x7f0000000000)=@can, &(0x7f0000000040)=0xfffffffffffffe7b, 0x0)

2018/03/26 17:10:17 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = fcntl$dupfd(r0, 0x0, r0)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@getspdinfo={0x14, 0x25, 0x405, 0x0, 0x0, 0x9}, 0x14}, 0x1}, 0x0)

2018/03/26 17:10:17 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f00006a9ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x14, 0x0, &(0x7f0000004000)=[@acquire_done={0x40086303, 0x0, 0x40406301}], 0x0, 0x0, &(0x7f0000002000)})

2018/03/26 17:10:17 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000c16ff0)={0x2, 0x1, @multicast1=0xe0000001}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x20020007, &(0x7f0000e97fcf)={0x2, 0x1, @loopback=0x7f000001}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4)

2018/03/26 17:10:17 executing program 0:
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={"6966623000faffffffffffffff00", 0x4000000000000302})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201})
write$tun(0xffffffffffffffff, &(0x7f0000000200)=ANY=[], 0x0)

[   53.751715] binder_alloc: 7029: binder_alloc_buf, no vma
[   53.769486] binder: 7029:7036 transaction failed 29189/-3, size 40-8 line 3134
[   53.816160] binder: undelivered TRANSACTION_ERROR: 29189
[   53.846161] binder: 7063:7065 BC_FREE_BUFFER u0000000000000000 no match
[   53.853033] binder: 7063:7065 got reply transaction with no transaction stack
[   53.863917] binder: 7063:7065 transaction failed 29201/-71, size 0-0 line 2927
[   53.889010] binder: 7063:7070 BC_FREE_BUFFER u0000000000000000 no match
[   53.896615] binder: 7063:7070 got reply transaction with no transaction stack
[   53.904499] binder: 7063:7070 transaction failed 29201/-71, size 0-0 line 2927
[   53.924294] binder: undelivered TRANSACTION_ERROR: 29201
[   53.932092] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/26 17:10:17 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x0, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:17 executing program 2:
r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0)
lseek(r0, 0x0, 0x4)

2018/03/26 17:10:17 executing program 6:
r0 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000000)={{0x80}, 'port1\x00'})
ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000ec6fb0)={{0x0, 0x8001}, {0x80}})

2018/03/26 17:10:17 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f0000531000)='numa_maps\x00')
sendfile(r0, r0, &(0x7f00009c7000)=0x400000, 0x400000ff)

2018/03/26 17:10:17 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000c16ff0)={0x2, 0x1, @multicast1=0xe0000001}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x20020007, &(0x7f0000e97fcf)={0x2, 0x1, @loopback=0x7f000001}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4)

2018/03/26 17:10:17 executing program 5:
r0 = socket$inet6(0xa, 0x1, 0x8010000000000084)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000001000), 0x4)
sendto$inet6(r0, &(0x7f0000b31000)="f9", 0x1, 0x0, &(0x7f00009e1000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c)
listen(r0, 0x87)
accept4(r0, &(0x7f0000000000)=@can, &(0x7f0000000040)=0xfffffffffffffe7b, 0x0)

2018/03/26 17:10:17 executing program 0:
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={"6966623000faffffffffffffff00", 0x4000000000000302})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201})
write$tun(0xffffffffffffffff, &(0x7f0000000200)=ANY=[], 0x0)

2018/03/26 17:10:17 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x0, 0x0)
r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000030fb4))

2018/03/26 17:10:17 executing program 2:
r0 = perf_event_open(&(0x7f0000000180)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = inotify_init1(0x0)
dup2(r0, r1)

[   54.126052] binder_alloc: 7072: binder_alloc_buf, no vma
[   54.142461] binder: 7072:7085 transaction failed 29189/-3, size 40-8 line 3134
[   54.158408] binder: 7072:7093 BC_INCREFS_DONE u0000000000000000 node 88 cookie mismatch 0000000000000001 != 0000000000000000
[   54.198503] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:17 executing program 0:
r0 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffe)
r1 = add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f00000003c0)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a}, 0x0, 0x0, r1)
r3 = add_key$user(&(0x7f00003bd000)='user\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a}, &(0x7f0000000440)='\x00', 0x1, r2)
r4 = add_key$user(&(0x7f0000fc0ffb)='user\x00', &(0x7f0000752ffb)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00003eb000)="b3", 0x1, r2)
keyctl$update(0x2, r4, &(0x7f0000000480)="df02754677212dfc3e2acc26fdc3ffa64813da494137e175e9f2780ac5e2a09f43a1fcebf272a5a135de92bf4a9033933824f6e6aa023895113293535d1c0066d20e0f275188b4b4c187e18774fc2227cbb60fc6697f5337726164c8fbe1181e6d50986cd98a5c44ac0ec375deb27eafcf7d06438f252510d87bd91d03e7dc2faed85adcd88ca30e75b1e143a72d94defa187e48b89efbbbcc9b9a9a307353df7a21affce4e9149eb122cbc356cb681365afd979e97b57b596e901864a68679f", 0xc0)
keyctl$dh_compute(0x17, &(0x7f0000000080)={r4, r4, r3}, &(0x7f0000a53ffb)=""/5, 0x5, &(0x7f0000c61fc8)={&(0x7f0000000000)={'poly1305-generic\x00'}})

2018/03/26 17:10:17 executing program 1:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x48, &(0x7f0000000000)={0xffffffa4, 'ip6_vti0\x00'}, 0x18)

2018/03/26 17:10:17 executing program 3:
socket$inet6(0xa, 0x80003, 0xff)

2018/03/26 17:10:17 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000001700)='/dev/loop#\x00', 0xfffffffffffffffd, 0x0)
r1 = memfd_create(&(0x7f0000000000)='%\x00', 0x1)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1)
ioctl$LOOP_CLR_FD(r0, 0x4c01)

2018/03/26 17:10:17 executing program 5:
r0 = socket$inet6(0xa, 0x802, 0x0)
socket$packet(0x11, 0xa, 0x300)
sendmsg(r0, &(0x7f000000b000)={&(0x7f000000bfe4)=@in={0x2, 0x4e20, @loopback=0x7f000001}, 0x10, &(0x7f0000016fa0), 0x0, &(0x7f000000d000)}, 0x0)

2018/03/26 17:10:17 executing program 2:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0)
write(r0, &(0x7f00000001c0)="3078320a6a64f9744aecc9fd1aba3e037d88ad50c260", 0x16)

2018/03/26 17:10:17 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000fe2000)={@remote={0xfe, 0x80, [], 0xffffffffffffffff}, 0x80000000, 0x0, 0x20000000002, 0x1}, 0x20)

2018/03/26 17:10:17 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x0, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:17 executing program 3:
syz_emit_ethernet(0xc4, &(0x7f0000000100)={@random="781593786d38", @empty, [], {@ipx={0x8137, {0xffff, 0xb6, 0x0, 0x0, {@broadcast=0xffffffff, @current}, {@random, @current}, "b1ad160f57cbfabc8a83248750c70892309b551aa14c21d0aa4b6d0ea4da54f980eef42eb35080d1c2eb7846bd8217b9df7aaa6727b7d140a6ed38527314fac76bfd84803c440888f4786e246bf7ccc1eeb84c9f5e1f7b19508b83a438dacf49bcf08fe7976ca899f4e7aa9d58f88c963805f8fe71601a45a4a2c15ee44edbf9beeb1ccb2376783ae724d7a34362b67cffb4633749cbe6c7"}}}}, &(0x7f00000000c0))
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000384ff7)='/dev/ppp\x00', 0x0, 0x0)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000001c0)=""/246)

2018/03/26 17:10:17 executing program 2:
socketpair$unix(0x1, 0x400000000003, 0x0, &(0x7f0000a8eff8)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000ac5000), 0x4)
sendmmsg$unix(r0, &(0x7f00000bd000), 0x80, 0x0)
connect$unix(r0, &(0x7f00002ffff6)=@file={0x0, './file0\x00'}, 0xa)
socketpair(0x0, 0x0, 0x0, &(0x7f0000000040))

2018/03/26 17:10:17 executing program 4:
r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000fb6000)=""/28, 0x1c)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d137e637, 0x10800a})
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9))
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000000)={0x0, 0x0, 0x0, {0x77359400}})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0)

[   54.360148] binder_alloc: 7104: binder_alloc_buf, no vma
[   54.375985] binder: 7104:7107 transaction failed 29189/-3, size 40-8 line 3134
2018/03/26 17:10:17 executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000981ff8)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
dup3(r1, r0, 0x0)
r2 = epoll_create(0x948)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000984ff4))

2018/03/26 17:10:17 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:17 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000001e80)={&(0x7f0000000100)={0x10}, 0xc, &(0x7f0000001e40)={&(0x7f0000001d80)=@mpls_delroute={0x1c, 0x19, 0x3, 0x0, 0x0, {0x1c}}, 0x1c}, 0x1}, 0x0)

2018/03/26 17:10:17 executing program 5:
r0 = socket$inet(0x28, 0x1, 0x0)
getsockopt$IP_VS_SO_GET_VERSION(r0, 0x28, 0x480, &(0x7f0000000080), &(0x7f00000000c0)=0x40)

[   54.402718] binder: 7104:7123 BC_INCREFS_DONE u0000000000000000 node 90 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:17 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:17 executing program 6:
r0 = syz_open_dev$evdev(&(0x7f0000057fee)='/dev/input/event#\x00', 0x0, 0x0)
ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f00000001c0)=""/178)

[   54.453711] binder: undelivered TRANSACTION_ERROR: 29189
[   54.508042] binder_alloc: 7142: binder_alloc_buf, no vma
[   54.537543] binder: 7142:7159 BC_INCREFS_DONE u0000000000000000 node 92 cookie mismatch 0000000000000001 != 0000000000000000
[   54.539972] binder: 7142:7148 transaction failed 29189/-3, size 40-8 line 3134
2018/03/26 17:10:18 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000ef5000)={0xa, 0x2}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000c7a000), 0x0, 0x30000001, &(0x7f0000b23000)={0xa, 0x2}, 0x1c)
close(r1)
sendto(r0, &(0x7f0000fca000), 0xfdbf12558da8f98b, 0x0, &(0x7f0000ec6f80)=@generic={0x0, "8921ef79394a92d7c3e502b2429f21f76f854ff1ff288cddc58d6adfd9b41c0428c73faa536977e8159391da5b5693610a5c3b99a7749776a4fa9fe9256804488862269804a60a2e793127079bcf9b9e7ec52d6fd2b6d28138b24ab90cec254620a715c57ebc136f04080036cfbfea78f5a737fa0892ab39813f23d30a5a"}, 0x80)

2018/03/26 17:10:18 executing program 3:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000384ff7)='/dev/ppp\x00', 0x0, 0x0)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000000)=""/246)
ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000e9f000))

2018/03/26 17:10:18 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:18 executing program 4:
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0x3b2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mremap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil)

2018/03/26 17:10:18 executing program 5:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f000014f000)={&(0x7f00003c7ff4)={0x10}, 0xc, &(0x7f0000000000)={&(0x7f0000c07e98)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x0, 0x0, 0x0, 0x0, 0xfffffff0}, {@in6, 0x0, 0x33}, @in=@broadcast=0xffffffff, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}, 0x1}, 0x0)

2018/03/26 17:10:18 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0)
r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='io.stat\x00', 0x0, 0x0)
read(r1, &(0x7f0000000380)=""/178, 0x29)

2018/03/26 17:10:18 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x0, 0x0)
read(r0, &(0x7f0000000040)=""/28, 0x1c)

2018/03/26 17:10:18 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

[   54.579849] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:18 executing program 5:
r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x14117e)
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x0)

2018/03/26 17:10:18 executing program 3:
nanosleep(&(0x7f0000000200)={0x0, 0x1c9c380}, &(0x7f0000000000))
mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0)
mlockall(0x1)
mremap(&(0x7f000053b000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffe000/0x2000)=nil)
mprotect(&(0x7f000008b000/0x3000)=nil, 0x3000, 0x0)

2018/03/26 17:10:18 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:18 executing program 2:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000223fd4)=[@in6={0xa, 0x3}], 0x1c)
sendto$inet6(r0, &(0x7f0000aaff09)="b8", 0x1, 0x0, &(0x7f0000ab0000)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000240)={0x0, @in={{0x2}}, 0x9}, 0x90)

[   54.624606] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies.  Check SNMP counters.
[   54.643491] binder_alloc: 7172: binder_alloc_buf, no vma
[   54.649346] binder: 7172:7179 transaction failed 29189/-3, size 40-8 line 3134
2018/03/26 17:10:18 executing program 4:
r0 = socket$inet6(0xa, 0x1, 0x8010000800000084)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0xffff}, 0x1c)

[   54.675786] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:18 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$cgroup_int(r0, &(0x7f00000000c0)='cpuset.cpus\x00', 0x2, 0x0)
write$cgroup_int(r1, &(0x7f0000000000)={[0x30]}, 0x1)

2018/03/26 17:10:18 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:18 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x0, 0x0)
read(r0, &(0x7f0000000040)=""/28, 0x1c)

[   54.932447] binder_alloc: 7194: binder_alloc_buf, no vma
[   54.964325] binder: 7194:7204 BC_INCREFS_DONE u0000000000000000 node 96 cookie mismatch 0000000000000001 != 0000000000000000
[   54.989308] binder: 7194:7199 transaction failed 29189/-3, size 40-8 line 3134
[   55.007271] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:18 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:18 executing program 5:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000d9c000)='/dev/sequencer\x00', 0x842, 0x0)
writev(r0, &(0x7f0000a2cf90)=[{&(0x7f000068c000)="95a96157244518ed548026538e235691b3c6d1812390e11fe85928da75acd6eb9fb63e63491a06da0bc202ea6ee4b5e159b6769f57fcf8a66c9c287ae58eee3ef46f54d0810419e307487c469d146574e96696bb85f2a98ae80233a6c83526fadcb062182a825e3cdda64ab91151e05bc5ce7dad0ab4dbc3630f63aa990ced7a55a79b6f09a61e513fd16b9c0fc1d61d3539c98090eb00f983aa8c5276f097a548dbcf867ee9a5d0deef7e1680cec2d0116458e8c981e73a29c89bac8c29129b2ae38eb9f35ef2c6d23dbccaf9f408a1321bb376f454dbf62d789db6f9569532e911add567f1906544fe95068980b8c7516e79a621afb95d8e70df14ac84365f3cd8ed21c610d2d8577627b83c9848d2666a00fd203ca9928f203876e1296f6133d7c0770864df65a3", 0x129}], 0x1)

2018/03/26 17:10:18 executing program 0:
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x2)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000180)={0x0, 0x7, "c85de82b0401a7"}, &(0x7f0000000080)=0xf)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x4001})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201})
write(r1, &(0x7f0000000180), 0xff4d)

2018/03/26 17:10:18 executing program 6:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)="2e469d000000cb14b3b4fcab46742945", 0x7ffff, 0x0)

2018/03/26 17:10:18 executing program 2:
r0 = socket$inet(0x2, 0x803, 0x5)
setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x30, 0x0, 0x0)

2018/03/26 17:10:18 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:18 executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r0, 0x29, 0x49, &(0x7f00000000c0)="1efc4568", 0x4)

2018/03/26 17:10:18 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000140)=@req={0x28, &(0x7f0000000100)={'lo\x00', @ifru_names='bridge0\x00'}})

2018/03/26 17:10:18 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:18 executing program 2:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0)
read(r0, &(0x7f00000001c0)=""/241, 0xf1)

2018/03/26 17:10:18 executing program 6:
r0 = socket$inet(0x2, 0x840000000003, 0x2)
setsockopt$inet_int(r0, 0x0, 0x5, &(0x7f0000000000)=0x6, 0x4)

2018/03/26 17:10:18 executing program 4:
r0 = socket$inet(0x2, 0x6, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@broute={'broute\x00', 0x20, 0x1, 0x138, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000580], 0x0, &(0x7f0000000000), &(0x7f0000000580)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x19, 0x0, 0x0, 'yam0\x00', 'bcsf0\x00', 'ipddp0\x00', 'sit0\x00', @random="73a7666b83b4", [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x70, 0x70, 0xa8}}, @common=@mark={'mark\x00', 0x10, {{0x0, 0xfffffffffffffffd}}}}]}]}, 0x17c)

2018/03/26 17:10:18 executing program 5:
add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffe)

2018/03/26 17:10:18 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000002b80))

[   55.118367] binder: 7219:7227 transaction failed 29189/-22, size 40-8 line 3011
2018/03/26 17:10:18 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000004ffb)='task\x00')
getdents64(r0, &(0x7f0000002000)=""/72, 0x48)

[   55.161882] skbuff: bad partial csum: csum=11240/260 len=3712
[   55.173953] binder: 7219:7241 BC_INCREFS_DONE u0000000000000000 no match
[   55.212316] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:18 executing program 6:
pipe2(&(0x7f0000fb0ff8)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
fcntl$setpipe(r1, 0x407, 0x0)
write$evdev(r1, &(0x7f00005d7fa0)=[{{0x77359400}}], 0x18)
vmsplice(r1, &(0x7f0000fccff0)=[{&(0x7f0000011fff)}], 0x1, 0x0)
vmsplice(r0, &(0x7f00004c0fd0)=[{&(0x7f0000165f90)="927d66e5e381cf4097f8000000feb41473dfde5668e10b0a", 0x18}], 0x1, 0x0)

2018/03/26 17:10:18 executing program 1:
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(0xffffffffffffffff, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:18 executing program 5:
r0 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000fb6000)=""/28, 0x1c)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a})
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1, @time={0x0, 0x1c9c380}})
ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000ec6fb0)={{}, {0x0, 0x2}})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0)

2018/03/26 17:10:18 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:18 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}})
r1 = syz_open_dev$sndtimer(&(0x7f0000022ff1)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f000000efcc)={{0x100000001}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3)

2018/03/26 17:10:18 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000018ff4)={0x10}, 0xc, &(0x7f0000013ff1)={&(0x7f0000000140)={0x20, 0x26, 0x1, 0x0, 0x0, {0x1}, [@typed={0xc, 0x0, @u64=0x6}]}, 0x20}, 0x1}, 0x0)

2018/03/26 17:10:18 executing program 0:
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x2)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000180)={0x0, 0x7, "c85de82b0401a7"}, &(0x7f0000000080)=0xf)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x4001})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201})
write(r1, &(0x7f0000000180), 0xff4d)

2018/03/26 17:10:18 executing program 3:
openat$sequencer2(0xffffffffffffff9c, &(0x7f000042a000)='/dev/sequencer2\x00', 0x2, 0x0)

2018/03/26 17:10:18 executing program 4:
r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0)
add_key$user(&(0x7f0000c24ffb)='user\x00', &(0x7f00003ebffb)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000d6c000)='\x00', 0x1, r1)
request_key(&(0x7f0000a98ffb)='user\x00', &(0x7f0000626000)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000dde000)="2f6465612f7675746f66730719", 0x0)

2018/03/26 17:10:18 executing program 1:
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(0xffffffffffffffff, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:18 executing program 3:
r0 = socket$inet(0x10, 0x3, 0x4)
sendmsg(r0, &(0x7f0000014000)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff10fffefd956fa283b70aa6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d4c1cbc882b079881", 0x4c}], 0x1}, 0x0)

2018/03/26 17:10:18 executing program 2:
r0 = socket$nl_generic(0x2, 0x3, 0x10)
read(r0, &(0x7f0000000400)=""/210, 0xd2)
sendmsg$IPVS_CMD_DEL_SERVICE(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x2}, 0x2000000c, &(0x7f0000000200)={&(0x7f0000000080)={0x14, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x14}, 0x1}, 0x0)

[   55.361603] binder: 7257:7259 transaction failed 29189/-22, size 40-8 line 3011
[   55.394980] skbuff: bad partial csum: csum=11240/260 len=3712
2018/03/26 17:10:18 executing program 6:
syz_open_procfs(0x0, &(0x7f0000834ff3)='net/if_inet6\x00')

2018/03/26 17:10:18 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000004ec0)={&(0x7f0000004e00)={0x10}, 0xc, &(0x7f0000004e80)={&(0x7f0000004e40)={0x14, 0x0, 0x0, 0x0, 0x0, {0x10}}, 0x14}, 0x10, 0xfffffffffffff000, 0x7fffefec}, 0x0)

[   55.405410] binder: 7257:7273 BC_INCREFS_DONE u0000000000000000 no match
2018/03/26 17:10:18 executing program 1:
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(0xffffffffffffffff, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:18 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:18 executing program 4:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x4e, &(0x7f0000000000)={0x0, 'ip6_vti0\x00'}, 0x3)

2018/03/26 17:10:18 executing program 3:
kexec_load(0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000040)}], 0x3e0000)

[   55.450570] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:18 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0)
chroot(&(0x7f000009a000)='./file0\x00')
chdir(&(0x7f0000cd2ff8)='./file0\x00')
symlink(&(0x7f0000000140)='..', &(0x7f0000272ff7)='../file0\x00')
mount(&(0x7f0000fb6000)='./file0\x00', &(0x7f0000d78000)='.', &(0x7f0000000400)='ubifs\x00', 0x1004, 0x0)

2018/03/26 17:10:18 executing program 6:
socket$netlink(0x10, 0x3, 0x1f)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbcfc8)={0x0, 0x0, &(0x7f0000fa3ff0), 0x0, &(0x7f00000000c0)=ANY=[]}, 0x0)

2018/03/26 17:10:18 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, 0x1c)
getpeername(r0, &(0x7f0000000080)=@ipx, &(0x7f0000000100)=0x80)

2018/03/26 17:10:18 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:18 executing program 5:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$int_in(r0, 0x5452, &(0x7f0000000080)=0x5)
sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback=0x7f000001}, 0x10)

2018/03/26 17:10:18 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:18 executing program 4:
getegid()

2018/03/26 17:10:18 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket(0x11, 0x803, 0x0)
mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20013, r0, 0x0)

[   55.503803] binder: 7289:7291 transaction failed 29189/-22, size 40-8 line 3011
[   55.530890] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:19 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040))
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:19 executing program 6:
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0)
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x84, 0x7d, &(0x7f0000000000), &(0x7f0000000040)=0x30)

2018/03/26 17:10:19 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip6_tables_matches\x00')
sendfile(r0, r0, &(0x7f0000301ff8)=0x9, 0xffffffff)

2018/03/26 17:10:19 executing program 3:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f00005d6000)='/dev/sequencer\x00', 0x0, 0x0)
r0 = syz_open_dev$sndtimer(&(0x7f00000b5ff1)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}})

2018/03/26 17:10:19 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:19 executing program 4:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
r1 = epoll_create(0x5)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c3bff4))

[   55.605046] binder: 7306:7311 BC_INCREFS_DONE u0000000000000000 node 101 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:19 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(0xffffffffffffffff, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:19 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='comm\x00')
read(r0, &(0x7f0000000180)=""/241, 0xf1)

2018/03/26 17:10:19 executing program 3:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f000082ef0a)=""/246)

2018/03/26 17:10:19 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)})
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

2018/03/26 17:10:19 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip6_tables_matches\x00')
sendfile(r0, r0, &(0x7f0000301ff8)=0x9, 0xffffffff)

2018/03/26 17:10:19 executing program 3:
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip6_tables_matches\x00')
sendfile(r0, r0, &(0x7f0000301ff8)=0x9, 0xffffffff)

[   55.712388] binder: 7333:7336 BC_INCREFS_DONE u0000000000000000 node 102 cookie mismatch 0000000000000001 != 0000000000000000
[   55.750598] binder: release 7343:7347 transaction 103 out, still active
2018/03/26 17:10:19 executing program 0:
pipe(&(0x7f0000055000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
pipe(&(0x7f0000041000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
writev(r3, &(0x7f000000b000)=[{&(0x7f0000066000)=',', 0x1}], 0x1)
tee(r2, r1, 0x5, 0x0)
vmsplice(r0, &(0x7f0000002200)=[{&(0x7f00000021c0)=']', 0x1}], 0x1, 0x0)

2018/03/26 17:10:19 executing program 1:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x2691d0877f1cca9b})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201})

2018/03/26 17:10:19 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000024000)={0x10}, 0xc, &(0x7f0000023ff0)={&(0x7f0000010ec4)={0x20, 0x2b, 0xaff, 0x0, 0x0, {0x3}, [@nested={0xc, 0x0, [@typed={0x8, 0x1, @binary='\bTT'}]}]}, 0x20}, 0x1}, 0x0)

2018/03/26 17:10:19 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:19 executing program 5:
r0 = socket$inet6(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f000044f000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x63, [], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, &(0x7f00000002c0))

[   55.760527] binder: send failed reply for transaction 103, target dead
[   55.798140] binder: undelivered TRANSACTION_COMPLETE
[   55.808123] binder: 7343:7347 transaction failed 29189/-22, size 0-0 line 3011
[   55.842531] binder: undelivered TRANSACTION_ERROR: 29189
[   55.846432] binder: 7365:7367 BC_INCREFS_DONE u0000000000000000 node 105 cookie mismatch 0000000000000001 != 0000000000000000
[   55.860877] TCP: request_sock_TCPv6: Possible SYN flooding on port 20000. Sending cookies.  Check SNMP counters.
2018/03/26 17:10:19 executing program 6:
r0 = socket$packet(0x11, 0x10000000002, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'gre0\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000001200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2}}, 0x14)
sendmmsg(r0, &(0x7f0000003080)=[{{&(0x7f00000000c0)=@ll={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14, &(0x7f0000000480), 0x0, &(0x7f0000000500)}}, {{0x0, 0x0, &(0x7f0000002940), 0x0, &(0x7f0000002980)}}], 0x2, 0x0)

2018/03/26 17:10:19 executing program 3:
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00006ee000)='/dev/rfkill\x00', 0x0, 0x0)
readv(r0, &(0x7f000010afb0)=[{&(0x7f00007f3fe6)=""/26, 0x1a}], 0x1)
ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000007ffc)={&(0x7f0000000000/0x2000)=nil, 0x2000})

2018/03/26 17:10:19 executing program 2:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f000039c000)=0x400000000000001, 0x4)
setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f00000b2000)=0xffffffffffffffff, 0x4)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000b72ffb)='nv\x00', 0x3)
sendto$inet(r0, &(0x7f0000a92000), 0x0, 0x800000020000000, &(0x7f0000303000)={0x2, 0x0, @loopback=0x7f000001}, 0x10)

2018/03/26 17:10:19 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:19 executing program 4:
mmap(&(0x7f0000000000/0x709000)=nil, 0x709000, 0x0, 0x44031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f000007d000/0x2000)=nil, 0x2000, 0x1000000000008)

2018/03/26 17:10:19 executing program 5:
mkdir(&(0x7f0000027000)='./file0\x00', 0x0)
mount(&(0x7f0000018000)='./file0\x00', &(0x7f000001c000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x0, &(0x7f000000a000))
mount(&(0x7f0000033ff4)='./file0/bus\x00', &(0x7f000000fff8)='./file0\x00', &(0x7f0000032ffb)='fuse\x00', 0x7ffbf, &(0x7f0000032000))

2018/03/26 17:10:19 executing program 1:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x2691d0877f1cca9b})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201})

2018/03/26 17:10:19 executing program 0:
pipe(&(0x7f0000055000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
pipe(&(0x7f0000041000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
writev(r3, &(0x7f000000b000)=[{&(0x7f0000066000)=',', 0x1}], 0x1)
tee(r2, r1, 0x5, 0x0)
vmsplice(r0, &(0x7f0000002200)=[{&(0x7f00000021c0)=']', 0x1}], 0x1, 0x0)

2018/03/26 17:10:19 executing program 4:
r0 = socket$inet6(0xa, 0x805, 0x0)
setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000068fe8)="ff0204000000000100000000000000000000000000000205", 0x18)

2018/03/26 17:10:19 executing program 0:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
setsockopt$sock_int(r0, 0x1, 0x2c, &(0x7f0000000600)=0xfffffffffffffff9, 0x4)

2018/03/26 17:10:19 executing program 5:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='7', 0x1)

2018/03/26 17:10:19 executing program 2:
r0 = socket$unix(0x1, 0x1, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/unix\x00')
sendfile(r0, r1, &(0x7f0000000000), 0xff)

2018/03/26 17:10:19 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

[   56.043347] binder: 7377:7387 BC_INCREFS_DONE u0000000000000000 node 106 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:19 executing program 0:
r0 = memfd_create(&(0x7f0000000140)='dev ', 0x0)
pwritev(r0, &(0x7f0000000640)=[{&(0x7f00000003c0)}, {&(0x7f0000000580)="1c21e455675d8e243ddb0b82c64b3da4ea57beafcfd714d7c094e3af6858a50607cb373935002315b68e94d7de7bb6359d95405c55618f5040260cbca86114f5d54bc15f940f9802b3c0e1b619484fd9891a6f8c0ea024936760fc1db6afc46a0b30218ddddef38de38087b5988828a5fb2a2ef04d0ec42b2535c5a5c83836c835a003d216e210d44275a9eb0250f8a562b60c3c434a", 0x96}], 0x2, 0x0)

2018/03/26 17:10:19 executing program 3:
r0 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$unlink(0x17, r0, 0x0)

[   56.106440] binder: 7400:7403 BC_INCREFS_DONE u0000000000000000 node 107 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:19 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000840)='./cgroup\x00', 0x200002, 0x0)
r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
read(r1, &(0x7f0000000300)=""/232, 0x744)

2018/03/26 17:10:19 executing program 4:
r0 = socket$inet(0x2, 0x803, 0x5)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000680)={0x11, @multicast2=0xe0000002, 0x0, 0x0, 'lc\x00', 0x2a, 0x8, 0x2c}, 0x2c)

2018/03/26 17:10:19 executing program 2:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000fc3ff8)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = fcntl$dupfd(r0, 0x0, r1)
sendmsg$nl_route(r2, &(0x7f0000cc1000)={&(0x7f0000fc2ff4)={0x10}, 0x3, &(0x7f0000fc2000)={&(0x7f000009d000)=@setlink={0x20, 0x13}, 0xfff7}, 0x1}, 0x0)

2018/03/26 17:10:19 executing program 5:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='7', 0x1)

2018/03/26 17:10:19 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:19 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
times(&(0x7f0000000300))

2018/03/26 17:10:19 executing program 3:
socketpair$inet(0x1e, 0x1, 0x0, &(0x7f00001b6ff8)={<r0=>0x0, <r1=>0x0})
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4)
sendmsg$key(r1, &(0x7f0000d4c000)={0x0, 0x0, &(0x7f000089c000)={&(0x7f0000e6ce08)={0x2, 0x0, 0x0, 0x0, 0x2}, 0xffffffa3}, 0x1}, 0x0)

2018/03/26 17:10:19 executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00006ffff8)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$int_in(r0, 0x5452, &(0x7f0000cfbff8)=0x1)
sendmmsg$unix(r0, &(0x7f00000bd000), 0x80, 0x0)
poll(&(0x7f0000e0b000)=[{r0, 0x6100}], 0x1, 0x0)

[   56.283868] binder: 7418:7423 BC_INCREFS_DONE u0000000000000000 node 108 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:19 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x6, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00', 0x20, 0x1, 0x230, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000040], 0x0, &(0x7f0000000000), &(0x7f0000000040)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x15, 0x0, 0x8100, 'yam0\x00', 'bcsf0\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xe0, 0x168, 0x1a0, [@time={'time\x00', 0x18}, @vlan={'vlan\x00', 0x8}]}, [@common=@mark={'mark\x00', 0x10, {{0x0, 0xfffffffffffffffc}}}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}]}, @common=@mark={'mark\x00', 0x10, {{0x0, 0xfffffffffffffffd}}}}]}]}, 0x258)

2018/03/26 17:10:19 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x0, 0x0)
preadv(r0, &(0x7f00000008c0)=[{&(0x7f00000007c0)=""/255, 0xff}], 0x1, 0x0)

2018/03/26 17:10:19 executing program 0:
r0 = open(&(0x7f0000ae8ff8)='./file0\x00', 0x14104a, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x1, 0x101002)
write$evdev(r0, &(0x7f0000037fe8)=[{{}, 0x1, 0x76, 0x2}, {{0x0, 0x2}}], 0x30)
sendfile(r1, r0, &(0x7f0000000000), 0x100000001)

2018/03/26 17:10:19 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000), &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:19 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f000060cff8)='/', 0x0, 0x0)
getdents(r0, &(0x7f000056a000)=""/210, 0xd2)
close(r0)

2018/03/26 17:10:19 executing program 6:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = getpid()
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, r0, 0x0, 0xffffffffffffffff, 0x0)

2018/03/26 17:10:19 executing program 3:
r0 = socket$inet(0x2, 0x200000000000006, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x0, 0x2b}, 0x0, @in6=@remote={0xfe, 0x80, [], 0xbb}}}, 0xe8)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000e40)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0)

2018/03/26 17:10:19 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPVS_CMD_DEL_SERVICE(r0, &(0x7f0000003bc0)={&(0x7f0000002740)={0x10}, 0xc, &(0x7f0000003b80)={&(0x7f0000002780)={0x14, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x10a}, 0x0)

2018/03/26 17:10:19 executing program 1:
mknod$loop(&(0x7f00000002c0)='./file0\x00', 0x2001, 0xffffffffffffffff)
execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180), &(0x7f00000000c0))

2018/03/26 17:10:19 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x0, 0x0)
preadv(r0, &(0x7f00000008c0)=[{&(0x7f00000007c0)=""/255, 0xff}], 0x1, 0x0)

2018/03/26 17:10:19 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f000060cff8)='/', 0x0, 0x0)
getdents(r0, &(0x7f000056a000)=""/210, 0xd2)
close(r0)

2018/03/26 17:10:19 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000cb9ffc)=0x1, 0x4)
bind$inet(r0, &(0x7f0000c16ff0)={0x2, 0x1, @multicast1=0xe0000001}, 0x10)
socket$packet(0x11, 0x3, 0x300)
sendto$inet(r0, &(0x7f0000fa0fff), 0xffffffffffffffc3, 0x20020007, &(0x7f0000e97fcf)={0x2, 0x1, @loopback=0x7f000001}, 0x10)

2018/03/26 17:10:19 executing program 1:
sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000289000)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000058000)={&(0x7f000023f000)=ANY=[@ANYBLOB="840008000000000000bd7000ffffffff0000fffc0c00000000000000000000005b659a62290ffc380c2dbfdc5e9f13e1a04810d464fbc3b4c1b4e2bf501fb101040000000000004d9f04005e66cd4dd3050bc1700612dbc3080c91745fa158cf0d70309f7f1969136edfd73294c0356675ffff000044f2a432a15b4ce56aa16603000d"], 0x83}, 0x1}, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f000023f000)=0xa, 0x263)

[   56.392557] binder: 7442:7449 got transaction with invalid offset (0, min 0 max 0) or object.
[   56.426413] binder: 7442:7449 transaction failed 29201/-22, size 0-8 line 3197
2018/03/26 17:10:19 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000088cff6)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000740)=0x2)
ioctl$TCSETA(r0, 0x5406, &(0x7f0000003740))

2018/03/26 17:10:19 executing program 2:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000abd000), 0x4)

[   56.442130] binder: 7442:7464 BC_INCREFS_DONE u0000000000000000 node 109 cookie mismatch 0000000000000001 != 0000000000000000
[   56.506651] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/26 17:10:19 executing program 5:
r0 = inotify_init1(0x0)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
fcntl$getownex(r0, 0x10, &(0x7f00000001c0)={0x0, <r1=>0x0})
setpgid(0x0, r1)

2018/03/26 17:10:19 executing program 3:
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000d81ff8)=0x101)
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0)
write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f00000000c0)='./control/file0\x00')
rmdir(&(0x7f000015dff6)='./control\x00')
close(r1)

2018/03/26 17:10:19 executing program 4:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000088cff6)='/dev/ptmx\x00', 0x1, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b3fdc))
write(r0, &(0x7f000054bfba)="4f7ad0c9edb302486f1748144523c0c253773e00d49ba39063e2432e8de58f5930fd07000000dcf50bbc54b70c0ea17b4728dde5f9eedfc811ff1f75642558334444c9fe3d13", 0x46)
r1 = syz_open_pts(r0, 0x0)
ioctl$TCSETS(r1, 0x5412, &(0x7f00000000c0)={0x13})

2018/03/26 17:10:19 executing program 2:
r0 = open(&(0x7f00007e2ff8)='./file0\x00', 0x80040, 0x0)
r1 = open(&(0x7f00007e2ff8)='./file0\x00', 0x0, 0x0)
fcntl$setlease(r1, 0x400, 0x0)
fcntl$setlease(r0, 0x400, 0x0)
open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0)

2018/03/26 17:10:19 executing program 0:
r0 = socket$inet6(0xa, 0x80001, 0x0)
setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88)
setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, 0x0, 0x4, [{{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}]}, 0x290)

2018/03/26 17:10:19 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000cb9ffc)=0x1, 0x4)
bind$inet(r0, &(0x7f0000c16ff0)={0x2, 0x1, @multicast1=0xe0000001}, 0x10)
socket$packet(0x11, 0x3, 0x300)
sendto$inet(r0, &(0x7f0000fa0fff), 0xffffffffffffffc3, 0x20020007, &(0x7f0000e97fcf)={0x2, 0x1, @loopback=0x7f000001}, 0x10)

2018/03/26 17:10:19 executing program 1:
mknod(&(0x7f0000000000)='./file0\x00', 0xc000, 0x0)
open(&(0x7f00000001c0)='./file0\x00', 0x2, 0x0)

2018/03/26 17:10:19 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000), &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:20 executing program 1:
r0 = memfd_create(&(0x7f0000000080)="6d81351e39cfc228a4c67200", 0x0)
pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000100)=';', 0x1}], 0x1, 0x0)

2018/03/26 17:10:20 executing program 5:
r0 = socket(0x1f, 0x2000000000000005, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, {}, 0x0, 0x1}, 0xe)

[   56.601349] binder: 7495:7498 got transaction with invalid offset (0, min 0 max 0) or object.
[   56.638640] binder: 7495:7498 transaction failed 29201/-22, size 0-8 line 3197
2018/03/26 17:10:20 executing program 0:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl(r0, 0x8b0c, &(0x7f0000000240))

2018/03/26 17:10:20 executing program 4:
r0 = socket$inet(0x11, 0x40000000000803, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x107, 0xf, &(0x7f00000001c0)=@broute={'broute\x00', 0x20, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000100], 0x0, &(0x7f0000000040), &(0x7f0000000100)=ANY=[]}, 0x50)
recvmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000580), 0x0, &(0x7f00000000c0)=""/34, 0x22}, 0x0)
sendmsg(r0, &(0x7f000087dfc8)={&(0x7f000005e000)=@in6={0xa, 0x0, 0x2, @local={0xfe, 0x80, [], 0xaa}}, 0x80, &(0x7f0000000380), 0x3c5}, 0x0)

2018/03/26 17:10:20 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000), &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:20 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a}, &(0x7f0000000180)='<', 0x1, 0xfffffffffffffffd)

2018/03/26 17:10:20 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000088cff6)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b3fdc))
r1 = syz_open_pts(r0, 0x0)
ioctl$TCSETS(r1, 0x5412, &(0x7f00000000c0)={0x17})

2018/03/26 17:10:20 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip6_mr_vif\x00')
preadv(r0, &(0x7f0000b24fb0)=[{&(0x7f0000830000)=""/4096, 0x1000}], 0x1, 0x2)

[   56.639844] binder: 7495:7511 BC_INCREFS_DONE u0000000000000000 node 111 cookie mismatch 0000000000000001 != 0000000000000000
[   56.666390] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/26 17:10:20 executing program 6:
r0 = syz_fuseblk_mount(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r0)

2018/03/26 17:10:20 executing program 3:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendmmsg$inet_sctp(r0, &(0x7f000093eee8)=[{&(0x7f00001f6000)=@in={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10, &(0x7f00000011c0)=[{&(0x7f0000000100)='n', 0x1}], 0x1, &(0x7f0000000380)=[@init={0x18, 0x84, 0x0, {0xffffffffffffffc0, 0x1, 0x41f0, 0x7fff}}], 0x30}, {&(0x7f0000957ff0)=@in={0x2, 0x0, @multicast2=0xe0000002}, 0x10, &(0x7f000093e000), 0x0, &(0x7f000093ef10)=[@sndinfo={0x20, 0x84, 0x2}], 0x30}], 0x2, 0x0)

2018/03/26 17:10:20 executing program 2:
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000040)={0x7, 0x0, 0x2, 0x49})
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0)
ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x4028700f, &(0x7f0000000040))
read(0xffffffffffffffff, &(0x7f0000000080)=""/224, 0xe0)

2018/03/26 17:10:20 executing program 5:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='bbr\x00', 0x4)

2018/03/26 17:10:20 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000948fee)='/dev/input/event#\x00', 0x0, 0x0)
r1 = dup(r0)
ioctl$TIOCSBRK(r1, 0x80084504)

[   56.722060] binder: 7529:7531 got transaction with invalid offset (0, min 0 max 0) or object.
[   56.733117] binder: 7529:7531 transaction failed 29201/-22, size 0-8 line 3197
[   56.781242] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/26 17:10:20 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x10e, 0x3, &(0x7f0000000500)={{0x0, @multicast1=0xe0000001, 0x0, 0x0, 'sed\x00'}, {@loopback=0x7f000001}}, 0x3)

2018/03/26 17:10:20 executing program 4:
r0 = socket(0x1f, 0x2000000000000005, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x80, {}, 0x1}, 0xe)

2018/03/26 17:10:20 executing program 1:
r0 = socket$inet(0x2, 0x80001, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x3, 0x14d0, [0x20000200, 0x0, 0x0, 0x20000c08, 0x20000c38], 0x0, &(0x7f00000001c0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'bcsf0\x00', 'bond0\x00', 'ip6_vti0\x00', 'ifb0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @link_local={0x1, 0x80, 0xc2}, [], 0x9a0, 0x9a0, 0x9d8, [@among={'among\x00', 0x898, {{0x0, 0x14ac00000, 0x0, {[], 0x3, [{[], @multicast2=0xe0000002}, {[], @rand_addr}, {[], @rand_addr}]}, {[], 0x7, [{[], @dev={0xac, 0x14, 0x14}}, {[], @remote={0xac, 0x14, 0x14, 0xbb}}, {[], @dev={0xac, 0x14, 0x14}}, {[], @rand_addr}, {[], @broadcast=0xffffffff}, {[], @multicast2=0xe0000002}, {[], @remote={0xac, 0x14, 0x14, 0xbb}}]}}}}, @stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], 0x0, 0x0, 0x0, 0x0, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}}}]}}, @arpreply={'arpreply\x00', 0x10, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x2, [{{{0x7, 0x0, 0x0, 'ip_vti0\x00', 'teql0\x00', 'vlan0\x00', 'gre0\x00', @random="6631168998f8", [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x70, 0xc0}}, @common=@LED={'LED\x00', 0x28, {{'syz1\x00'}}}}, {{{0x7, 0x0, 0x0, 'gre0\x00', 'gretap0\x00', 'sit0\x00', 'syzkaller1\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x8f0, 0x970, 0x9a8, [@among={'among\x00', 0x858, {{0x0, 0x0, 0x0, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0x4, [{}, {[], @local={0xac, 0x14, 0x14, 0xaa}}, {}, {[], @loopback=0x7f000001}]}, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x1, [{[], @loopback=0x7f000001}]}}}}]}, [@common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}, @common=@redirect={'redirect\x00', 0x8}]}, @arpreply={'arpreply\x00', 0x10}}]}]}, 0x14e8)

2018/03/26 17:10:20 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:20 executing program 2:
syz_open_procfs(0x0, &(0x7f000078e000)='net/dev\x00')

2018/03/26 17:10:20 executing program 6:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000680)={&(0x7f0000000180)={0x10}, 0xc, &(0x7f0000000640)={&(0x7f0000000380)=@updpolicy={0xb8, 0x1d, 0x11, 0x0, 0x0, {{@in=@remote={0xac, 0x14, 0x14, 0xbb}, @in=@remote={0xac, 0x14, 0x14, 0xbb}}}}, 0xb8}, 0x1}, 0x0)

2018/03/26 17:10:20 executing program 3:
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x840, 0x0)

2018/03/26 17:10:20 executing program 5:
r0 = socket$netlink(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000024000)={0x10}, 0xc, &(0x7f0000023ff0)={&(0x7f0000010ec4)={0x1c, 0x1f, 0xaff, 0x0, 0x0, {0x2}, [@nested={0x8, 0x1, [@typed={0x4, 0x1, @binary}]}]}, 0x1c}, 0x1}, 0x0)

2018/03/26 17:10:20 executing program 5:
r0 = socket$inet(0xa, 0x5, 0x0)
bind$netlink(r0, &(0x7f0000000040)={0xa}, 0x10)

2018/03/26 17:10:20 executing program 2:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x1a, &(0x7f0000000000)={0x0, 'ip6_vti0\x00'}, 0x3)

2018/03/26 17:10:20 executing program 0:
r0 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0xa}, 0x1c)
sendmsg$key(r0, &(0x7f0000006fc8)={0x20480, 0x0, &(0x7f0000006000)={&(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in6=@remote={0xfe, 0x80, [], 0xbb}, @in=@multicast1=0xe0000001}}]}, 0x50}, 0x1}, 0x0)

2018/03/26 17:10:20 executing program 3:
ioctl$sock_SIOCGSKNS(0xffffffffffffffff, 0x894c, &(0x7f0000000080))
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sync()

[   56.960035] binder: 7558:7564 BC_INCREFS_DONE u0000000000000000 node 115 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:20 executing program 6:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x4}, 0x1c)
connect$inet6(r0, &(0x7f0000e78fe4)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}}, 0x1c)

2018/03/26 17:10:20 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f000001bfc8)={&(0x7f00007a9000)={0x10}, 0xc, &(0x7f000000b000)={&(0x7f00006c1000)=@ipv6_newroute={0x1c, 0x18, 0x501, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x1c}, 0x1}, 0x0)

2018/03/26 17:10:20 executing program 4:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00008f0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000510ffc)=0x1b)

2018/03/26 17:10:20 executing program 5:
r0 = memfd_create(&(0x7f0000000040)='userloppp1ptoc\'\x00', 0x6)
fcntl$addseals(r0, 0x409, 0xa)

2018/03/26 17:10:20 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:20 executing program 0:
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
add_key$user(&(0x7f00003bd000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000facfff), 0x0, 0x0)

2018/03/26 17:10:20 executing program 3:
mkdir(&(0x7f0000000200)='./file0\x00', 0x0)
mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000340)='devtmpfs\x00', 0x200001, &(0x7f0000000000)="e996e7891844de7c2c")

2018/03/26 17:10:20 executing program 2:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x1a, &(0x7f0000000000)={0x0, 'ip6_vti0\x00'}, 0x3)

[   57.052009] binder: release 7558:7564 transaction 116 out, still active
[   57.063472] binder: undelivered TRANSACTION_COMPLETE
[   57.071677] binder: send failed reply for transaction 116, target dead
2018/03/26 17:10:20 executing program 3:
request_key(&(0x7f0000000000)='encrypted\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000080)='\x00', 0xfffffffffffffffe)

2018/03/26 17:10:20 executing program 0:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000001000)={0x1, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}}}}, 0x108)

2018/03/26 17:10:20 executing program 5:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
getsockopt$bt_hci(r0, 0x107, 0xb, &(0x7f0000000000)=""/25, &(0x7f0000000240)=0x4)

2018/03/26 17:10:20 executing program 1:
socket$inet(0x2, 0x2, 0x88)

2018/03/26 17:10:20 executing program 2:
r0 = socket$inet(0xa, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x29, 0x1a, &(0x7f0000000000)={0x0, 'ip6_vti0\x00'}, 0x3)

2018/03/26 17:10:20 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x48200}, 0xc)
bind$netlink(r0, &(0x7f0000001000)={0x10}, 0xc)

[   57.148338] binder: 7599:7605 BC_INCREFS_DONE u0000000000000000 node 117 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:20 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:20 executing program 6:
clone(0x0, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140), &(0x7f0000000080))
wait4(0x0, &(0x7f0000000100), 0x40000002, 0x0)

[   57.205221] binder: release 7599:7605 transaction 118 out, still active
[   57.212498] binder: undelivered TRANSACTION_COMPLETE
[   57.220542] binder: send failed reply for transaction 118, target dead
2018/03/26 17:10:20 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x8000000010)
sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00002daff0)={&(0x7f000062d000)={0x14, 0x20, 0x80afb, 0x0, 0x0, {0x3}}, 0x14}, 0x1}, 0x0)

2018/03/26 17:10:20 executing program 3:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x79, &(0x7f0000908000), 0xc)

2018/03/26 17:10:20 executing program 5:
timer_create(0x0, &(0x7f00000012c0)={0x0, 0x0, 0x1, @thr={&(0x7f00000011c0), &(0x7f0000001240)}}, &(0x7f0000001300))
timer_settime(0x0, 0x0, &(0x7f0000001380), &(0x7f00000013c0))

2018/03/26 17:10:20 executing program 4:
socket$inet6(0xa, 0x803, 0x4000000000000001)

2018/03/26 17:10:20 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x10e, 0x5, &(0x7f0000000500)={{0x0, @multicast1=0xe0000001, 0x0, 0x0, 'sed\x00'}, {@loopback=0x7f000001}}, 0x44)

2018/03/26 17:10:20 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:20 executing program 6:
perf_event_open(&(0x7f0000014f88)={0x1, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
readv(0xffffffffffffffff, &(0x7f0000000440), 0x0)

2018/03/26 17:10:20 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newroute={0x24, 0x18, 0x101, 0x0, 0x0, {0x2}, [@RTA_GATEWAY={0x8, 0xf, @dev={0xac, 0x14, 0x14}}]}, 0x24}, 0x1}, 0x0)

[   57.264160] binder: 7626:7634 BC_INCREFS_DONE u0000000000000000 node 119 cookie mismatch 0000000000000001 != 0000000000000000
[   57.297814] binder: release 7626:7634 transaction 120 out, still active
[   57.308323] binder: undelivered TRANSACTION_COMPLETE
2018/03/26 17:10:20 executing program 4:
r0 = socket$inet(0x2, 0x801, 0x0)
connect$netlink(r0, &(0x7f0000000000)=@kern={0x10}, 0xc)

2018/03/26 17:10:20 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x2, 0x2, 0x0)
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x2, r0, &(0x7f000003cff4))

2018/03/26 17:10:20 executing program 2:
r0 = socket(0x1f, 0x2000000000000005, 0x0)
setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0xa, &(0x7f00000001c0), 0x4)

2018/03/26 17:10:20 executing program 0:
mkdir(&(0x7f0000b08ff8)='./file0\x00', 0x0)
chroot(&(0x7f00008b4000)='./file0\x00')
mount(&(0x7f0000451ff8)='./file0\x00', &(0x7f000069cff8)='./file1\x00', &(0x7f0000847000)="07e372f2", 0x0, &(0x7f000012c000))
mount(&(0x7f000097fff8)='./file0\x00', &(0x7f0000a51ff8)='./file0\x00', &(0x7f00002d6ffd)='9p\x00', 0x5000, 0x0)
pivot_root(&(0x7f0000857ff8)='./file0\x00', &(0x7f0000a96ff8)='./file0\x00')

2018/03/26 17:10:20 executing program 1:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(r0, 0x8b2b, &(0x7f0000000240))

2018/03/26 17:10:20 executing program 6:
r0 = socket$inet(0x2, 0x5, 0x0)
getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x84, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0x3)

[   57.332048] binder: send failed reply for transaction 120, target dead
2018/03/26 17:10:20 executing program 3:
r0 = socket$inet(0xa, 0x5, 0x0)
bind$netlink(r0, &(0x7f0000000040)={0xa}, 0x1c)
bind$netlink(r0, &(0x7f0000000000)={0x10}, 0xc)

2018/03/26 17:10:20 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(r1)
setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x1}, 0x10)
socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
close(r3)
setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0xfffffffffffffffe, 0x1}, 0x10)

2018/03/26 17:10:20 executing program 4:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x78, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r0, &(0x7f0000e92000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x2}}, 0x2e)
close(r0)

2018/03/26 17:10:20 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

[   57.394868] binder: 7652:7657 BC_INCREFS_DONE u0000000000000000 node 121 cookie mismatch 0000000000000001 != 0000000000000000
[   57.427503] binder: release 7652:7657 transaction 122 out, still active
2018/03/26 17:10:20 executing program 2:
r0 = perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$setownex(r0, 0xf, &(0x7f0000000140))

2018/03/26 17:10:20 executing program 1:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(r0, 0x8b2b, &(0x7f0000000240))

[   57.454722] binder: unexpected work type, 4, not freed
[   57.475707] binder: undelivered TRANSACTION_COMPLETE
[   57.489713] binder: 7681:7684 BC_INCREFS_DONE u0000000000000000 node 125 cookie mismatch 0000000000000001 != 0000000000000000
[   57.510599] binder: send failed reply for transaction 122, target dead
[   57.527838] binder: release 7681:7684 transaction 126 out, still active
[   57.554795] binder: unexpected work type, 4, not freed
[   57.567953] binder: undelivered TRANSACTION_COMPLETE
2018/03/26 17:10:21 executing program 5:
ioprio_get$pid(0x1, 0xffffffffffffffff)

2018/03/26 17:10:21 executing program 6:
r0 = socket$inet(0x2, 0x6, 0x0)
getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x10d, 0xc0, &(0x7f0000000000), &(0x7f0000000040)=0xc)

2018/03/26 17:10:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:21 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000680)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
mmap$binder(&(0x7f0000ffb000/0x5000)=nil, 0x5000, 0x0, 0x12, r0, 0x0)

2018/03/26 17:10:21 executing program 1:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(r0, 0x8b2b, &(0x7f0000000240))

2018/03/26 17:10:21 executing program 3:
r0 = syz_open_procfs(0x0, &(0x7f000045cffd)='ns\x00')
getdents(r0, &(0x7f0000000fd6)=""/24, 0x18)

2018/03/26 17:10:21 executing program 0:
r0 = syz_open_dev$urandom(&(0x7f0000c4f000)='/dev/urandom\x00', 0x0, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42c01)
r1 = syz_open_dev$random(&(0x7f0000000ff4)='/dev/random\x00', 0x0, 0x0)
ioctl$int_in(r1, 0x5452, &(0x7f0000ca9ff8)=0xffffffffffff8001)
ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000000000)={0x6})

2018/03/26 17:10:21 executing program 4:
r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
mmap(&(0x7f0000007000/0x6000)=nil, 0x6000, 0x0, 0x11, r0, 0x0)

[   57.573585] binder: send failed reply for transaction 126, target dead
2018/03/26 17:10:21 executing program 5:
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={"d208d7f6300000ae000000880000e710", 0x101})

2018/03/26 17:10:21 executing program 1:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(r0, 0x8b2b, &(0x7f0000000240))

[   57.619859] binder: 7708:7710 BC_INCREFS_DONE u0000000000000000 node 129 cookie mismatch 0000000000000001 != 0000000000000000
[   57.634643] binder_alloc: binder_alloc_mmap_handler: 7713 20ffb000-21000000 already mapped failed -16
[   57.654542] binder: release 7708:7710 transaction 130 out, still active
[   57.672028] binder: unexpected work type, 4, not freed
[   57.677321] binder: undelivered TRANSACTION_COMPLETE
[   57.684265] binder: send failed reply for transaction 130, target dead
[   57.692428] binder_alloc: binder_alloc_mmap_handler: 7713 20ffb000-20ffd000 already mapped failed -16
2018/03/26 17:10:21 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00')
sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x14, r1, 0x401, 0x0, 0x0, {0xd}}, 0x14}, 0x1}, 0x0)

2018/03/26 17:10:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:21 executing program 4:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00001f0ff8)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0)
sendto$unix(r1, &(0x7f00004b9000), 0x0, 0x0, 0x0, 0x0)
close(r0)

2018/03/26 17:10:21 executing program 0:
getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000180), &(0x7f00000001c0)=0x14)

2018/03/26 17:10:21 executing program 6:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00008f0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3)

2018/03/26 17:10:21 executing program 1:
ioctl(0xffffffffffffffff, 0x8b2b, &(0x7f0000000240))

2018/03/26 17:10:21 executing program 5:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000564000)=@abs, 0x6e, &(0x7f0000451ff0)=[{&(0x7f0000007000)="002a932f01000000cf960802e02348f800000000001c0003f2a576", 0x1b}], 0x1, &(0x7f00001f9fe0)}, 0x0)
r0 = syz_open_dev$sg(&(0x7f00000c5ff7)='/dev/sg#\x00', 0x0, 0x0)
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000007000)={0x0, 0x0, 0x80da14, 0x8001, 0x20000000})
ioctl(r0, 0x2285, &(0x7f0000007000)='S')

2018/03/26 17:10:21 executing program 2:
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='/group.stat\x00', 0x2761, 0x0)
write$cgroup_pid(r0, &(0x7f00000000c0)=ANY=[], 0x68)
write(0xffffffffffffffff, &(0x7f0000000240)="f3", 0x1)

2018/03/26 17:10:21 executing program 1:
ioctl(0xffffffffffffffff, 0x8b2b, &(0x7f0000000240))

2018/03/26 17:10:21 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_generic(r0, &(0x7f000000d000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f000000d379)={&(0x7f000000c1a8)={0x20, 0x14, 0x21, 0x0, 0x0, {0x2}, [@nested={0xc, 0x0, [@typed={0x8, 0x6, @ipv4=@loopback=0x7f000001}]}]}, 0x20}, 0x1}, 0x0)

2018/03/26 17:10:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:21 executing program 6:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00008f0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3)

2018/03/26 17:10:21 executing program 1:
ioctl(0xffffffffffffffff, 0x8b2b, &(0x7f0000000240))

2018/03/26 17:10:21 executing program 2:
stat(&(0x7f0000000400)='./control/file1\x00', &(0x7f0000000440))
close(0xffffffffffffffff)

2018/03/26 17:10:21 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00')
sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x14, r1, 0x401, 0x0, 0x0, {0xd}}, 0x14}, 0x1}, 0x0)

2018/03/26 17:10:21 executing program 5:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f000042a000)='/dev/sequencer2\x00', 0x0, 0x0)
ioctl$TCSETA(r0, 0x5402, &(0x7f0000bd2000))

2018/03/26 17:10:21 executing program 0:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001f88)={0x200000000000001, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000fff)}}, 0x0, 0x0, r0, 0x0)

[   57.802436] binder: release 7739:7747 transaction 134 out, still active
[   57.811053] binder: unexpected work type, 4, not freed
[   57.819610] binder: undelivered TRANSACTION_COMPLETE
[   57.836411] binder: send failed reply for transaction 134, target dead
2018/03/26 17:10:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:21 executing program 4:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000088cff6)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b3fdc))
r1 = syz_open_pts(r0, 0x0)
ioctl$TCSETS(r1, 0x5412, &(0x7f00000000c0)={0x1c})

2018/03/26 17:10:21 executing program 1:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(0xffffffffffffffff, 0x8b2b, &(0x7f0000000240))

2018/03/26 17:10:21 executing program 3:
clock_getres(0x6, &(0x7f0000000180))

2018/03/26 17:10:21 executing program 2:
r0 = socket(0x15, 0x80005, 0x0)
getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x114, 0x2710, &(0x7f0000000040), &(0x7f0000000ff8)=0x4)

[   57.889033] binder: release 7762:7764 transaction 138 out, still active
[   57.905938] binder: unexpected work type, 4, not freed
[   57.951542] binder: undelivered TRANSACTION_COMPLETE
[   57.962636] binder: send failed reply for transaction 138, target dead
[   57.986731] binder: release 7773:7778 transaction 142 out, still active
2018/03/26 17:10:21 executing program 6:
ioprio_set$pid(0x0, 0x0, 0x23ee)

2018/03/26 17:10:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:21 executing program 5:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000240)={0x11, 0x0, r1, 0x1, 0x0, 0x6}, 0x14)
syz_emit_ethernet(0x56, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@canfd={0xd, {{}, 0x0, 0x0, 0x0, 0x0, "6328c5cd4b601a16b0b29a339cbdd8c76492d94405e86ee297ced571bf12e001a8e0edee037b4a15e43b711c1bf34419bdb00c3342326a7c0a24104b57647bf0"}}}}, &(0x7f0000000080))

2018/03/26 17:10:21 executing program 0:
r0 = socket$inet(0x2, 0x6, 0x0)
ioctl$sock_SIOCINQ(r0, 0x5452, &(0x7f0000000000))

2018/03/26 17:10:21 executing program 4:
r0 = socket$inet(0xa, 0x803, 0xb7)
getsockopt$IP_VS_SO_GET_DESTS(r0, 0x29, 0x1a, &(0x7f0000000180)=""/4096, &(0x7f0000001180)=0x1000)

2018/03/26 17:10:21 executing program 3:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0)
recvmmsg(r1, &(0x7f0000005940)=[{{0x0, 0x0, &(0x7f0000004180), 0x0, &(0x7f0000004240)=""/86, 0x56}}], 0x1, 0x0, 0x0)
connect$unix(r0, &(0x7f0000681000)=@abs, 0x8)

2018/03/26 17:10:21 executing program 1:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(0xffffffffffffffff, 0x8b2b, &(0x7f0000000240))

2018/03/26 17:10:21 executing program 2:
r0 = socket$inet6(0xa, 0x1, 0x8010000400000084)
bind$inet6(r0, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c)
shutdown(r0, 0x0)
sendto$inet6(r0, &(0x7f0000925000)="e0", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000f96000)={0x9}, 0xfe53)
close(r0)

2018/03/26 17:10:21 executing program 6:
r0 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000080)=0x1, 0x4)

[   58.011212] binder: unexpected work type, 4, not freed
[   58.016508] binder: undelivered TRANSACTION_COMPLETE
[   58.031580] binder: send failed reply for transaction 142, target dead
2018/03/26 17:10:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:21 executing program 4:
symlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00')
syz_fuse_mount(&(0x7f0000000180)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

2018/03/26 17:10:21 executing program 1:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(0xffffffffffffffff, 0x8b2b, &(0x7f0000000240))

2018/03/26 17:10:21 executing program 6:
socket$packet(0x11, 0xa, 0x300)
syz_emit_ethernet(0x2a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="6c9eee2d7bec", [], {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @multicast2=0xe0000002, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=0xffffffff}}}}, &(0x7f0000000140))

[   58.061799] binder: release 7788:7797 transaction 146 out, still active
[   58.072697] binder: unexpected work type, 4, not freed
2018/03/26 17:10:21 executing program 0:
r0 = syz_open_dev$binder(&(0x7f000000cff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100), 0xf, 0x0, &(0x7f0000000000)="62d6e104000000d4327af178305d6f"})

[   58.105179] binder: undelivered TRANSACTION_COMPLETE
2018/03/26 17:10:21 executing program 4:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f0000000040)='./bus\x00', 0x6042, 0x0)
fadvise64(r0, 0x0, 0x0, 0x0)

2018/03/26 17:10:21 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
prctl$setmm(0x23, 0x5, &(0x7f0000ffe000/0x1000)=nil)

2018/03/26 17:10:21 executing program 1:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(r0, 0x0, &(0x7f0000000240))

2018/03/26 17:10:21 executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCPKT(r0, 0x5420, &(0x7f00003b8ffc)=0x51)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00000002c0))
r1 = syz_open_pts(r0, 0x0)
ioctl$TCSETSF(r1, 0x5404, &(0x7f0000062000)={0xfffffdfd})

[   58.126619] binder: 7817:7822 BC_INCREFS_DONE u0000000000000000 node 149 cookie mismatch 0000000000000001 != 0000000000000000
[   58.138287] binder: send failed reply for transaction 146, target dead
[   58.163549] binder: 7827:7830 ioctl c0306201 20000000 returned -14
[   58.196797] binder: release 7817:7822 transaction 150 out, still active
[   58.207099] binder: unexpected work type, 4, not freed
[   58.225468] binder: undelivered TRANSACTION_COMPLETE
[   58.233051] binder: send failed reply for transaction 150, target dead
2018/03/26 17:10:21 executing program 3:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0)
recvmmsg(r1, &(0x7f0000005940)=[{{0x0, 0x0, &(0x7f0000004180), 0x0, &(0x7f0000004240)=""/86, 0x56}}], 0x1, 0x0, 0x0)
connect$unix(r0, &(0x7f0000681000)=@abs, 0x8)

2018/03/26 17:10:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:21 executing program 5:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendmsg$inet_sctp(r0, &(0x7f0000000340)={&(0x7f0000000080)=@in={0x2, 0x0, @rand_addr}, 0x10, &(0x7f0000000100), 0x0, &(0x7f0000000240)=[@init={0x18, 0x84, 0xf}], 0x30}, 0x0)

2018/03/26 17:10:21 executing program 4:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f6e65742f697076342f76732f73796e635f7468726573686f6c6400bf7956050224b756c63bfc477378350232509b7b38b3adffa319e718e9db27a59ed4e8720bc4cdfb78", 0x2, 0x0)
write(r0, &(0x7f00000000c0)='\t8\t\x00', 0x4)

2018/03/26 17:10:21 executing program 2:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x802, 0x4)
setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f000039c000)=0x400000000000001, 0x4)
setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f00000b2000)=0xffffffffffffffff, 0x4)
sendto$inet(r0, &(0x7f00005c9000), 0x252, 0x800000020000000, &(0x7f0000303000)={0x2, 0x0, @loopback=0x7f000001}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000965fec)={0x0, 0x800000000000852b, 0xffff}, 0x14)
writev(r0, &(0x7f0000000440)=[{&(0x7f0000000480)="b8", 0x1}], 0x1)

2018/03/26 17:10:21 executing program 0:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00005d6000)='/dev/sequencer\x00', 0x0, 0x0)
r1 = syz_open_dev$sndtimer(&(0x7f00000b5ff1)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}})
dup3(r0, r1, 0x0)

2018/03/26 17:10:21 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
prctl$seccomp(0x16, 0x1, &(0x7f00000001c0)={0x0, &(0x7f0000000180)})

2018/03/26 17:10:21 executing program 1:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(r0, 0x0, &(0x7f0000000240))

[   58.304214] binder: 7843:7848 BC_INCREFS_DONE u0000000000000000 node 153 cookie mismatch 0000000000000001 != 0000000000000000
[   58.326657] audit: type=1326 audit(1522084221.701:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7856 comm="syz-executor6" exe="/root/syz-executor6" sig=9 arch=40000003 syscall=240 compat=1 ip=0xf7735ba9 code=0x0
2018/03/26 17:10:21 executing program 4:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000000)='./control\x00', &(0x7f0000000080)='./control/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
rename(&(0x7f0000000240)='./control/file0\x00', &(0x7f00000001c0)='./file0\x00')
ftruncate(r1, 0x0)
close(r0)

2018/03/26 17:10:21 executing program 2:
r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00')
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000003640)={&(0x7f0000003300)={0x10}, 0xc, &(0x7f0000003600)={&(0x7f0000003340)={0x50, r0, 0x401, 0x0, 0x0, {0x9}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'rose0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1={0xff, 0x1, [], 0x1}}]}]}, 0x50}, 0x1}, 0x0)

2018/03/26 17:10:21 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip6_tables_names\x00')
preadv(r0, &(0x7f0000b24fb0)=[{&(0x7f0000000240)=""/4096, 0x1000}], 0x1, 0x0)

2018/03/26 17:10:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:21 executing program 6:
mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0)
mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f000000c000)='tmpfs\x00', 0x0, &(0x7f0000000100))
mkdir(&(0x7f0000000080)='./file0/control\x00', 0x0)

2018/03/26 17:10:21 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x10e, 0xa, &(0x7f00000001c0)={{0x1003, @broadcast=0xffffffff, 0x0, 0x0, "738bf7fcb3e76b0000000000000000f8"}, {@broadcast=0xffffffff}}, 0x44)

2018/03/26 17:10:21 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000966ffc)=0x3, 0x4)
listen(0xffffffffffffffff, 0x0)

2018/03/26 17:10:21 executing program 1:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(r0, 0x0, &(0x7f0000000240))

[   58.348791] binder: release 7843:7848 transaction 154 out, still active
[   58.348796] binder: unexpected work type, 4, not freed
[   58.348798] binder: undelivered TRANSACTION_COMPLETE
[   58.348861] binder: send failed reply for transaction 154, target dead
2018/03/26 17:10:21 executing program 2:
r0 = memfd_create(&(0x7f000001afe5)="7d7d9574686f5e707230630100000400001e0070ff6f630ff8", 0x0)
r1 = syz_open_dev$sndseq(&(0x7f0000027ff3)='/dev/snd/seq\x00', 0x0, 0x20001)
dup2(r1, r0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000042000)={0x0, 0x0, 0x0, 'queue1\x00'})
write$sndseq(r0, &(0x7f0000036000)=[{0x0, 0x3, 0x0, 0x0, @tick, {}, {}, @connect}], 0x1c)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000027fb0)={0x0, @time={0x77359400}})

2018/03/26 17:10:21 executing program 5:
r0 = socket(0x40000000015, 0x5, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r1=>0x0}, &(0x7f0000000200)=0x5)
setresuid(0x0, r1, 0x0)
pivot_root(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='./file0\x00')

2018/03/26 17:10:21 executing program 3:
clock_adjtime(0x0, &(0x7f0000000980)={0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff80000001})

[   58.414927] binder: 7867:7869 BC_INCREFS_DONE u0000000000000000 node 157 cookie mismatch 0000000000000001 != 0000000000000000
2018/03/26 17:10:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:21 executing program 6:
r0 = socket$netlink(0x10, 0x3, 0x0)
writev(r0, &(0x7f0000664ff0)=[{&(0x7f0000000000)="390000001100094700bb61e1c30500800700001702000000450000000000800019001a00000000000000000ff4000000fd17e9ffff06060400", 0x39}], 0x1)

2018/03/26 17:10:21 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f0000003600)='net/protocols\x00')
readv(r0, &(0x7f00009a5f80)=[{&(0x7f0000214000)=""/4096, 0x1000}], 0x1)
readv(r0, &(0x7f0000f5c000)=[{&(0x7f0000979000)=""/4096, 0x1000}], 0x1)

2018/03/26 17:10:21 executing program 0:
syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0)

[   58.460641] binder: release 7867:7869 transaction 158 out, still active
[   58.470776] binder: unexpected work type, 4, not freed
[   58.494278] binder: 7890:7892 BC_INCREFS_DONE u00000000204edf8a node 163 cookie mismatch 0000000000000000 != 0000000000000001
[   58.652841] binder: undelivered TRANSACTION_COMPLETE
[   58.691694] binder: send failed reply for transaction 158, target dead
[   58.708517] binder: release 7890:7892 transaction 162 out, still active
[   58.716516] binder: unexpected work type, 4, not freed
[   58.722237] binder: undelivered TRANSACTION_COMPLETE
[   58.727424] binder: send failed reply for transaction 162, target dead
2018/03/26 17:10:22 executing program 5:
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)={0xaa})
mincore(&(0x7f0000002000/0x4000)=nil, 0x4000, &(0x7f0000000100)=""/4096)

2018/03/26 17:10:22 executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000910000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSLCKTRMIOS(r0, 0x5428, &(0x7f0000000000))

2018/03/26 17:10:22 executing program 3:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mount(&(0x7f0000000040)='./control\x00', &(0x7f0000000080)='./control\x00', &(0x7f0000000100)='xfs\x00', 0x21000, &(0x7f00000001c0))
rmdir(&(0x7f000015dff6)='./control\x00')
close(0xffffffffffffffff)

2018/03/26 17:10:22 executing program 1:
add_key(&(0x7f00000012c0)='pkcs7_test\x00', &(0x7f0000001300)={0x73, 0x79, 0x7a}, &(0x7f0000001340), 0x0, 0xfffffffffffffffc)

2018/03/26 17:10:22 executing program 6:
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c)
syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @local={0xac, 0x223, 0x14, 0xaa}, @dev={0xac, 0x14, 0x14, 0x2b}}, @udp={0x0, 0x4e20, 0x8}}}}}, &(0x7f00000000c0))

2018/03/26 17:10:22 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x4, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000009000)})

2018/03/26 17:10:22 executing program 4:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000000)='./control\x00', &(0x7f0000000080)='./control/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
rename(&(0x7f0000000240)='./control/file0\x00', &(0x7f00000001c0)='./file0\x00')
ftruncate(r1, 0x0)
close(r0)

2018/03/26 17:10:22 executing program 7:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000ee4ff0)={0x77359400}, 0x10)

2018/03/26 17:10:22 executing program 5:
syz_emit_ethernet(0x7ffff, &(0x7f00000000c0)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], {@ipv4={0x800, {{0x4, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback=0x7f000001, @remote={0xac, 0x14, 0x14, 0xbb}}, @udp={0x0, 0x0, 0x8}}}}}, &(0x7f0000000000))

2018/03/26 17:10:22 executing program 3:
openat$ptmx(0xffffffffffffff9c, &(0x7f00008f0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080))

2018/03/26 17:10:22 executing program 2:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f000078dff8)='./file0\x00', 0x0)
write$sndseq(r1, &(0x7f0000011fd2), 0x0)
link(&(0x7f0000f3bff8)='./file0\x00', &(0x7f00009db000)='./file1\x00')
rename(&(0x7f0000000040)='./control/file0\x00', &(0x7f0000000000)='./file0\x00')
rename(&(0x7f0000000180)='./file1\x00', &(0x7f00000001c0)='./control/file0\x00')
dup2(0xffffffffffffffff, r0)

2018/03/26 17:10:22 executing program 0:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10)
sendto$inet(r0, &(0x7f000061af66), 0xfffffffffffffd8f, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10)
setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000100)=0x5, 0x4)
sendto$inet(r0, &(0x7f0000000000)="93", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @multicast1=0xe0000001}, 0x10)

2018/03/26 17:10:22 executing program 6:
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40086310}], 0x0, 0x0, &(0x7f0000000f4d)})

2018/03/26 17:10:22 executing program 7:
syz_open_dev$sndseq(&(0x7f0000054ff3)='/dev/snd/seq\x00', 0x0, 0x101042)

2018/03/26 17:10:22 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00')
preadv(r0, &(0x7f0000b24fb0)=[{&(0x7f0000830000)=""/4096, 0x1000}], 0x1, 0x0)

[   58.858185] binder: 7917:7924 transaction failed 29189/-22, size 0-0 line 3011
[   58.875577] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:22 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='task\x00')
getdents64(r0, &(0x7f0000000000)=""/249, 0xffffffff00000018)

2018/03/26 17:10:22 executing program 0:
pipe2(&(0x7f0000989000)={<r0=>0xffffffffffffffff}, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0)
write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"410f44be5f55ea719cbb6635"}}], 0x30)
link(&(0x7f0000f3bff8)='./file0\x00', &(0x7f00006b3ff0)='./file2\x00')
rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file1\x00')
lstat(&(0x7f0000003180)='./file1\x00', &(0x7f00000031c0))
dup2(r0, r1)

2018/03/26 17:10:22 executing program 7:
r0 = socket(0x40000000015, 0x5, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r1=>0x0}, &(0x7f0000000200)=0x5)
setreuid(0x0, r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000000)={&(0x7f0000018ff4)={0x10}, 0xc, &(0x7f0000013ff1)={&(0x7f0000000140)={0x20, 0x26, 0x1, 0x0, 0x0, {0x1}, [@typed={0xc, 0x0, @u64=0xfffffffffffff000}]}, 0x20}, 0x1}, 0x0)

2018/03/26 17:10:22 executing program 4:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000000)='./control\x00', &(0x7f0000000080)='./control/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
rename(&(0x7f0000000240)='./control/file0\x00', &(0x7f00000001c0)='./file0\x00')
ftruncate(r1, 0x0)
close(r0)

2018/03/26 17:10:22 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f000009aff8)='./file0\x00', 0x0)
write$sndseq(r0, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
fallocate(r0, 0x3, 0x0, 0x5)

[   58.946294] binder: 7946:7949 BC_DEAD_BINDER_DONE 0000000000000000 not found
2018/03/26 17:10:22 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:22 executing program 5:
perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x3, 0x6)
getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x50, &(0x7f00000002c0)={'ah\x00'}, &(0x7f0000000040)=0x1e)

2018/03/26 17:10:22 executing program 1:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pivot_root(&(0x7f00000001c0)='.', &(0x7f0000000200)='..')

2018/03/26 17:10:22 executing program 2:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
creat(&(0x7f0000000180)='./file0\x00', 0x0)
mount(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='btrfs\x00', 0x0, 0x0)

2018/03/26 17:10:22 executing program 3:
nanosleep(&(0x7f0000000200)={0x0, 0x1c9c380}, &(0x7f0000000000))
mlockall(0x1)
mremap(&(0x7f000053b000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffe000/0x2000)=nil)
mprotect(&(0x7f000008b000/0x3000)=nil, 0x3000, 0x0)

2018/03/26 17:10:22 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:22 executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(0xffffffffffffffff, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:22 executing program 4:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000000)='./control\x00', &(0x7f0000000080)='./control/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
rename(&(0x7f0000000240)='./control/file0\x00', &(0x7f00000001c0)='./file0\x00')
ftruncate(r1, 0x0)
close(r0)

2018/03/26 17:10:22 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:22 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="11634840"], 0x74, 0x0, &(0x7f00000006c0)="684f4b60f68c3ea854d1d4e65fa76fd9ab258c88ac58d96229cb17eccceb2b785b587b77fe08b5c3e213603a5dbaa3aa764245ffe9b9e8b4dfb953ff122e052c45f8f9e716e60e45ee088b32c108fb0b022a72cf5c64aeaefba3c0b63253d4d191a17c2d51c809fee963c21c49504b765fb52ca6"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

[   59.172269] binder_alloc: 7974: binder_alloc_buf, no vma
[   59.177646] binder: BINDER_SET_CONTEXT_MGR already set
[   59.177654] binder: 7982:7987 ioctl 40046207 0 returned -16
[   59.196845] binder_alloc: 7974: binder_alloc_buf, no vma
[   59.213738] binder: 7974:7995 BC_INCREFS_DONE u0000000000000000 node 166 cookie mismatch 0000000000000001 != 0000000000000000
[   59.213767] binder: 7982:7987 transaction failed 29189/-3, size 40-8 line 3134
[   59.213826] binder: 7974:7978 transaction failed 29189/-3, size 40-8 line 3134
[   59.224042] binder: BINDER_SET_CONTEXT_MGR already set
[   59.224049] binder: 8000:8001 ioctl 40046207 0 returned -16
[   59.227250] binder_alloc: 7974: binder_alloc_buf, no vma
[   59.227289] binder: 8000:8001 transaction failed 29189/-3, size 40-8 line 3134
[   59.228850] binder: 8000:8001 BC_INCREFS_DONE u0000000000000000 no match
2018/03/26 17:10:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1}], 0x0, 0x0, &(0x7f0000000580)})
r2 = dup2(r0, r0)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f0000000040)={0x3, 0xa2, "9bf3cbc9cfad9d6c017aac3d27617a067560c7a7cfb3c7afafe6428010f8dd24b45950723851a35d6e67c3d2b1e2994304ba77a536cf6b59f8f62947611f37554190eb1ed3591225af59cd49d50e2f71e4ed58e8cf8a2920eb68d4a42408bd98b1d1bdd2076204aacffab456d5998a60da13bda8466ff2e59837974ab4bbf139b341dd10da37a0003793db4c2325ec0201f4c3eb2a195dfa4953e8a3b2b26618fdb8"})

2018/03/26 17:10:22 executing program 4:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000000)='./control\x00', &(0x7f0000000080)='./control/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
rename(&(0x7f0000000240)='./control/file0\x00', &(0x7f00000001c0)='./file0\x00')
ftruncate(r1, 0x0)

2018/03/26 17:10:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
fcntl$setflags(r0, 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1}], 0x0, 0x0, &(0x7f0000000580)})

[   59.258161] binder: BINDER_SET_CONTEXT_MGR already set
[   59.258167] binder: 8004:8005 ioctl 40046207 0 returned -16
[   59.262778] binder_alloc: 7974: binder_alloc_buf, no vma
[   59.262817] binder: 8004:8005 transaction failed 29189/-3, size 40-8 line 3134
[   59.263030] binder: 8004:8005 ioctl 40085203 20000040 returned -22
[   59.263568] binder: BINDER_SET_CONTEXT_MGR already set
[   59.263576] binder: 8004:8006 ioctl 40046207 0 returned -16
[   59.264869] binder_alloc: 7974: binder_alloc_buf, no vma
2018/03/26 17:10:22 executing program 2:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000))
ioctl(r0, 0x8b2b, &(0x7f0000000040))
socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000000080))

2018/03/26 17:10:22 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
memfd_create(&(0x7f0000000000)='user\x00', 0x1)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x9})

[   59.264908] binder: 8004:8005 transaction failed 29189/-3, size 40-8 line 3134
[   59.283429] binder: undelivered TRANSACTION_ERROR: 29189
[   59.283586] binder: undelivered TRANSACTION_ERROR: 29189
[   59.305391] binder: BINDER_SET_CONTEXT_MGR already set
[   59.305398] binder: 8008:8010 ioctl 40046207 0 returned -16
[   59.308169] binder_alloc: 7974: binder_alloc_buf, no vma
[   59.308208] binder: 8008:8010 transaction failed 29189/-3, size 40-8 line 3134
[   59.314510] binder: undelivered TRANSACTION_ERROR: 29189
[   59.332978] binder: BINDER_SET_CONTEXT_MGR already set
[   59.332985] binder: 8008:8011 ioctl 40046207 0 returned -16
[   59.337639] binder_alloc: 7974: binder_alloc_buf, no vma
[   59.337680] binder: 8008:8013 transaction failed 29189/-3, size 40-8 line 3134
[   59.338652] binder: BINDER_SET_CONTEXT_MGR already set
[   59.338658] binder: 7994:8014 ioctl 40046207 0 returned -16
[   59.339198] binder: 8008:8011 BC_INCREFS_DONE u0000000000000000 no match
[   59.344382] binder_alloc: 7974: binder_alloc_buf, no vma
[   59.344421] binder: 7994:7999 transaction failed 29189/-3, size 40-8 line 3134
[   59.361063] binder: undelivered TRANSACTION_ERROR: 29189
[   59.361228] binder: undelivered TRANSACTION_ERROR: 29189
[   59.361635] binder: undelivered TRANSACTION_ERROR: 29189
[   59.408497] binder: BINDER_SET_CONTEXT_MGR already set
[   59.408505] binder: 7993:7997 ioctl 40046207 0 returned -16
[   59.412174] binder_alloc: 7974: binder_alloc_buf, no vma
[   59.412212] binder: 7993:7997 transaction failed 29189/-3, size 40-8 line 3134
[   59.413714] binder: 7993:7997 BC_INCREFS_DONE u0000000000000000 no match
2018/03/26 17:10:22 executing program 1:
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0)
ioctl$sock_ipx_SIOCIPXNCPCONN(r0, 0x89e3, &(0x7f0000000040)=0x400000000000000)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)="2f70726f632f7379732f6e65742f697076342f76732f73796e635f726566726573685f706572696f6400b1c554463a772254be3ef026df322950626008436b95f04d2090f57e0053975e7f9ca6b773de57b90a43405acafbb3244a45232b271068f27d96848b9c52854bfa2933ca23cbd7772837cc00000000000000", 0x2, 0x0)

2018/03/26 17:10:22 executing program 4:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000000)='./control\x00', &(0x7f0000000080)='./control/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
rename(&(0x7f0000000240)='./control/file0\x00', &(0x7f00000001c0)='./file0\x00')
ftruncate(r1, 0x0)

2018/03/26 17:10:22 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
r1 = dup3(r0, r0, 0x80000)
ioctl$sock_netrom_TIOCINQ(r1, 0x541b, &(0x7f0000000000))
ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x1)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080))
setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000000c0)={0x7ff, 0x0, 0x1000}, 0x4)
fcntl$setflags(r0, 0x2, 0x1)
setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000100)={0x1}, 0x1)

2018/03/26 17:10:22 executing program 0:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000000)='./control\x00', &(0x7f0000000080)='./control/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
rename(&(0x7f0000000240)='./control/file0\x00', &(0x7f00000001c0)='./file0\x00')
ftruncate(r1, 0x0)

2018/03/26 17:10:22 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1, 0x1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:22 executing program 2:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x20000, 0x0)
ioctl(r0, 0x8b2b, &(0x7f0000000000)="f0a852ef771cefb672378a451247f5b5a874a14d6ee7f899b5293b29e2f83ce3010066045e2a3a4ce38bcd04c1e536054e4f3803696d9bc03378c2f513113518a3aeb6e5bf104e4cdcf6bb3abcb20e849de8b9db8b2f71fa0edd6d7a8b7ea67da964ac5606b43b7d6e572ba084b19e1efa387b3f17623253cc6b60d5699cb87a4b545ceb12bed1cf80f4235c12391071a1afca4541b5cecd734195648d227fdb138044e2fe7a79bb29462e4c39c0ab0371fb61d374364beb87c5d60083ab15831a728c44a146c33fcc19f5")

2018/03/26 17:10:22 executing program 3:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/bnep\x00')
setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000040)={0x7ff, {{0xa, 0x4e21, 0x8000, @local={0xfe, 0x80, [], 0xaa}, 0x9}}, 0x1, 0x1, [{{0xa, 0x4e21, 0x4e}}]}, 0x10c)
r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x802)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}})
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f00000001c0)={'filter\x00', 0x3, [{}, {}, {}]}, 0x58)

2018/03/26 17:10:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1}], 0x0, 0x0, &(0x7f0000000580)})
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x4000, 0x0)
ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0086426, &(0x7f0000000180)={0x1, &(0x7f0000000140)=[{<r3=>0x0}]})
ioctl$DRM_IOCTL_DMA(r2, 0xc0286429, &(0x7f00000002c0)={r3, 0x7, &(0x7f00000001c0)=[0x100000000, 0x1, 0x3f, 0x8001, 0x0, 0x1, 0x6], &(0x7f0000000200)=[0x0, 0x6, 0x8aa, 0x99bd, 0x140000, 0x6, 0x4, 0xe490, 0x6], 0x37, 0x2, 0x1ff, &(0x7f0000000240)=[0x200, 0x8], &(0x7f0000000280)=[0x10000, 0x7fffffff, 0x0, 0x7]})
r4 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0xc0040)
getsockopt$netrom_NETROM_IDLE(r4, 0x103, 0x7, &(0x7f0000000080)=0x80000001, &(0x7f00000000c0)=0x4)

[   59.472417] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:22 executing program 1:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0)
setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x77359400}, 0x8)

2018/03/26 17:10:22 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0)
ioctl$DRM_IOCTL_IRQ_BUSID(r1, 0xc0106403, &(0x7f00000000c0)={0x7, 0x40, 0x7, 0x2})
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}})
r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0)
setsockopt$llc_int(r2, 0x10c, 0x6, &(0x7f0000000040)=0x100000001, 0x4)

[   59.511963] binder: 8024:8030 BC_INCREFS_DONE u00000000204edf8a node 178 cookie mismatch 0000000000000000 != 0000000000000001
[   59.526868] binder: BINDER_SET_CONTEXT_MGR already set
[   59.533353] binder: 8027:8031 ioctl 40046207 0 returned -16
[   59.547543] binder: 8027:8031 BC_INCREFS_DONE node 181 has no pending increfs request
2018/03/26 17:10:22 executing program 6:
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, @perf_bp, 0x200000400, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mknod$loop(&(0x7f0000683000)='./file0\x00', 0x0, 0xffffffffffffffff)
mount(&(0x7f0000144000)='./file0\x00', &(0x7f0000343ff8)='./file0\x00', &(0x7f0000bd2ffc)='nfs\x00', 0x0, &(0x7f000000a000))

[   59.559132] binder: BINDER_SET_CONTEXT_MGR already set
[   59.579405] binder: 8024:8044 ioctl 40046207 0 returned -16
[   59.579415] binder: release 8027:8031 transaction 180 out, still active
[   59.579418] binder: unexpected work type, 4, not freed
[   59.579420] binder: undelivered TRANSACTION_COMPLETE
[   59.597667] binder_alloc: 8024: binder_alloc_buf, no vma
[   59.597707] binder: 8024:8030 transaction failed 29189/-3, size 40-8 line 3134
[   59.659908] binder: undelivered TRANSACTION_ERROR: 29189
[   59.699742] binder: release 8024:8030 transaction 177 out, still active
2018/03/26 17:10:23 executing program 1:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000040)=0x5, 0x4)
ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f00000001c0)={0x2000000000000, 0x40, 0x3, 'queue1\x00'})

2018/03/26 17:10:23 executing program 7:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x80100, 0x0)
getsockname$packet(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000100)=0x14)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x400000000e)
ioctl$TCSETS(r1, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:23 executing program 4:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000000)='./control\x00', &(0x7f0000000080)='./control/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
rename(&(0x7f0000000240)='./control/file0\x00', &(0x7f00000001c0)='./file0\x00')
ftruncate(r1, 0x0)

2018/03/26 17:10:23 executing program 2:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0)
getpeername$unix(r1, &(0x7f0000000040), &(0x7f00000000c0)=0x6e)
ioctl(r0, 0x8b2b, &(0x7f0000000240))

2018/03/26 17:10:23 executing program 0:
personality(0xa000008)
uname(&(0x7f0000d38ff1)=""/15)

2018/03/26 17:10:23 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80001, 0x0)
ioctl$LOOP_SET_CAPACITY(r1, 0x4c07)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r2=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r2}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:23 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0xfffffffffffffffc)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000944fa8)={{0x8000000, 0x1}, 0x1, 0x0, 0x0, {0xf2}})
r1 = timerfd_create(0x4000000000000008, 0x0)
read(r1, &(0x7f0000da2000)=""/8, 0x8)
timerfd_settime(r1, 0x0, &(0x7f0000714fe0)={{0x0, 0x989680}, {0x0, 0x6}}, &(0x7f0000000fe0))
r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0)
ioctl$TUNSETSNDBUF(r2, 0x400454d4, &(0x7f00000000c0))
r3 = fcntl$dupfd(r0, 0x0, r0)
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
sigaltstack(&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000140))
ioctl$TUNSETSNDBUF(r3, 0x400454d4, &(0x7f0000000000)=0x8000)
getpeername$inet6(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0, @local}, &(0x7f0000000200)=0x1c)
ioctl$TUNGETFEATURES(r3, 0x800454cf, &(0x7f0000000040))

2018/03/26 17:10:23 executing program 6:
socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
recvfrom$packet(r0, &(0x7f0000000040)=""/131, 0x83, 0x160, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="e9a3d4df9dd4"}, 0x14)

2018/03/26 17:10:23 executing program 0:
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f00006a9ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x14, 0x0, &(0x7f0000000280)=[@acquire={0x40046305}, @dead_binder_done={0x40086310}], 0x0, 0x0, &(0x7f0000000140)})

2018/03/26 17:10:23 executing program 1:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={0x5}, 0x8, 0x80000)
fcntl$notify(r0, 0x402, 0x80000000)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)="2f70726f632f303f76732f73796e635f708072736973747a6d6f646500", 0x2, 0x0)

[   59.706539] binder: unexpected work type, 4, not freed
[   59.711837] binder: undelivered TRANSACTION_COMPLETE
[   59.724004] binder: send failed reply for transaction 177, target dead
[   59.748339] binder: send failed reply for transaction 180, target dead
2018/03/26 17:10:23 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000240)={0x0, &(0x7f00000001c0)=[{}]})
syz_open_pts(r0, 0x200)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080))

2018/03/26 17:10:23 executing program 0:
sched_setaffinity(0x0, 0x8, &(0x7f00001d5000))
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendto$inet(r0, &(0x7f0000000100)="a9", 0x1, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10)
recvmmsg(r0, &(0x7f0000003bc0)=[{{&(0x7f0000000800)=ANY=[], 0x0, &(0x7f0000000040), 0x0, &(0x7f0000003ac0)=""/214, 0x7a}}], 0x1, 0x0, &(0x7f0000003c00))
listen(r0, 0x7)
accept4(r0, 0x0, &(0x7f0000000000)=0x31c, 0x0)

2018/03/26 17:10:23 executing program 6:
r0 = socket$inet(0xa, 0x1, 0x0)
connect$netlink(r0, &(0x7f0000000200)=@unspec, 0xc)

[   59.767218] binder_alloc: 8070: binder_alloc_buf, no vma
[   59.771997] binder: 8078:8080 BC_DEAD_BINDER_DONE 0000000000000000 not found
[   59.772412] binder: 8078:8082 BC_DEAD_BINDER_DONE 0000000000000000 not found
[   59.788421] binder: 8070:8077 transaction failed 29189/-3, size 40-8 line 3134
2018/03/26 17:10:23 executing program 2:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(r0, 0x8b29, &(0x7f0000000040)="7d853984e1624c7d71d0c86ef5713d6aa8c2c96f559a03e4bdaf204c1256cc5baa09ae45ce79ee761f941ab1c5b41b57feff38d5fdb3ba644a7d46eb5fac61e1f658ea4cc08d7d234b10eb2361f5938e7bd55782761456df82af71070b23c147c66356c3c306385181d22fbf1c795e0873090d6dd26a0a007e109ea5c1e38b92775b0d9808f4c78c5e0de21208b387f1aca92551f58fc6f62dcae1cbffd5dbafbb253bf2a704299b1de17dc9515f68")
setsockopt$sock_int(r0, 0x1, 0x3, &(0x7f0000000000)=0x393, 0x4)

2018/03/26 17:10:23 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
r1 = creat(&(0x7f0000000180)='./file0\x00', 0x20)
ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000001c0)=<r2=>0x0)
getresuid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=<r3=>0x0)
ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0186405, &(0x7f0000000300)={0xfff, 0x9, r2, 0x0, r3, 0x1, 0x6, 0x7})
r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$PPPOEIOCSFWD(r4, 0x4004b100, &(0x7f0000000040)={0x18, 0x0, {0x4, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, 'ip6gretap0\x00'}})
ioctl$sock_SIOCADDDLCI(r4, 0x8980, &(0x7f00000000c0)={'rose0\x00', 0x7fff})
setsockopt$nfc_llcp_NFC_LLCP_RW(r4, 0x118, 0x0, &(0x7f0000000000)=0x5, 0x4)
chdir(&(0x7f0000000080)='./file0\x00')
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000400)='/dev/sequencer\x00', 0x8400, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}})
clock_gettime(0x0, &(0x7f0000000340)={<r5=>0x0, <r6=>0x0})
getresuid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0))
timerfd_settime(r4, 0x1, &(0x7f0000000380)={{r5, r6+10000000}}, &(0x7f00000003c0))
clock_nanosleep(0x0, 0x1, &(0x7f0000000100)={0x77359400}, &(0x7f0000000140))

2018/03/26 17:10:23 executing program 4:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000000)='./control\x00', &(0x7f0000000080)='./control/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
rename(&(0x7f0000000240)='./control/file0\x00', &(0x7f00000001c0)='./file0\x00')
close(r0)

2018/03/26 17:10:23 executing program 6:
perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0)
ioctl(r0, 0x2275, &(0x7f0000791ffe)="0080")

2018/03/26 17:10:23 executing program 1:
r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x10000, 0x200000)
ioctl(r0, 0x4, &(0x7f0000000040)="e6cbdd8ce0794a61eae2a7bd949f26e838d2faf9a79f642d265887cb371e82dd0705e692be4ee9cae7de15157e8e5e5277c59643b3d41b9ef9fe90bc7e")
fcntl$setlease(r0, 0x400, 0x2)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)="2f70726f632f303f76732f73796e635f708072736973747a6d6f646500", 0x2, 0x0)

[   59.815347] binder: BINDER_SET_CONTEXT_MGR already set
[   59.827699] binder: 8070:8077 ioctl 40046207 0 returned -16
[   59.836854] binder_alloc: 8070: binder_alloc_buf, no vma
[   59.847443] binder: 8070:8083 transaction failed 29189/-3, size 40-8 line 3134
[   59.858446] binder: 8070:8092 BC_INCREFS_DONE u0000000000000000 no match
2018/03/26 17:10:23 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0x0, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r1}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:23 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe})

2018/03/26 17:10:23 executing program 6:
r0 = socket$inet(0xa, 0x803, 0xb7)
getsockopt$IP_VS_SO_GET_DESTS(r0, 0x29, 0x3e, &(0x7f0000000180)=""/4096, &(0x7f0000001180)=0x1000)

[   59.885200] binder: undelivered TRANSACTION_ERROR: 29189
[   59.892384] binder: undelivered TRANSACTION_ERROR: 29189
2018/03/26 17:10:23 executing program 0:
r0 = socket$inet6(0xa, 0x400000000001, 0x0)
r1 = dup(r0)
bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c)
sendto$inet6(r0, &(0x7f0000f98000), 0xfffffffffffffff3, 0x2000000c, &(0x7f00004a5fe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x27ffe)
sendmsg$nl_generic(r1, &(0x7f00004d5000)={&(0x7f000082e000)={0x10}, 0xc, &(0x7f00009e8000)={&(0x7f0000000280)=ANY=[@ANYBLOB], 0x1}, 0x1}, 0x0)
sendfile(r1, r2, &(0x7f0000ea8000), 0x3)

[   59.956764] binder: 8111:8117 BC_INCREFS_DONE u00000000204edf8a node 190 cookie mismatch 0000000000000000 != 0000000000000001
[   59.988909] binder: BINDER_SET_CONTEXT_MGR already set
[   59.994339] binder: 8111:8131 ioctl 40046207 0 returned -16
2018/03/26 17:10:23 executing program 2:
socketpair$inet(0x2, 0x4, 0x3, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fremovexattr(r1, &(0x7f0000000040)=@known='security.selinux\x00')
r2 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl(r1, 0x1000000008b2a, &(0x7f0000000180)="004e68e7d8b26b158cd69c3858739ea755c796fe26bf3caef39c475d98d0eb542a2581b806814d9ef6fcba9cc8f7985fd5660110c32f46825443bed781f85ce6b203000000000000004acc6f4188712094428f25f1ee8f8f8ee11455d58344c6d259dca4f7a947a11dd8ecbc77285f61258738fa8ce5d1feaa0a75915d08fadc18b8d7176d6a2581e6a45b143f28bdf858814c12fd8d86387b1393736d0907728e690f68c26e1a0050f27941651428035c0a17380d0387909bc811a1e2166936dab4641e3a63616dde709333befc24b0efaf112f4ca4d8")
fallocate(r0, 0x0, 0x6, 0xffffffff)
syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x400200)
r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000380)='/dev/keychord\x00', 0x102, 0x0)
recvfrom$inet6(r3, &(0x7f0000000100)=""/44, 0x2c, 0x60, &(0x7f0000000140)={0xa, 0x4e24, 0x0, @empty, 0x7}, 0x1c)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000001400)={'ipddp0\x00', 0x1000})
setsockopt(r2, 0x9, 0x0, &(0x7f00000003c0)="9cae636a57e2c3166d13dfbedabcbb1abdbd1170a31a607820fa843a492bbc18ddb44c61f48e97ae58eaf11e3d15e1404758257f258ec1a3ee8d003a00dded10ae06c5d479fc688ca154e2f6265bea6d5ab8b14d1c4a2dd4ad8860051f1204c03f74c643faec25af5fd53e9512303984112967f94d73032cb96ecd47362bcd2edec1c2e2433977d0669419cec8f34bbfe538312de12c84195d85ac839cc5e0eb2e32bcdb0a9ffb149cdb95bb397f5e882d7d6b1afd9e4cf17b554bc1372b86c950122f68294f28a6dfeaa9ad8275cad342101db8e67a4a0a2628cbb6ebaf380a065f670acbdd7d824e67f434c2a29aa6b6d3ad2982f71c01d508901183a5b0f9f5f0908a3ce4609ec2786f75c628b0079ac9d370d66650c01833e32b0d32d48adf85317c17e857d50cfabec8e687bcc6a7b3d7d4b4016d04c8297808482e45474f76ce44cc9c41d6c775b584c76d0e87e842c16e3e1ccbd3179898a18c81ddf98b2d146e15c47fd32ec24fd3bbb6a21a16a4afb812b1acb0cb171144b2243210554c901d39f806aa7af16f521e7dc68d62676e4f0840b5d9c4ce2ae6d720f82eedee8ea900d93515d11b03a0af7048dc8912cb82798104446e60f01bea48ff2ae62cefc56652404c559d0a90e9897f9936e255a0376999a33a91ba4378f4480477eab8cf296c6462ada352022cc774a858c769b6146638f302e19d168833980a0e4840b0ad63d18f362c09e1e3e8d788c5fcab01434f908c4a4b49f590883b74807a31586aca6f5c376a4c807cba25d2c832ab43490fd25488b84b40ced56648ac3ffdf9a51c9b55c1d1994c4a09fef322351f01274959e9e48c4a45f02c8dab364bad1951023338e6f757725d479c9ab69c9db788753ca0ceb3fd99fe77cf7fce6306a447aa5f059abd354f59946479687bcbb5acfa9cf5387b2c6f2f0c8e7593273be74c71cc562ea6c45041c18d52e79f3babf42eaee29d322123b3b33188515056c56e9e31631aadf5034c24cd10534e253c39697efaba22e541bcb7b85e5af8c598d9ae3a003754608237c3b32d3da91799fbad86c1e85926efc80cb2a3da14a374550f7bd4ce989cd795e6bbc58779633d4ef9554ce481ed400d6ab1289af564d4516cf66f76f3f9cb6a5a5c7e849d3217d2b5d596850320372fb5c42b322f3c7720c69121bc7ced0ee3687c1c1c5a697ff0c11e705d52e31df1fa03f4e3b3c05be687e71c615402116ea033277409bc847fa1c24c6cca2364a431d27b20e818b5a0e04b499b8c7ce320bb3d7733a537baa5b4ae282e13c67d7d9edbb3f037bf9851edd1636aed00f3dd3e9376b855967a041744e4efc64851d21fba1980fb0d506f7401dda5ed05ddda55cd482d000868761b4ffd7b2bf1a8277e35225de46c5e353f14f9ec2a7504bf83441bc6c947ced88f88fece623b37a22ff2a01ccb52187331c257ddebfad56011e93cb5a6971cf65a54e934bfb3871f9410a2f2763fc98f8f46aaeaef12d7ca8d04e80bef959c3eea0f3101303772c0b35fd3683d6d5c8437178239d7064cfea45e1cf39ce550dd59b994035a9375417b728a655c0a17e2c251549d6734c606c983c8f18fb503ab76133268ab49929aa914b4a1a562274eeefefab6b84a9f1ec9049aadcb2b62c47334d402e7cc4ab98703eab7309fddd7410a70fac85f10877c92fde90f38e7e2abd6b6efb533f01f6aeac9c2656fe77c38502bdb4638a5996eb971b51eb296c6ac15cf91a2860455a9d59bab33a45012d620e9bab07a4a3c8cf89d9e28991859d1344c75189aa5104df8d84202b1943fa5e6b6a493b27df93082d93f5776474722146089ff0fae8891993a8c0b6b06bb27be6e962ac200aceca564f117b378330e8901cccf30ce8e83eb5fe0d0886f4a78ea478662b36e3573e09d7d80d7690a0af8ffdc60c7ce59b147393197113b60582d882ca031285cfd41fa03c89a5910370f36d68ba74131b8f21dbe5664066fa1e68a266276b4edf6289952d4bd34dc238483fed7ef7a55e2f537caea424c295695f151f0f5b0b235a41f4420b0909ff5b267c3dde6510b8a7175b1a96a1e6ec9c7380af1c7a19053915ed37ee9ee893f85bcf5feaaddd76be9da5aced3537612f6b05b0d86a7bf93210941e3ee4a05c1ff4ffd802ef8e9173fe8d55ec1eb052a349f3a750c77e3a4c4b02ed87cb5ac8489d57dece4859cb44902d44da8e6bb4800b94d8edce90456d9c63a9574e2220a24399988d2e97fe10f02485d76e8b84808752b42d4f052d39eb228289f60ffd277b9a9c199559e2714fd68d0994b9acd61d6ebd73527e042edfddfc8b40796b4426247e02850bd6da03371439229e857e2f925e86372cf35a0fd0d54f2a2f07fd3e8bb5dd436674dca90d6bf31426cf4a6be5b0523ee1eb3ffe9d3b03b1fa5e3eb984be466372b24bf097c4f389352f04a50cef7a4ec1a8e53630566ad159582fc2fe35484614ba507330435a638dd873a3b74409ec9a6dc0697a5863198c6abe7f9972857402ec37dd83ae0c0c58b0f32f9185c91b6757b1529f80d45a397dce024556d652ce1cd6e86169dc0f9eefcaf641bb6927df35626ff2087e46f92d017915cd3933293daf185f9dfe687b943f4dfea14d20e75777fad2be275cfb9ec957d8ec5e7e43d4aabe1b4d9bcde06e5891b4c5c3e938620005454df17e06dae2debd5fa85beb9797d7a094bcf6f2f5422d88c0ae1d43d63d1914b24bbc6387258aec956b7f2f5bb9481ce95c43d1bdbc6594a6ecc0aaa48ea4710ad283b4c64f3821e22d47da066ec3080e4ec9b78d36c18397c0dc2346d1fc3d216a849cb612721db7639d5a50dac12ba696c1db77c0c229159097258733e5908c26a825b620b381264bbf3ab9c13d081e8d25bee5c9c39e98cd80975d2e2c1f9eb7060bb3d77f5d7fead9c40e7f1c6d2622cb46d5e14eb161c0ff67f722c4205008b493973b9a563c6936ae9dd3080cef3da5a828981739ee37b52c5b4e33268e829eb48b992f160180dbc26b560540becce7bfaee8ccff29a3cca8902fbd9ba318f69628fba060831e1db47d022d5a1fdc5d2286e687a7ab2e48a149340b7107d2ef17a548ebc605ff360b64c651aefc10c730e40e784f19d460ac5946dbca96df6c30f9294701ae3c46a31be455317a9f9c208ae3bdf5a544ab4c08e63ccf934ec8250ba36b4f961cdcb2fd5a09006654090a0ad5a4d0a3fe8080a450ab966ac0c5d9c8a64c780669071bf220415193904d6760120663e3653daa7ab85e780bd08783fdaf5e81e4fc3042e35dc5f10317ec351068d46ed7bebc82b944af62d8078c236698ef83f9b7e5b9b87a63077ab3868d173af2ee501903a46ef74d606008ca1066a82189bf523aa15428c1e1329adb4fa7bb3aa4df1cf82383bde586251906558da13e13d57c61d98f78911777a2b7d6612f4d6bd9baed5316dd0425c866d58a340ffc54e0de4776406183a97f604e7346f3378d1336e69d835fa90fc6491c660a3bd7549d882845571752295664cfca899aee1cc59774a8a32139a322f8a6671369911dadf12042d3d086c17c8a41bd67393c3beda350a2e0167ecb4c22b7802f95c24a4c231dec39ec6d84f2be9273963e3ae364c703ab9aa6a14c34175503b6a843e8912b4f34094db06cc6d58804cabf22e642b12f8714ef8af76b97a4a24782769bc275090d5d7a605609a9d2f3e428c2051480dd6cfd9e1aff3e22e94cbddacc193a0f43cd659c0f6bed95b7bfda3a36ca574ff997df8048609838969f271718aa9fb8d0f6a2a02b1bb8f05fec46dc529fd4d4d4690c5398f1202c464f01fb7579c500598b261ed9e3636e1f0e124b39da8c960a92b48398122c0e14da1c7609491def0941f388a067dcbe08bb5ec72b01086a30b87504b2f5425cfaf8b62a0b712ae34be1bac08b598f701b2d4dab013c3be6a27976df519ea45ba1f6f652ff422b23aec56941b56adc13639b9ea7d4dc1eaccf772315b704645eef9baced3fd92fab6a2f9fffd81bebc047dff764ade92d4c67481a460d43bb8efa93b825fec8f31f742ce12deff14b6491bf87fc531a9a5305bd6e0900db16cf73abaa20a0c86e2b9cdf8d3effae8f7b8a595eb44eaf8e67a9ce75c4141b3c6529a55f28cc1bc69792ece595815b78846da6f80b75f0694c3b9a4b5212f3133513b67526505c47ba8e9cd37f5b13b4a6b96d8a04e9d582c8a4c872737f49fc2d8e75a643d4f93cc7375ecb8664caad075dcc95471ae85606128d0fe91ec570e303966c8cdb007d6a43c031062c2aa7fa235c180385d53c183652bebef643b0650a5f3d49fff20a835ce2eb0a78c0fee2dee8ea3dd0128911b1221512518bb3e8896dc7760c726436f2168e754f1d69341969369afa056094541d50c9a2fb0492275b4988724bea5d8f4b28a10789ddfd4c61cce461dc6c53b264435fe92c13f2f4c1455a369f4da83f3f99db9e0389b94319d9d504058f61d737862e8b23b5e48f4101a2acdfcadd9bb30c2630dae0c479e464820f0edce62eb7cc708cece32d26b5397e97486562599904aba81c9cf638f7ef473b74ed25278c3afe6e89369de36738462e13d4d6861a6471df5cdfa3dd58bfdd0e2c49365f06ef03e6fcf3339674e3adf1ba91370cc53d2af4c7b5c0cf4a62cf1cbfd551d35013c9f74c56ee4935579d7d5ae595935c7198a269b1cf631c9a67248c9815161166731ca4df13cceb5ee376fdf18253a4bac57a3e39bca3d824f27704dc94ff672b317a816a642cdf93421c24e8ac760eeddc13327b2fcf74f64ac4be228cd7061a8a3fabd57ff442b4cc268cf01b192ba5f8bac54f778e83691a26554c0d1f525550dff2526954eff719be23b0f98177375e4a76e3fdb476b5af8bda2c3215b5f90979ec69db58221a534b022e41130fd5bc61c84184dcbeb18c99219b6b1fb7921586cedc1091d328800fa9907a04a4bb2a9cfe04c0f7422b76f5ac7b8e950bee789d0bc209593c717be8c4c3dc2334ac605f6f7160ea9e7059ae5af6dcc15817401e180cd9874470b31b647a63eeb6cf7eedabf3005bc33a3162f0238a5e15cff0d29e97303509606f606143df63e1a7cb3db9ac2cd0623279dbdd04141f538dc99aeb114d5300550002f47f2055207d476c128b9dc044e32917484d1f0f34cdd41fc397757efccef64cdf317f6fb200934b2e9eb468de8094debfaeb14d3e3df7846ebdc8e55609758c8a9c4e13add7946e49267bd28b8af11f2ec80506e230ea595f091b58fe0f27eb6627bb7d4e67008357e9a64d15067c3fa755e0a5565fcee885cb36461208f82bd6d9daaab983201900781f2a7bb83c958f0b77b18ad3464e52d28411f8e4d856c07a174191221f537dd03bedcdbe808ab5bae293ffa5394d428ca826141d17a203bd5075c603bf5cbb1e45d1668bbc37f88991e019a53df82449d6779419584547d6b9a4b297af5db2327488f4e66e9bb99792d652e58ec830fd3291b41024247d1410d94c7e829150bbe097b5cf61cfe846427068fa7493b300c4c327e25083fcedd07b70cd604dd1830a921963e372d4e45790c6251d381a426b9fc7c20792d031f265f7f3b825ce2b51911a58707a692f9bb53eef4225d8bd535b75cd9725f7db3e13f4be541cc47ec8905f48c3e61de30eb197c896ac68d7ddf8f1e13d093fc27f1c4b5f0a94280d49c9bf2c3f4d77e3f92d000a63226b79dd0f2195665046889ceee8d92dcd2250970ac7a870a282f29fdd3aaaac0bbd49285e08110982a906cde269ac16f19", 0x1000)
r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x8000, 0x0)
setsockopt$IP_VS_SO_SET_ZERO(r3, 0x0, 0x48f, &(0x7f00000013c0)={0x7f, @rand_addr=0x8001, 0x4e23, 0x3, 'sed\x00', 0x2, 0xedc, 0xd}, 0x2c)
ioctl$PIO_SCRNMAP(r4, 0x4b41, &(0x7f0000000280)="c344ab3e910a8ed62387520cde6d1ad08e172af12f650e2e761f4d76b214238627838c6d3199d794bba96aa3ce6b8af743be955b810f1ed35bbcc8a735a65915c772b5978f1656653af2cfb7c08b1cb73b051d1101d6d13b66b640aa92a64e370184d6479bc03389ad8d25fd7c62f36796cc085805e22e095578d3f80890b7be7ef42bd483fc9ee498c69d77654859c314862f0f80cc5efe715a4b54a2006322b545285254136d924370ce40497a94b2cf9aca72d23aa4a7a8b17186ea17a27c2a3676dbc56f4ec00a4f099a5a76809235225371f56f67926c")

2018/03/26 17:10:23 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x400000000e)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080)={0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4})

2018/03/26 17:10:23 executing program 3:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff})
ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x7f, 0x12, 0x20, 0x11, "f4a934c028d94fff374d78af926b3f98179552057c51cc08d7ac6114d25c81878b2952ab847a98b296f309f279aff4428b10096f594050ddf14733d8bcf9bd85", "8cd2054e6ccb40fe995d1e2b76338d525dcd5fe8133b1cf355068ce1954267b4", [0x20, 0xc93]})
syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000100)={{0x0, 0x1}, 0x3, 0x5})

2018/03/26 17:10:23 executing program 6:
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000080)={0x2, 'eql\x00'}, 0x18)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f00000000c0)={0x2, 'sit0\x00'}, 0x18)

2018/03/26 17:10:23 executing program 1:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)="2f70726f632f303f76732f73796e635f708072736973747a6d6f646500", 0x2, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r1=>0x0, <r2=>0x0})
ppoll(&(0x7f0000000000)=[{r0, 0x8040}, {r0, 0x20}, {r0, 0x12}, {r0, 0x28}, {r0, 0x2000}, {r0}, {r0, 0x8190}], 0x7, &(0x7f0000000080)={r1, r2+10000000}, &(0x7f00000000c0)={0x1f}, 0x8)

2018/03/26 17:10:23 executing program 0:
keyctl$get_security(0x11, 0x0, &(0x7f00001a7f91)=""/111, 0x6f)

2018/03/26 17:10:23 executing program 5:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000080)=0x10000, 0x4)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x6c)
modify_ldt$read_default(0x2, &(0x7f00000001c0)=""/175, 0xaf)
sendto$inet(r0, &(0x7f0000000000), 0x0, 0x20000802, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='syz_tun\x00', 0x10)
sendto$inet(r0, &(0x7f0000000180)="fc", 0x1, 0x0, 0x0, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000e5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000008000000000000000000040000000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={<r2=>0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000380)=[@increfs_done={0x40106308, r2}], 0x0, 0x0, &(0x7f0000000580)})

2018/03/26 17:10:23 executing program 4:
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
syz_fuseblk_mount(&(0x7f0000000000)='./control\x00', &(0x7f0000000080)='./control/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
rename(&(0x7f0000000240)='./control/file0\x00', &(0x7f00000001c0)='./file0\x00')
close(r0)

[   60.002444] binder_alloc: 8111: binder_alloc_buf, no vma
[   60.008060] binder: 8111:8117 transaction failed 29189/-3, size 40-8 line 3134
[   60.036191] binder: undelivered TRANSACTION_ERROR: 29189
[   60.043193] binder: release 8111:8117 transaction 189 out, still active
2018/03/26 17:10:23 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0)
fcntl$setsig(r0, 0xa, 0x16)
inotify_init1(0x80800)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000944fa8)={{0x0, 0x1}, 0x0, 0x80000, 0x0, {}, 0x0, 0x10})

2018/03/26 17:10:23 executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000910000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSLCKTRMIOS(r0, 0x540f, &(0x7f0000000000))

2018/03/26 17:10:23 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x200000, 0x0)
openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f0000000000)={0x7, 0xc7, 0x10001})
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x440000000e)
ioctl$TCSETS(r0, 0x80047456, &(0x7f0000000080)={0x0, 0x0, 0x2})

[   60.068791] binder: unexpected work type, 4, not freed
[   60.077789] IPVS: stopping backup sync thread 8150 ...
[   60.083825] IPVS: sync thread started: state = BACKUP, mcast_ifn = sit0, syncid = 0, id = 0
[   60.099822] binder: undelivered TRANSACTION_COMPLETE
[   60.105929] binder: send failed reply for transaction 189, target dead
[   60.123637] binder_alloc: 8148: binder_alloc_buf size 288230376151711744 failed, no address space
[   60.142342] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192)
[   60.170120] binder: 8148:8171 BC_INCREFS_DONE node 193 has no pending increfs request
[   60.178154] binder: 8148:8156 transaction failed 29201/-28, size 288230376151711744-0 line 3134
[   60.205178] binder_alloc: binder_alloc_mmap_handler: 8148 20ffb000-20ffd000 already mapped failed -16
[   60.215738] binder: BINDER_SET_CONTEXT_MGR already set
[   60.221283] binder: 8148:8156 ioctl 40046207 0 returned -16
[   60.221357] binder_alloc: 8148: binder_alloc_buf, no vma
[   60.221396] binder: 8148:8171 transaction failed 29189/-3, size 288230376151711744-0 line 3134
[   60.227689] binder: 8148:8172 BC_INCREFS_DONE u0000000000000000 no match
[   60.251312] binder: undelivered TRANSACTION_ERROR: 29189
[   60.258485] binder: undelivered TRANSACTION_ERROR: 29201

INIT: Id "5" respawning too fast: disabled for 5 minutes

INIT: Id "3" respawning too fast: disabled for 5 minutes

INIT: Id "6" respawning too fast: disabled for 5 minutes

INIT: Id "1" respawning too fast: disabled for 5 minutes

INIT: Id "2" respawning too fast: disabled for 5 minutes

INIT: Id "4" respawning too fast: disabled for 5 minutes
[  242.239062] INFO: task kworker/1:2:1773 blocked for more than 120 seconds.
[  242.246108]       Not tainted 4.4.124-g851fb4d #18
[  242.251050] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  242.259028] kworker/1:2     D ffff8800b6847a28 27704  1773      2 0x00000000
[  242.266444] Workqueue: events_power_efficient reg_check_chans_work
[  242.272892]  ffff8800b6847a28 ffff8800b6821800 0000000000000002 0000000000000007
[  242.280934]  ffff8800b6821800 ffff8801db31fdb8 ffff8801db31fde0 ffff8801db31f4d8
[  242.288906]  ffff8801db31f4c0 ffff8800b763b000 ffff8800b6821800 0000000000000000
[  242.297067] Call Trace:
[  242.299659]  [<ffffffff8376b59a>] schedule+0x7a/0x1b0
[  242.304826]  [<ffffffff8376bd93>] schedule_preempt_disabled+0x13/0x20
[  242.311420]  [<ffffffff83770356>] mutex_lock_nested+0x306/0x850
[  242.317454]  [<ffffffff82e85e27>] ? rtnl_lock+0x17/0x20
[  242.322823]  [<ffffffff83770050>] ? __ww_mutex_lock+0x14f0/0x14f0
[  242.329042]  [<ffffffff81d6867d>] ? debug_object_deactivate+0x26d/0x3c0
[  242.335854]  [<ffffffff82e85e27>] rtnl_lock+0x17/0x20
[  242.341043]  [<ffffffff83488d44>] reg_check_chans_work+0x74/0xf30
[  242.347252]  [<ffffffff83488cd0>] ? regdom_changes+0x140/0x140
[  242.353245]  [<ffffffff8117ff77>] process_one_work+0x7d7/0x16e0
[  242.359306]  [<ffffffff8117fe97>] ? process_one_work+0x6f7/0x16e0
[  242.365571]  [<ffffffff8117f7a0>] ? pwq_dec_nr_in_flight+0x280/0x280
[  242.372082]  [<ffffffff81181108>] ? worker_thread+0x288/0xfc0
[  242.377943]  [<ffffffff81180f59>] worker_thread+0xd9/0xfc0
[  242.383583]  [<ffffffff83778caa>] ? _raw_spin_unlock_irqrestore+0x5a/0x70
[  242.390554]  [<ffffffff811909c8>] kthread+0x268/0x300
[  242.395717]  [<ffffffff81180e80>] ? process_one_work+0x16e0/0x16e0
[  242.402060]  [<ffffffff81190760>] ? kthread_create_on_node+0x400/0x400
[  242.408703]  [<ffffffff81190760>] ? kthread_create_on_node+0x400/0x400
[  242.415381]  [<ffffffff83779b15>] ret_from_fork+0x55/0x80
[  242.420925]  [<ffffffff81190760>] ? kthread_create_on_node+0x400/0x400
[  242.427700] 3 locks held by kworker/1:2/1773:
[  242.432212]  #0:  ("events_power_efficient"){.+.+.+}, at: [<ffffffff8117fe5d>] process_one_work+0x6bd/0x16e0
[  242.442782]  #1:  ((reg_check_chans).work){+.+...}, at: [<ffffffff8117fe97>] process_one_work+0x6f7/0x16e0
[  242.453176]  #2:  (rtnl_mutex){+.+.+.}, at: [<ffffffff82e85e27>] rtnl_lock+0x17/0x20
[  242.461649] Sending NMI to all CPUs:
[  242.466576] NMI backtrace for cpu 0
[  242.470295] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.124-g851fb4d #18
[  242.477281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  242.486648] task: ffffffff84217840 task.stack: ffffffff84200000
[  242.492698] RIP: 0010:[<ffffffff81d18cf7>]  [<ffffffff81d18cf7>] rb_erase+0x967/0x1b60
[  242.500753] RSP: 0018:ffff8801db207d38  EFLAGS: 00000046
[  242.506186] RAX: ffff8801d9ab7648 RBX: ffff8801d9ab7638 RCX: 1ffff1003b356ec9
[  242.513561] RDX: dffffc0000000000 RSI: ffff8801db219710 RDI: ffff8800ac59fb60
[  242.520870] RBP: ffff8801db207d80 R08: 1ffff100174bd9b5 R09: 0000000000000001
[  242.528121] R10: 0000000000000000 R11: 1ffff1003b640f6a R12: ffff8801d9ab7639
[  242.535412] R13: ffff8800ac59fb50 R14: ffff8801db219c40 R15: ffff8801d9ab7638
[  242.542693] FS:  0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
[  242.550946] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  242.556816] CR2: 00007f65d39f6d0d CR3: 00000001d305a000 CR4: 0000000000160670
[  242.564110] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  242.571558] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  242.578812] Stack:
[  242.581032]  ffff8800ac59fb50 ffffffff84217840 fffffbfff0843023 ffffffff842bdb60
[  242.588557]  ffff8800ac59fb50 ffff8801db219710 ffff8801db219718 0000000000000000
[  242.596125]  0000000000000000 ffff8801db207db0 ffffffff81d24118 ffffffff842bdb60
[  242.603679] Call Trace:
[  242.606248]  <IRQ> 
d [<ffffffff81d24118>] timerqueue_del+0x78/0x170
[  242.612766]  [<ffffffff812ac980>] __remove_hrtimer+0x90/0x250
[  242.618635]  [<ffffffff812adc58>] __hrtimer_run_queues+0x238/0xfe0
[  242.624994]  [<ffffffff812ada20>] ? hrtimer_fixup_init+0x70/0x70
[  242.631164]  [<ffffffff812b0191>] ? hrtimer_interrupt+0x131/0x440
[  242.637377]  [<ffffffff812b0206>] hrtimer_interrupt+0x1a6/0x440
[  242.643447]  [<ffffffff810b0e7a>] local_apic_timer_interrupt+0x6a/0xb0
[  242.650112]  [<ffffffff8377c336>] smp_apic_timer_interrupt+0x76/0xa0
[  242.656582]  [<ffffffff8377b290>] apic_timer_interrupt+0xa0/0xb0
[  242.662746]  <EOI> 
d [<ffffffff810d0666>] ? native_safe_halt+0x6/0x10
[  242.669413]  [<ffffffff81027e85>] default_idle+0x55/0x3c0
[  242.674925]  [<ffffffff810293fa>] arch_cpu_idle+0xa/0x10
[  242.680388]  [<ffffffff812217c8>] default_idle_call+0x48/0x70
[  242.686245]  [<ffffffff81221ecd>] cpu_startup_entry+0x5fd/0x8f0
[  242.692313]  [<ffffffff83778caa>] ? _raw_spin_unlock_irqrestore+0x5a/0x70
[  242.699249]  [<ffffffff812218d0>] ? call_cpuidle+0xe0/0xe0
[  242.704859]  [<ffffffff83766529>] rest_init+0x189/0x190
[  242.710235]  [<ffffffff84823811>] start_kernel+0x6b9/0x6ee
[  242.715832]  [<ffffffff84823158>] ? thread_stack_cache_init+0xb/0xb
[  242.722262]  [<ffffffff84822120>] ? early_idt_handler_array+0x120/0x120
[  242.729029]  [<ffffffff84822120>] ? early_idt_handler_array+0x120/0x120
[  242.735763]  [<ffffffff84822312>] x86_64_start_reservations+0x2a/0x2c
[  242.742353]  [<ffffffff84822454>] x86_64_start_kernel+0x140/0x163
[  242.748584] Code: 3c 21 00 0f 84 b4 fc ff ff 48 89 55 c0 48 89 45 c8 48 89 75 d0 e8 6a 62 7e ff 48 8b 55 c0 48 8b 45 c8 48 8b 75 d0 e9 92 fc ff ff <48> ba 00 00 00 00 00 fc ff df 48 89 c1 48 c1 e9 03 80 3c 11 00 
[  242.767609] NMI backtrace for cpu 1
[  242.771243] CPU: 1 PID: 487 Comm: khungtaskd Not tainted 4.4.124-g851fb4d #18
[  242.778494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  242.787874] task: ffff8800bac44800 task.stack: ffff8800bac48000
[  242.793937] RIP: 0010:[<ffffffff810c3fa7>]  [<ffffffff810c3fa7>] flat_send_IPI_mask+0xf7/0x1a0
[  242.802720] RSP: 0018:ffff8800bac4fcb8  EFLAGS: 00000046
[  242.808150] RAX: 0000000003000000 RBX: 0000000000000c00 RCX: 0000000000000000
[  242.815437] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fb300
[  242.822725] RBP: ffff8800bac4fce0 R08: 0000000000000001 R09: 0000000000000000
[  242.830018] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000246
[  242.837268] R13: 0000000000000003 R14: ffffffff8426f5a0 R15: 0000000000000002
[  242.844572] FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
[  242.852830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  242.858700] CR2: 00007f65d39f77d0 CR3: 00000001d9294000 CR4: 0000000000160670
[  242.865990] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  242.873265] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  242.880567] Stack:
[  242.882704]  ffffffff8426f5a0 ffffffff847f09c0 fffffbfff08fdbec dffffc0000000000
[  242.890253]  ffff8801db31bca0 ffff8800bac4fd00 ffffffff810b9adb ffffffff839f6e40
[  242.897767]  0000000000000003 ffff8800bac4fd60 ffffffff81d115a4 ffffffff8141b803
[  242.905322] Call Trace:
[  242.907884]  [<ffffffff810b9adb>] nmi_raise_cpu_backtrace+0x5b/0x70
[  242.914312]  [<ffffffff81d115a4>] nmi_trigger_all_cpu_backtrace+0x4a4/0x550
[  242.921423]  [<ffffffff8141b803>] ? print_lock+0xab/0xae
[  242.926852]  [<ffffffff810b9a80>] ? irq_force_complete_move+0x3b0/0x3b0
[  242.933638]  [<ffffffff810b9b74>] arch_trigger_all_cpu_backtrace+0x14/0x20
[  242.940671]  [<ffffffff8136944a>] watchdog+0x6fa/0xae0
[  242.945931]  [<ffffffff81368e13>] ? watchdog+0xc3/0xae0
[  242.951302]  [<ffffffff811909c8>] kthread+0x268/0x300
[  242.956462]  [<ffffffff81368d50>] ? reset_hung_task_detector+0x20/0x20
[  242.963139]  [<ffffffff81190760>] ? kthread_create_on_node+0x400/0x400
[  242.969795]  [<ffffffff81190760>] ? kthread_create_on_node+0x400/0x400
[  242.976439]  [<ffffffff83779b15>] ret_from_fork+0x55/0x80
[  242.981969]  [<ffffffff81190760>] ? kthread_create_on_node+0x400/0x400
[  242.988609] Code: b3 5f ff f6 c4 10 75 e1 44 89 e8 c1 e0 18 89 04 25 10 b3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 b3 5f ff <41> f7 c4 00 02 00 00 74 1a e8 8b 31 17 00 4c 89 e7 57 9d 0f 1f 
[  243.007917] Kernel panic - not syncing: hung_task: blocked tasks
[  243.014044] CPU: 1 PID: 487 Comm: khungtaskd Not tainted 4.4.124-g851fb4d #18
[  243.021288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  243.030612]  0000000000000000 b8f6cd777a8c0e64 ffff8800bac4fca8 ffffffff81d0663d
[  243.038583]  ffffffff838831a0 ffff8800bac4fd80 dffffc0000000000 7fffffffffffffff
[  243.046554]  ffff8800b6821c48 ffff8800bac4fd70 ffffffff8141b2da 0000000041b58ab3
[  243.054527] Call Trace:
[  243.057087]  [<ffffffff81d0663d>] dump_stack+0xc1/0x124
[  243.062421]  [<ffffffff8141b2da>] panic+0x1aa/0x388
[  243.067408]  [<ffffffff8141b130>] ? percpu_up_read.constprop.45+0xe1/0xe1
[  243.074304]  [<ffffffff81d114f8>] ? nmi_trigger_all_cpu_backtrace+0x3f8/0x550
[  243.081546]  [<ffffffff81d114f8>] ? nmi_trigger_all_cpu_backtrace+0x3f8/0x550
[  243.088790]  [<ffffffff8136945b>] watchdog+0x70b/0xae0
[  243.094033]  [<ffffffff81368e13>] ? watchdog+0xc3/0xae0
[  243.099366]  [<ffffffff811909c8>] kthread+0x268/0x300
[  243.104526]  [<ffffffff81368d50>] ? reset_hung_task_detector+0x20/0x20
[  243.111159]  [<ffffffff81190760>] ? kthread_create_on_node+0x400/0x400
[  243.117793]  [<ffffffff81190760>] ? kthread_create_on_node+0x400/0x400
[  243.124428]  [<ffffffff83779b15>] ret_from_fork+0x55/0x80
[  243.129932]  [<ffffffff81190760>] ? kthread_create_on_node+0x400/0x400
[  243.137160] Dumping ftrace buffer:
[  243.140707]    (ftrace buffer empty)
[  243.144388] Kernel Offset: disabled
[  243.147998] Rebooting in 86400 seconds..