0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) futex(&(0x7f000053c000-0x4), 0x400000085, 0x0, &(0x7f00008b5000)={0x0, 0x989680}, &(0x7f0000000000), 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f000053b000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$DRM_IOCTL_VERSION(r0, 0xc0246400, &(0x7f0000ed3000)={0x3ff, 0x1, 0xba, 0x9d, &(0x7f0000452000)=""/157, 0x36, &(0x7f0000e99000-0x36)=""/54, 0x9e, &(0x7f00003c4000)=""/158}) [ 78.636147] binder: 9942:9955 transaction failed 29201/-71, size 48-80 line 2757 [ 78.656734] IPVS: ftp: loaded support on port[0] = 21 2018/02/04 21:33:26 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000db0000-0x20)={{&(0x7f0000782000/0x2000)=nil, 0x2000}, 0x20001}) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x401) removexattr(&(0x7f0000afc000)='./file0\x00', &(0x7f0000ec6000)=@random={'trusted.', '/dev/input/event#\x00'}) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000013000)) write$evdev(r1, &(0x7f000011c000-0x90)=[], 0x0) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000eb0000)={0x0, 0x0, 0x1, 0x0, 0x0, 0x81}) close(r0) r2 = syz_open_dev$midi(&(0x7f00000b1000-0xb)='/dev/midi#\x00', 0x100, 0x2000) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000aa7000-0xc)={0x0}, &(0x7f0000612000-0x4)=0xc) ioprio_get$pid(0x2, r3) pipe(&(0x7f0000efb000-0x8)={0x0}) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f0000c0f000-0x4)=r4) 2018/02/04 21:33:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:26 executing program 0: mmap(&(0x7f0000000000/0x1f000)=nil, 0x1f000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000012000)={0xffffffffffffff9c}) mmap(&(0x7f000001f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000020000-0x8)={0x0, 0x20}, &(0x7f000000c000-0x4)=0x8) mmap(&(0x7f000001f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f000001f000)={r1, 0x80, 0x3, 0x6}, 0x10) r2 = socket$inet(0x2, 0x6, 0x0) mmap(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_dccp_buf(r0, 0x21, 0xf, &(0x7f0000015000-0xc8)=""/200, &(0x7f0000020000)=0xc8) mmap(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mount(&(0x7f0000020000)='./file0\x00', &(0x7f0000003000-0x8)='./file0\x00', &(0x7f0000021000-0x5)='adfs\x00', 0x880000, &(0x7f0000004000)="13b9114fecbff0834e363954856fda37c8c2ff7029ea5a5e66e216dacccbdf93fadc800e36f125e16ec4c7ebe05bfb7250fc776be541cc29143c") setsockopt$IPT_SO_SET_REPLACE(r2, 0x10d, 0xf, &(0x7f0000015000)=@filter={'filter\x00', 0xe, 0x4, 0xfffffffffffffd6f, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000042000), {{{[], 0x0, 0x70, 0x98}, {0x10, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@uncond, 0x0, 0x11, 0x98, 0x0, {}, []}, @REJECT={0xf, 'REJECT\x00'}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@ip={@broadcast=0xffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0x0, 0x0, @generic="220ae9d3c6476e358eac15d6f74385af", @syzn={0x73, 0x79, 0x7a}}, 0x0, 0xffffffffffffffd1, 0xffffffffffffff53, 0x0, {}, []}, @REJECT={0xffffffffffffffa0, 'REJECT\x00'}}]}}, 0xc5) r3 = creat(&(0x7f0000004000)='./file0\x00', 0x0) mmap$binder(&(0x7f000000e000/0x3000)=nil, 0x3000, 0x1, 0x40010, r3, 0x0) 2018/02/04 21:33:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f00005b0000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000c6b000-0x94)=""/148, &(0x7f00006e7000-0x4)=0x94) syslog(0x9, 0x0, 0x0) vmsplice(r1, &(0x7f00007f0000)=[{&(0x7f0000037000-0x3c)="e1", 0x1}], 0x1, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000e29000-0x8)=0x1) write(r1, &(0x7f0000335000), 0xfc94) bind$alg(r1, &(0x7f00007bb000-0x58)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(cast6)\x00'}, 0x58) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000f6f000-0x11)='/dev/vga_arbiter\x00', 0x4a0040, 0x0) writev(r1, &(0x7f000014c000)=[{&(0x7f0000e9e000-0x2)="c27f", 0xfffffffffffffda6}], 0x1) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00003cb000)) [ 78.682898] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:26 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000de9000-0x16)='/selinux/checkreqprot\x00', 0x8000, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r0, 0x8040ae9f, &(0x7f0000cf9000)) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:26 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000004000)='map_files\x00') getdents64(r0, &(0x7f0000001000-0x1000)=""/24, 0x18) getdents(r0, &(0x7f0000f34000), 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f00007be000)={0x5, 0x4, 0x19d, 0x0, 0xc}) 2018/02/04 21:33:26 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000494000-0x9)='/dev/ppp\x00', 0x400, 0x0) write$eventfd(r1, &(0x7f00002df000)=0x536, 0x8) socket$inet6(0xa, 0x5, 0x1) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1b, &(0x7f00003f9000+0xc8b), &(0x7f0000000000)) 2018/02/04 21:33:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 78.746121] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/04 21:33:26 executing program 3: mmap(&(0x7f0000000000/0xfc4000)=nil, 0xfc4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1000000010, 0x802, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00004bd000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) sendmsg$nl_route(r0, &(0x7f0000f73000-0x38)={&(0x7f0000f81000)={0x10}, 0xc, &(0x7f00002ca000-0x10)={&(0x7f0000ef2000)=@ipv4_newaddr={0x20, 0x14, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0x2, 0x0, 0x0, 0x0, r1}, [@IFA_LOCAL={0x8, 0x2, @empty}]}, 0x20}, 0x1}, 0x0) setsockopt$inet_buf(r0, 0x0, 0x2b, &(0x7f00005a5000)="ef99ebd6c0bb9d8aab0afa9587b55b5ee044bfa97152c32bb5daa2a77cb2b5edc5f9bae4737059fc971bbe4db220c8498de854e13aa485a77dd0ea021d06c731ea3b2edbb22bb7aefdbf20cc53b5d03ffbd80941125b3535f0cddb13032f868ed89b71459742f25882ae6f7618cf757bfd5c640924658d931c60421622a85b1a9ffe97b3c18738f8a23b5d1f02814f0fa222bffa9100a1bd", 0xfffffffffffffef7) 2018/02/04 21:33:26 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1, 0x0, 0x0) connect$inet6(r0, &(0x7f00000b9000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0x100000002}, 0x1c) sendto$inet(r0, &(0x7f000050a000-0x6e), 0xff77, 0x8000, &(0x7f0000560000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) connect$inet(r0, &(0x7f00007c0000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x10) sendmsg$inet_sctp(r0, &(0x7f00006fd000)={&(0x7f0000d0a000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0xb9, &(0x7f00008e2000-0x90)=[], 0x0, &(0x7f0000576000)=[]}, 0x0) 2018/02/04 21:33:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000235000-0x58)={0x26, 'hash\x00', 0x0, 0x0, 'tgr128\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000adc000-0x140)=[{{&(0x7f00002d8000-0x10)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}}, 0x10, &(0x7f000010e000-0x38)=[{&(0x7f000013f000-0xe0)='F', 0x1}], 0x1, &(0x7f000015a000-0x2160)=[{0x7c, 0x195, 0xffffffffffffff5d, "f12d3624476a2f0d0793828de81c98fced274fd7edf8904c5463306138b4df3a6414eb3c39b82e8c801ecfe0bea32d69fb9590ce4241b95239797b7732aa5893c391dc4ca9789c039c2a7d4eb5b2d3d5f9c4d038a634a79fa1595830bbbf9ae2812e23dcd8bf1795c8f4c8cd9016"}], 0x7c, 0x4}, 0xffff}, {{&(0x7f0000adf000)=@vsock={0x28, 0x0, 0x0, @reserved=0x1}, 0x10, &(0x7f000075b000)=[{&(0x7f000056d000-0x40)="2ce608840157a85db0d053bd6940742864ce4b5810a96ab3ef74b3d86f98c29b51fc11867f159228b44f8afcad299a81324f696744f26818b47fd071b6fef54a", 0x40}], 0x1, &(0x7f0000bb9000)=[{0x4c, 0x11f, 0x937a, "920c8aee55904b4907048289ff26ad31e3766706676ed9a7d47a06bb248a8bd38ade777fd9a0cb479044d58c82f75a3d5f112f1cadf09a088468a33b504f4c"}], 0x4c, 0x10}, 0x400}], 0x2, 0x100000000000) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000755000-0xd)='/selinux/mls\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000d23000)={0x0, 0x8000}, &(0x7f00009ef000-0x4)=0x8) ioctl$EVIOCSKEYCODE(r2, 0x40084504, &(0x7f0000521000)=[0x3, 0x9]) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r2, 0x800448d2, &(0x7f00008eb000-0x8)={0x3, &(0x7f00009a0000-0x1bc)=[{}, {}, {}]}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00006cc000)={r3, @in={{0x2, 0x2, @rand_addr=0xffffffffffffffb3}}, 0x3f, 0x8}, &(0x7f0000179000)=0x98) 2018/02/04 21:33:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000a3c000)='net/rpc\x00') readlinkat(r0, &(0x7f0000b78000)='./file0\x00', &(0x7f000037b000-0xe9)=""/233, 0xe9) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000c00000)=0x10000) getdents64(r0, &(0x7f000064e000)=""/48, 0x30) [ 78.789388] binder_alloc: 9991: binder_alloc_buf, no vma [ 78.794995] binder: 9991:9993 transaction failed 29189/-3, size 24-8 line 2957 [ 78.851682] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:26 executing program 5: syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:26 executing program 6: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x400000, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r0, &(0x7f0000001000-0x1c)={&(0x7f0000e39000)={0x10, 0x0, 0x0, 0x11080000}, 0xc, &(0x7f000019b000)={&(0x7f000044c000)={0x20, 0x3b, 0x300, 0x6, 0x0, {0x1d}, [@typed={0xc, 0x3e, @ipv4=@broadcast=0xffffffff}]}, 0x20}, 0x1, 0x0, 0x0, 0x4c000}, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f00008af000-0x60)=[{{&(0x7f0000437000)=@pppoe={0x18, 0x0, {0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, @syzn={0x73, 0x79, 0x7a}}}, 0x1e, &(0x7f0000c6e000)=[], 0x0, &(0x7f0000102000)=[]}}], 0x1, 0x0) 2018/02/04 21:33:26 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000582000-0x8)={0x19980330}, &(0x7f00005cd000-0x18)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f0000987000)={@common='bridge0\x00', @ifru_data=&(0x7f0000a7b000-0x20)="04000000000000000200000020000005000000d8000000edfffffff5fffffc23"}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000ebb000-0x16)='/selinux/checkreqprot\x00', 0x10002, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000b38000)={0xaa, 0x40}) 2018/02/04 21:33:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x1, 0x0) getsockname$ipx(r0, &(0x7f0000900000-0x10), &(0x7f0000556000)=0x7) getpeername$inet(r0, &(0x7f0000f2f000-0x10)={0x0, 0xffffffffffffffff, @dev}, &(0x7f0000394000-0x4)=0x10) 2018/02/04 21:33:26 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000c56000-0x6)='smaps\x00') getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00004c0000)={0x0, @remote, @empty}, &(0x7f0000b3f000+0xd13)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000691000)={0x0}, &(0x7f00002ce000-0x4)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000546000-0xc)={0x0}, &(0x7f00003aa000-0x4)=0xc) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f000031a000-0x8)={0x100000001, 0xffffffffffff0001, 0x2, 0x40}, 0x8) sendmsg$nl_route(r1, &(0x7f0000b2b000-0x1c)={&(0x7f0000b6e000)={0x10, 0x0, 0x0, 0xc01000}, 0xc, &(0x7f000017f000)={&(0x7f000050f000)=@bridge_dellink={0x15c, 0x11, 0x800, 0x0, 0x0, {0x7, 0x0, 0x0, r2, 0x18220, 0x4010}, [@IFLA_EVENT={0x8, 0x2c, 0x401}, @IFLA_VF_PORTS={0x11c, 0x18, [{0xc, 0x1, [@generic="3c02fc328587"]}, {0x10c, 0x1, [@generic="1b1509cfcad0419324188f9395ec172025bb5638f93c738945cd7516119bf8eade83b770f415b39d3c6a69e2afb08cb39c8f9dda2e95b6de724cc5e154eacdfc4a4d3097ba1ae3151227b70741ffb2bc66cfbc0337601bc3a719e0050a4e31e8322055878fcd3bb553c4f17eea1c1dcb9404f1c3cb13db468e366b1d24856bed6d1e85f37009de5824cc9300c6cfe626263a252acd4b146f6bb29bb337cfecbcaa767018f830fb0aedb8dcfc410da5decb2f8456789c6a654b3ea97395da51c01e9ed9604aea0a0e00840dbbc35a42e0ff929be80eb7791b7c2f8975826b9132a8da3693f49a", @nested={0x14, 0x83, [@typed={0x10, 0x37, @u64=0x1}]}, @typed={0xc, 0x78, @pid=r3}]}]}, @IFLA_LINK={0x8, 0x5, 0xcc}, @IFLA_NET_NS_PID={0x8, 0x13, r4}, @IFLA_OPERSTATE={0x8, 0x10, 0x1f20}]}, 0x15c}, 0x1, 0x0, 0x0, 0x4}, 0x1) bind$alg(r0, &(0x7f00008de000-0x58)={0x26, 'hash\x00', 0x0, 0x0, 'rmd160-generic\x00'}, 0x58) r5 = accept4$alg(r0, 0x0, 0x0, 0x0) sendfile(r5, r1, &(0x7f00008ef000), 0x400000c6) ioctl$int_in(r0, 0x5421, &(0x7f0000368000-0x8)=0x7) 2018/02/04 21:33:26 executing program 4: mmap(&(0x7f0000000000/0x6000)=nil, 0x6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) sendto$inet6(r0, &(0x7f0000003000), 0x312, 0x0, &(0x7f0000000000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000005000)=@dstopts={0x3f, 0x21, [], [@jumbo={0xc2, 0x4, 0x1}, @generic={0x327c, 0xaf, "b5902da5d33db66866bb2e0708339a0595b7877c0cada48c070300a402048f95611608e7e2f2752e09dafc419fda9741a187685490d8d74db3050dd9e2a55287765d65221e7d3d2f3190cb84ed85201f65449c3453d6f2e6568c7e9c3cce26d9780b19a4245a1b7ec75484bf3ec1b46133599539f556b698022a91d8e3ab6a76b680fcaf802efbf3b9dce94916b133a0ef17a3bdaf3c5e95d765e9bd6d2daa72aa03b69692ba41115996f650a86c21"}, @ra={0x5, 0x2, 0x80000000}, @ra={0x5, 0x2, 0x13c}, @calipso={0x7, 0x40, {0x81, 0xe, 0x5, 0x400, [0x0, 0xffffffffc21bcb18, 0x80000001, 0xffffffff80000001, 0x2, 0x1f, 0x0]}}, @enc_lim={0x4, 0x1, 0xfa7}, @jumbo={0xc2, 0x4, 0x9}]}, 0x112) 2018/02/04 21:33:26 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000a8a000)='./file0\x00', &(0x7f0000b9c000)='./file0\x00', &(0x7f00007ad000-0x8)='cgroup2\x00', 0x0, 0x0) llistxattr(&(0x7f00003e8000)='./file0\x00', &(0x7f0000bf0000-0xa0)=""/160, 0xa0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00007fe000-0xc)='/dev/autofs\x00', 0x200000, 0x0) ioctl$KVM_PPC_ALLOCATE_HTAB(r0, 0xc004aea7, &(0x7f0000fdc000)=0x1f) r1 = socket$bt_cmtp(0x1f, 0x3, 0x5) sendto$ipx(r0, &(0x7f00004b6000-0xef)="bfe252bba9a2350d0e99f601293a7f05c3726ac8e39f2c88230552b1877d33e9dc59b4b940ba72d56de4478fb33ab9c0dafdfc411f7f3223a2e1d91c46351e05c860b3bf9dd8103cfbc985240bef469cf20e9fc6dd1681cc44402dbb7d304e9b8107b62154fee7e95d7d6b4c6ff6ded4ab3356a00f084f383257ddad3d660d79b7c5fc431d5e25686d04ec8aef25e4acd220e76795e743b18994dd1724c1517ee040d0dc77f08ce07d60029e73ff6c8e09575a0d612b8a0dfa0112b8d6a29c32abdd492ff42a5fa770f84369afd52e842d2c3e968535d0a36a3d27215f45b5f3ce70aa3ad7cb913d4b99a18eb2a9ad", 0xef, 0x80, &(0x7f0000cf9000-0x10)={0x4, 0x5, 0x2, "98d139e77426", 0x5}, 0x10) accept4$packet(r0, &(0x7f000023f000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f000022d000)=0x14, 0x80000) symlink(&(0x7f0000e92000-0x8)='./file0\x00', &(0x7f0000b7d000-0x8)='./file0\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000e14000)={{{@in6=@loopback, @in6=@remote, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f0000952000-0x4)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000b20000)={{{@in6=@empty, @in6=@local, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@dev}}, &(0x7f0000353000-0x4)=0xe8) r5 = geteuid() getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000158000)={{{@in6=@ipv4={[], [], @rand_addr}, @in6=@mcast1, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000d04000-0x4)=0xe8) fcntl$getownex(r1, 0x10, &(0x7f000068d000-0x8)={0x0, 0x0}) sendmsg$nl_route(r0, &(0x7f00007a8000)={&(0x7f0000cd2000-0xc)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f000056a000)={&(0x7f0000b3d000)=@newlink={0x24c8, 0x10, 0x20, 0x5, 0x1, {0x0, 0x0, 0x0, r2, 0x4, 0x5020}, [@IFLA_MAP={0x28, 0xe, {0x4, 0x1f8, 0x101, 0x3f, 0x6, 0x3ff}}, @IFLA_XDP={0x90, 0x2b, [@generic="b21774358a883fa0c689184c9217b943ad95d03e50f4a9834333c84b8b6fca8cbc4894f2210743da08a8538733d3d5a6c0172addd2a06aa031542aad29e165ec3a3a6735ffddb7f4b1b9", @generic="65dac6e0a5b2b223aa689c032b9db8f14a87ccf4b5b9ac4d996a6ef968aac13694b51b764c6af3320c3305ea295f586d386d1a566aa3e7ea12d262c22388ad3637"]}, @IFLA_VF_PORTS={0x23e0, 0x18, [{0x2fc, 0x1, [@nested={0x170, 0x66, [@generic="84a1f60e59df5b49cdaf070504c5c1b9191b608076a2be8c85316152d292ca1220bb5bf2863f726de3b9ae518b1a6174fcd8b30ce0cb20860450dc107c97cc9ff5bb2f5912e4166366b1640c12b2680006a5466c923e0807214168cff411e4eb0e6d7b8e80bdf929d69d53533f56c031aa5a2446da66512ef665853ce2e5094a6f35f89260f4caef4318545c43e10bd88787394fb0c738da8e1315e2a0e5bed553771303623e47787854a820c185521197875fd139aa304509ab110d94c1c2", @typed={0x10, 0x1c, @str='cgroup2\x00'}, @typed={0xc, 0x77, @fd=r1}, @generic="b951d68f50ed73bf2992329b0ebb71134c04e2611aec38eb9970b9c96a0f75f4", @generic="244e13bb303884a60e930be46f49c6310ae0ea66f49a3a7808b589cefbdc469c8afa915d845987a2d6e7747f53a20b8da95d5c4f6b55fd8039e82022fc7108e61686f6d3ac3f57785bd17ae4c0ce74e1b57f40c68d256e273659a5dfc415f50b600fb0f54541514283b90f1affa9df"]}, @typed={0xc, 0x73, @uid=r3}, @typed={0x10, 0x86, @u64=0x9}, @generic="a285fd184f1d38e3b7d1f43f44265f6a074a8f464a7f582a087117dabe27815a405196d211e8aee0bbcd494bd897ac0e55db35b76a4d445c5cb4d55eb499a86b1533eceb0bbdebd6fca69bfac2fa291683c04965eaaa5d78e05cdcb37e580c0f44cd9ed8d4aa20fe69ed2de91be6e467907895f6192959c1b6b54d0b4cf1cfc3d235edc18ef032b402223869d5ae464b312612a0cfd30cc91a80b3598c35ec02cb94bd85ab672320d332f45f342b6fc3bc2d459a7747e70d94e660c2e42b6c7403e1bd9b7f4e827f2754e6ca1abacc1a29cb55c5b8f4010f3f40", @generic="712a5b718695515b804df7d1614e2a43049b002072bf28b6f973dc7b981435d48daa713902df84b2dcc112d06dd60a81118b0ee147cc69ab8d253f04f83ac434550a4b7975c61dc608798200a5c56b1a15e7b3049a76dcac773adcd72153852dbda0f77d8ad3c7175e1833a0750932a195a481f39c6d3b9cd3f5c6", @nested={0x10, 0x87, [@typed={0xc, 0x83, @ipv4=@broadcast=0xffffffff}]}, @generic="ab1ea7cb"]}, {0x13b0, 0x1, [@typed={0x28, 0x3e, @str='securitysecurity{wlan1,vmnet1!\x00'}, @generic="8a4064fe34bff050a4d26be1c83b2dcdb73bee50d83ab62e2d3e74d23396c89c22ce587a837fed66ca4186daf2f2033027f4ef0c57dbf77cf81387030b4e22312d66a4b55d77ad24dc678edc758f93e387df25cf86abdddb92d194686d19ced25710598a92d4cdb116a111caedc03b6689178a0ceb38c7284eabe83666f19483cc15e2213b0326891dac2f47345a04a219247da6d585d84a07f851f52122d85daea5a73981bf2170a42f03ee8213fc794963ff01e7a6a72acb72c5c8d4a59ee56755af704706f0b5bc59d4b6ac98585000a4fa12c049f8411fcc2052", @generic="10c324f65eeb703d9e", @generic="5f96335160d7d22bebfd8318bb9f9bae9493cec3efd94c95d891c6d11d901e0448c877a91d9e84697a82f508553a4e30e3c22417e04b0f47fe94a5d98e02d85f723b20c3b1b808b2c00afc15e37ff49a4791a83f0f7c18c4b2de8cc8b80be8453c052e878c06dbacf0e6848a4ef4b07458f6f642ec6fbdcb279b1b696386faf5b53ca00e2d0682801d47bf1a67285e891f5ed421fe4bb484ff0fccf662a89c2d685ebbd75e9d87e1fc4a0759eb4112ae3f8675d6561d8b4fd9185c1a29a588", @nested={0x1104, 0x8e, [@typed={0xc, 0x53, @fd=r0}, @generic="d70e713bea862cdca833d799427ba86679e0be518fd25a61497f14bba5d21d8456af458c350f16082746a253a00c742ad80ca96386e61a4ab6929c36b886d68e957322698856e0d3fdb4e23409", @typed={0x8, 0x4c}, @typed={0x14, 0xb, @str='/dev/autofs\x00'}, @generic="ca541d624005d5f72915554fbb66a560d249a081b3c47a5020fe2f96b15ba40e31634db72ab43422cef2fce994569810102ad17eb4164a280a11cc6adae1afd7d42f205f923c9423c3fa275d0da362524996a2fbcc284b043d30fc5ffc039c3425e4a8ae397c11620448f33ac0dbda0749ee7630a039b780ec04c5423c3f74f82c3653d0ee23ce19585e35435ad585f538adfb3af1b4629555c714f93dd37c26a595eb376790a0a581b149d8e4f9aa0213d4d7c5de9ac82ec547be499a1cc27718f0079090b36ebf47eb4101fd84cb647f170f591d67c42cfdbb1ad1118e6884f68a4a4ea515af3332d03a8e975bc911b2215299c68887d3ee3f4b41e0381dbce3ef668e1ac162062933ccb359fdb1dcbee9213eb53b4ddf08ec394baea6d6e3fe11a160e04af8ccb0f7d15b82afdebdcad0fffc4bbd82f812a83e91c2261d692da149d5c77d8ef345a99636e55dd7b72c0e7e51435560ac030f096f5ba1493be04b6f016e08490fb5f539af1f0700b118a5d943f6ca2450728161b7ed9f67a2c054d7bc6ca5673e0df3e0723223c3fe4620e6c728e4191106c81b006af6f1ee59bfa8f0ef2d5471c35c4a94168593968ecdf37556c665c2a4cd65cdd7f4c6a065bb70052e3c55a08d63cf9f45e4231b635902b5cf17294516657690db15e1e68e259f55a1e4ea352f9d6d5b7a6a81e7ce1d28ed2d0e2fd86480a84900d2464f3d8fc9867160ca037b55b82bff31c7f0174538e5a2d5663523ad897bf8e532c1f3c71167e108db595432c446f5122dbdfe49c734fc17027fa23f8c447eeb37349d9eceb3de80c65aeda3182fa88e545076e6045d9f7456c11afeefd39ec9daa10c4a70bf56194d89c1595fc4d601011c8481cc22c6e958690de58cea0ac3163114665c03f72bedf2436e6af60e86b078cd91d28cd3b6ce724fd95dbb53e1fa972e67807904bd07dd0b2e2528a4cc483a85fbba75193b3192a2bfbc4798b3b9b97b377c2cf16829690b970826a9b1fc0f8fdcec103ee5bd42a552a50cdebadd4f52b729f1d99e3182a34ca8d166600b19938a5f910a037a40fc4397ab2ef691277cba558f7eceb4b189ae588c42aad559241454a8203a8e904b399e5348c2a9e0e11ed5c9991195ae2064af86ffc44ab2d802202ecea535d9156e04d5d45e97234748976c49ac4a3450dccd239f48fdea55f037953b6653b59a38e4f867c54b373fdd741e1f027a7ff4e6b149d14fa6998b2d8925faa4f85575fba50d6bace5002d26e1ad6dbeb50961df400e99e880e0021362a7c17a23ff9a81002d1c2befdd191666990961aa141be60f43182a9927a5acb8c4ce64690bec149e81caee082986f4fc287d634ae787db6edb4e9864d25e557a73f615b89beb6c4ff6c61154bc64679858b6a623ca3585c4d72fa1b92470387f52d5f3af374abe4d12c8574e64d83c7b4fbf5e753d9d47d8ae30c18d1ff5702fac56e390597eef7b2f80094b3a15941983e575da1bf31ad9e4386cde0d39e3d4a5e0c356ab1397f58a9ce1aad8d77858c113b9db647682c97e40554566417036c47b7984afb4f826cef6e5983a791f76a8f5066acf0a5364e4292fb5627c78c317f486389d2c7e61aa2e031199609c946a2ed5fe4d873a419a209869e349f45addc56f3e5749ee24bef9d11c1e7ed1c7412888d411a3b2b0a8bb707b66c41e74060d5f22c4120bbaae0cf3cca572166b0fdd1bee2b654bd97483cc0a8caa5316c212d6cc58cc14c6799f64ca7938ba58729ee408fb0a55625d7c7689214e36f36c0f851873a4934117b92a39e78cf1b2830fddd0ba6570e7f1df1092d35f93b1948bf0f017fc598e7161ea7a0856729c20147f4d9bf0871525e17c19db1701a55868a3b87f6d9926b79e15bb30c463d5ad431146f9f7bb695ceaa7fa3e63370a62c58dfad7a80e2ef875d17dc22096ffb493302b0d5e0d846878cc3fbc4fcdc896e38497b509a8a6ada6d30f968152415d2889345902db05616e79b6e99b80cb631063ae13bb8c1015f8b7bcb12ce061a48910a48e341612c307f6bb720eb66603a77b3d6e4a88ab186d07a8bb44393d930988de17abc3548bfeb28d57d2fc3b65b4d67164260a59452168cc37b28b018381c7e02e370d225f612045cc8d9a621aecc2e3a37d0a827f896b54a337b5d0fcceba993459b4d659425252de9344b581e779e9bdcf03f2b1dfe73919c75cbc2ff7d5d778f26b35dc0ac5bcd95dd0e59336cc1a3808407ddc3635397d42b05a5bff8c6ded0532715659573a2c6944b5aaa1f34990b745ce31b4390bd37ade87c9c03bcb981e81bc5fba02f07232504255982389aafcda3c0572c40655506951ad0cbda08ad0e28dde1985e1497a55f822217e3547f0f866a14318528d62f342de1debc82596850a506b3e1dfd2162a4dc1e0dc059865ae408a99f313492845f5c09124b47c1ae6cd547236925330750311941260b960d6d838f0f4ceef367666a3bb223f99e68a479dd8b4c152b0d69c6f3c01f291c5bcc1c317e3ec39d54db8ba2c1d386552db23eef05d219c2abbcde5cf07eac3f1462e24d0ff8c5f4fe54929cd6a44e08a978767de974e46cde1fce05c42da48cb8e4d541d43ff493b64383773ec8248e6b9df952bf5688b4361c6ae018ff128046492b81923ec61d1bc7c58872adae019e36ae42470c6b672b7312b9b152c8f1adf21d49340b47e4ce7156d5e6bf7a3112ff1e818b9f1e56f6c2b950c43d0e24f79a2bf4d5b5a6ac50033c3367772d035a5550483d56b5c56c55086c18c37133c47d7f22e8003e942117380d491a1e670ac35dd4e95b81025a1b42e1a0c854f0675b13a857baeb78756578bb4d9a29e79b6fdbfc45f8e76fbecb76cee9c5de85ae7d9d319a3c78f58db2f2d7984e54402e1fd313ecf14d7a04578306e02f1d0e0146204598c01652ff3fc6663a082a6f949f6095da66cbc1306308690e3acb5862ee99df4a2127706d62a195e5f365b1af1846f586a0cc8ff6d12f465be1452e11ea2765a7638e3d8432ea247a4c59c657a08c7dd471d20bd29caf3e712f7db2f45016967b60d4c8235a6be7912a45332789fce3060e6918c962a723ef1fc7baaeee3553bb08e2ceb151c145beb24240954ef4832e011eea62faa42f7cf82e72d18c09895411d0934c35164337b0e2f3f0243782135a338fd777af5b96f417f8a40f3522db3eacea53082800812b98367d4674988aa03540709786f6f0958b214d3cb2f44ed35adbb19de962960f5c6490ffe9db4e985edb9a6ad10097f2d5af2537c972442183d2d96161955228f1cc7bd68e43afbdf41ea33159078d469e38dd172e6fe1c95a33289b9ebb8c07d934fddbcc242b5f4d35d9345661b50e0fc17ecb4ac4344a3e216b8174f019e13773e150da2c37c0253afa628edba3268c6d2839ed9b769a65d060653985e3c038262a6ace000a5fcdb3e7f1602f1536b7fe18fccbd122fba1205b4dd9e6ec14ad3358a841f5aa43bd18ea1b32d945d133898ac0d086c2f51f3ab1278316dd2bf9cda980ce5096c078fc065fefc895ffa18fe60d6d6c8d5a3e02002e4c951b102529f7c291c1c1f995a2ac0d59ed3d8f5090d0a93a494d304c8544adcbed6e1e98e6779d85f04a0398c631ba090125084321e11021d2dc8d2c80f2d2771b1bb559df73820cb2cdc524deee1b42025da61959288e7ee5fe9a366a841beda7a2b62d3aa7b9137368c93819fe9f6988806b8c88b19a0c6661a454dae8cc0beeaf094e3ee051de37b582c44379ef88542036f038ba019572ec4e12257ac0c9c9e4cd96200c88cfc802415c963468cf47c0af189a14c34a182132d03a15888745237be866175ef25172ee8a98f18a9334c73243be1d7f0de8583981414ad540ad269e978a29163ea4f89400f2d76066f5465adeee1ebf164ab16b889c56714680f3db33c919e2f1747af6720864a8513cb5e3cad4172c154dcaa4c846f46e53189f80cfe5dec52c694b6c1aae80e9dd48e59d906a738027da021b96e5fc47fe40b107fb33451892342c0f1d03f8a22e0d0f32adfdefa9a4e8f07ab078e7161cc32ef6dc969f9d27088534dba7010a12de3c2ed87a765aad6146c2a4eab6e7010098ddcf1c879b765bffbf80ef44b9cda3e184b97375aac3225839549ea4da84da7d11036c0e48454530e16db556d3c8560f830673373af8b1915c748431d3245b4f99e31575e1e875776e68a96f6be93d54323c66316123279bb010f619667bad16ffa5240ef8ab45a97e747ba4d9b0e3d3b30cc0c417b2b43f5d65605711e54ab57e810959ecc021aa7e1e708eb6a15cb7aad94cc6e4b4136f1c16ce553e8e3e506216227c5821c09087bcb262264898e9d30959a6ae4bee5e6aa7ccd603ffba74df6a39ea41d1be9a7b179d44eb1094405397e141b2851f8e6b111d324538491e345ba5bf816a66e2861c5d85400359537e86ad40d9e67539d2b92054ccf881fcd5154f18fc4bf865df89d6a4c0e82708dbfeb12da96d52e92c4073c1bbd4e8593b642cf6825c91e87d1743b9e7dde280966a2bfb8d2d44e0674bf1d1437a6b0d3cbdae2d4bae607aca7573239b5ca4c7db2195b08248491acc4950767b599946a3701db70f98d9a960f489e5a1ba9be407375f26a46b9894bca3ee3c6ea395b16ad3184993dfb4f69bf499c92759a5facd1895cda305e2547ab933f815fcc4d79f10f0aab9352602fab40858e9735670942133a289417af912c90788a3d46f37805d3370e55343835e5c7e2c3cf8461552ce88f9018b822923176e0f8b6b036f741cb0c432270016017475c68381ed2de90873d2d5ce340aaacc10cbd959a3da226465726d4232e153813a093115de1e8d4088d03fd64d14fcc4851da2019a2f040e43cabfdd9a6106303815efc9e31b073854d59b6b4d0b98f5fe59d5ab0bd95d2d09c82296b378bc0e4dfce421b799e5b73408daacf5231fb42c5a259bf48297f8a93026de47099abb8d0a431f3b1e0017e6c77b32f112fefe99636a7c38ace77446a76bea9b790172fac104c5b218b7dd0b53414471116a20266ded83a83fdde38e77b5197d51bc24289ee25350f713054252cee0d1d712f0ce6ed4968a5515b9302b4dcfeaf86e8e6de13886a7224341214a229a93a1e8bfb48f1287adc4965b2775ba2235014793a525b1e722ad48c0e3957845961c2dcfcab455c1d250430c85ccf4965fbbc75d2f3714724276e47c0b14be5ba09d8920573e09ec89be88c72bcaa1fe71c82c9908702e3641edc6e54ff64fdf6c057324627d4e39e71877acf8d63f024dd328f67b3f5d2ffe8a5f0b6de3af97cf8532dc6219f4651e8caf34cf3053d312d4adf559ec434ca4cf804825539e78c7734a0e7d49de2c7876832c0d69230d1b6e2a42b880404cfcce17126fd3d5b0ca03c5f3433e3c6fd2efd5650a5602a2bf3b87de44c1c9924a8361739311bffe33499a0c9aa4f87c99f46830bc52eaa88a31cb9bd670296f7a928d75dfd597e563a69c5ccadc84ce3812f65c8ab529d7902f968188dce8b8817bdd2c28ca7a9c77b0ba7b8cba2275bfc2be396b9cca9e4790d13528b327ab32667177ae0f0d6e907285cee5d20b83a9c3d417ecf06802dffffa074c94364f02db8c11c02c55242795df9aa994dc31a6b50977a9811d4ff66e79e9eae5ff3b66d121ea7ecea5740df8a038c15598010921eec57eda26e17923066ce5942fd383abcd37040f07a0e80e983313fbeddd7ba8ddc312e53038dacea382236d12c2477fafd701a9d47119b46429", @typed={0xc, 0x6e, @uid=r4}, @generic="0ba4baef0608ce052716dec3349a9a0b4ff73884dcbb893064ff40ec611c6106d31d4bbf325f6519961ecfa137e6f0ef01b0cbfa9be8fb4fbcee765f91f75e5f6ca3dee3f7ed33d4e3196f0e736dd2c7018b397c9c765a819fa3fc4ab201471fa1a3fbdef867fe01f3af1e59b3a5ed04f5610f8afba4c7beae975f1b"]}, @nested={0xdc, 0x3, [@typed={0x80, 0x64, @binary="ec0c22c7b36b233d449d40a7d18caadda6b773640430d455d06fd6c7db78ed9dfada3d36c77f02435eaaee81b8910c72f801a60d786914a8a1a341322fca418d2db961c49d3e4df2050072a6fadbbe2ba7ae41ab214441aae068f9bd2ad6856569058a29390d5a62742ce48e7e80b8ec763ac1b915"}, @typed={0x4c, 0x13, @binary="32b77952dc8271f50a3baa1dc619b81b45a04be5cbe8e5408de92f337475a7f2fb893524595dd55a3e7326bc56fa58b26db9d66fd9947eb808a91458d2f37d62dd17"}, @typed={0xc, 0x52, @uid=r5}]}]}, {0x708, 0x1, [@typed={0x10, 0x4, @u64=0x1}, @nested={0x200, 0xe, [@generic="9b498eab8be61b2a3b49478b80179c60f2c5607e0217c63ce0eab53fe2d03ac19d28e088d7c10f443c5865f7c5ecd938fd218bb6c5e1f477b5a23aa27b59709e4c058aea424015c6790a90f2e13e83941d1e332457cb350d49ae51358073d9e5d4b937afd6b1bb0bb736ddeb00ae0dcbfca9aa7653b5b819e5796c3501fac74bc54be4442b6ca25d14c748095bb7112a4df0f1864262a12464a5e8448d5a31a96a573c878e7a0c851dd500ef84b852ba59f5c8c28c8c5e54af0f6776118cb3432b554f0611", @generic="47364885354e472bcec6c4e05ba933", @generic="12fedb751d8b916476ad6d69e5e546af574d4b4686427224fbbcd8529c90fea6f498fb", @generic="4a62da4b366d40a8b89a789a706ad282b59dfa5aa526cf177af738bdea110efbbf5e693e61f9", @typed={0xc, 0x8c, @ipv4=@loopback=0x7f000001}, @typed={0xd0, 0x2d, @binary="dcfc624177ed21589fc48794bd49f278a85158fc2efe5da3416699753ee4dd8528a1ef0dc6521ccbd1a5ae74e3f1a436cd6fabb18052c85bc1c559768a1dde48fcd31d93d23ab7a9a3601dda57e68c6fb5e942fcdc73b5e8bf25217af3eba5a07271368a13481e9d45f29893bbccb5cc06492a77bd25733698119e4c2cb85a7722d672967e9310e601a3096eaed1a0fe907860343b6339a9945ada2f4a887f72bb622d13b4cf00184401869a7175a56d0fc48fb4dc02b2b533c2b8e025e337c2c9204c5887f1"}]}, @typed={0xc, 0x95, @ipv4=@remote={0xac, 0x14, 0x0, 0xbb}}, @generic="5ebc9bbf09cd46bfa365011570d3d9e4918fd8aff5acc85efd3ff00f76f0c6932667cdb3dccc1c783b8c3a804b1711f5bc13110df22afc0c41795e1eebc9ce06bb7cdf5716fe68d75d4d4d447885448df39aa732ecf18091681f26ccb32206a92644e22b4fa8c63a1fd18eec0d517ceb41f0f03b4a9c1b85ce5a37aef398096d0a38d9345925ffcfcf9b2fa958649b6c7abfba72aa686190ba64af316453750ea7663dd06a4a63c8c815641e3bca9d50a2fa2c6e47e74f07377090550ed621a34a90ba9077f6bf26c8b71a6ac5795bfb8629848dd98646d2a79d46bac4bde425df1cf10aca", @generic="95d94b555451e9e6856d0af1ba5133edaa000cc3b9a405aa424a9ad14d69a461cc4d91c35e9dc1d9288911ebc61a486bcfea9c499ba62221105f55", @nested={0x250, 0x96, [@generic="66e31fb7cb43604a35015e823c91ce975e98372f370cc9cb7d999d402053b6e7f7562d05debaa24c6ca97f16e8c6dee8f01710a837a18d921850a8e3175e8a9d3315a4e6a34b6ab1a1cb34309593125ba6", @generic="8fa5564f1052ee943634113510f78f62d79dbbeee348c14744810254929aca1e01200c20a6466d3f8c51207219c72a7237e37fde2d556cffe3d3caed4aef18fdbbf2c7be716ce5806c6472a1a85b5bf3341bae524ea5b3376d03adc155cfb06fe8aaaf537931774810b8f14fd12d447c62e3a35efeb6f162df9580cb0f0e59bc051b90067deb472223e2364f2398bb284c3ddabc187601cbdd0a2492d82512d21e6cc5f664d1ea42a6fe77ae5af12129a456232ac3cca165d42792c22e6895d4ea8efc406f1939214b5c", @generic="4f3d40ba1424cc441b1bf928ad89dccc5513c8c5e887e90c0f0f802b589a", @generic="a6e8582d4e55f0168f98f28e4e5031597d729980178629dc586eb1e1aa245163cd0ad782cf525c51cc4db321fddf3ccb746ebaee9c24c541950f8bbc0747e286347250ee128cb10f66940c4073271c3f0c0d9e878b46194d26fbecf12546d88cdf0939058ee24340c61d2f60fd7c0eb39334288d41ad211d41e3e1c567482ed08e6b", @typed={0xc, 0x28, @uid=r6}, @generic="32b957f36e2976b9c3349ae2e02d1b36a383808d5f4e9660f7f20bc80c6e30fc6abc5bd4390e12346f9a0d6659a5edbb28797ba8b3d69fc6a4df2f2e1a1a46e50401e3d1609ad711087ec82e1068adbc864a4bb5f5df25b48b02cf54dbf9abcac7febcd9dee2fc85e87ea551e8daf29b00dfb434501049", @typed={0xc, 0x12, @fd=r0}]}, @typed={0xf4, 0x3e, @binary="a16909f5366ad053285d3a08ce45577ed56aa5f75ff22f6c13dd802adc5af27ef296dda63dc026b05809382c114e7ebc8efe4ccc00d2566eae8f559e3532d5fd5140960d749d166bd2e47c25f5e3658564e41afae2f9ee8f8ceeb3b857527323799ae7252e88ebcb64ccab5b5c93c7ae2a4a08a90c35afc478f20b744cf335c93dead362b34f615d916715834096189a1fe365d94f3ece37410f4b6c3d40557ee9eeba8d8818b671f6d7ce99c358bb85823bf4888a0270dbbb56aa5c1b753d3d291b54247b8d89e615ecc4963e2fdc46b7e0182370c7c7fe91798167a03f1d9faa417659aefb088753a91342"}, @nested={0x84, 0x27, [@typed={0xc, 0x5, @pid=r7}, @generic="07f2ba992a46d54b4933953bb0464618ddc583d66f22727905db879a623271406cf3e50c41e60e00ba33bf306f9062096abd2f9d38239d2fcedc2ef07ee2b2f00180881e4f20d2d8e80cd1596f0841668bf2f0416c2bfd81176b3f7d9e7b65c8bde67f63ecc10364", @typed={0xc, 0x21, @u32=0x71}]}]}, {0x4d8, 0x1, [@nested={0x1a8, 0x95, [@typed={0x10, 0x8c, @u64=0x7}, @generic="817afa60872b94aaddaab0cb532030a0d368cef3f55417061c99033e23def5608fae3ca0e258113a93889a29be36b811774eb56fe2734792a50342aa4a87a7776b4b12ea3b60a682bf5e28f584844a730f6f1a0a669d4a93bc0d3cf6edb7799b16e008d793a96ac1f369eca0b6e1695480088faff3c177f7f2d1db5598039ca2d1b5af41e476fccb2a6ee7213d7f9b221188904ad52cfc515c026070190784591b", @typed={0x18, 0x0, @ipv6=@empty}, @typed={0xc, 0x3e, @u32=0x6}, @generic="ee22f22844563ca93b342e9377d687be09c75be6638befb0847f1cfec958bfbb3bd9164193fec48bebee948a1c2414273f1db2ec1c91b38c5aee7820a60b828a0f62a5bf48db7f2bb2556e67f70a1a0607dfde7b810e8d996d369e7e0c788213f7e168db1a83a0f2e7fecfe97f3b89273ed887a98c6446e957018d353382ac47408b9f", @typed={0xc, 0x60, @ipv4=@remote={0xac, 0x14, 0x0, 0xbb}}, @typed={0x40, 0x4c, @binary="41f1c28bc88d5908c4f42663492d0314c4867bd1569c6343cc1b346d31cf24424b13fcdf92be31ab03173d0580d9e7c81a2f41cc7e176d"}]}, @typed={0x18, 0x60, @ipv6=@empty}, @nested={0x22c, 0x5d, [@typed={0x8, 0x81}, @generic="e4840cdb9af43423db9513f19b55ac98daf10f", @typed={0x108, 0x31, @binary="8f9f6f3f76e575da90b44d41e0377d59dd90cb381ee14f6f0ac4b3a0471afc4f93b9f74a1b5d25ec268fd156dd56d58a4b608fbb4b6c5ad2960c03132eb2c59221c38cfc0bc477a85e960cf6494b0a780326f9d8ead41ae4d43669935bce2ade7fbe367d3aeee2af27be18dbde28188ac25086d122096284e895bdac6ac506255a6d1a7fed67bef76e49b88a67f221e3bf8d8f01c2f358719196f397814e5ddcfb42fd4c6b27f2bae70a80933c459bdd55c7f6ccf8e2790325742d472d141f4baae208c283314fc1a7ad189101a8f1ff8aa622bb1e84e5ed182f4a5abc996f0bc2970595d942c1fdf68f58afa20c6612bb064e70ac927b5e89a3e325c2e4"}, @typed={0xc, 0x25, @u32=0x5}, @generic="c335c9ba0e5760b46411fda23cdd8cb5637aaa39932ca937e9d4c825244286331017aea5bee004161a3ed78f8f8f05f397b5b10d33828c8a38297f1afb260557f61ccfcbffc02b9f3c4d301ca0d45130ae9568b3aa78f5e99d72a48f7142a99c6129a30aaa2411c40a07c34e", @generic="ca44aa3d4faa744942af6e0773a520522a0ee2a5862070ed545fc91274509769e2732f7058fac6a040ffd0f4a58dd5005c69e17cee2afb1c55a62e430f48591ae5d100243f1ff75a2d15fbaf6cb5b8e7715945e29fe49d6c44ff160037b4828650bda1e5db9dc2f26075a779e1bda463808e956e0cc409a99ec93dcf4d2cbbf26e289a7fedd573b3f8a5783d1b"]}, @generic="c6fc9ad2256493947fb672a7f21cf9ded874aaf95ce30eb7035985eb3d536fb04de43e71041ce8362d92624b6ff09dfe2e2d23fc33b29a7af94b3d196ca2802b5aa0308fa21d21b0cb5a6bff1e5883733e5586bb3f0a76a5a07acd017d5e800bcf898b2633ecc95a4458a8375730b95ca6ecf5e29a55c68236b1319695a5db8d6255900acd0af6e1a415467a0b86d3d218bd2fa631832b3564fdbd5f1e6b99e2735a77566930e59aba25d3065e39e8a32a3ae8a0b26b65e9fe05ceec5bea268132709450aa104101bcb2fe916d191f7e", @typed={0x18, 0x2, @ipv6=@dev={0xfe, 0x80, [], 0x0, 0x16}}]}, {0x150, 0x1, [@generic="3ef2c15d89d86b5930319c58b1474fe068018e4c7e6175b9ce562cfbcbec6a638f29ef11a67cdbe7e8c5e4415d20bf831da2d0d8ff501c1801929cf171b536970f081f59a7d57699f62af82b89f2a41e93aa6541e8294ba35f2cf657d5e1fd916565882744bc3b6f82a8e2a6ce708b6dd7f037741f40ca96", @generic="b1776f3e5aeb366f4934", @nested={0xc8, 0x80, [@generic="b6ed6dbe9a9ba17a59dc9c7588c02524aacf2517069e3e50978019cd946076318c2bc9348cfaa5f2aecb72b22dda00f2bdc99109c22b01e226cf382cc96378a0e2840553def34ad67d2af405c91deb9277f1c6ddaee3fb1f5a84b02ab971368d6b4a8cd03b3ad36d0c2665f44ee3b04f2bfde9d7a4d5293b7d9fb51cc6accb42799b5ca2d97703677586d7ca9cc08fa8fb4ed38e71bd816d13", @generic="ab37a2234a008235f3466179542cc4fa4195d442096e6071bedbedde0b6208446a5372dafb9096b5"]}]}]}, @IFLA_CARRIER_CHANGES={0x8, 0x23, 0x80000000}, @IFLA_EVENT={0x8, 0x2c, 0x6ca4}]}, 0x24c8}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 2018/02/04 21:33:26 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = syz_open_dev$sndmidi(&(0x7f000047e000-0x12)='/dev/snd/midiC#D#\x00', 0xc612, 0x200) unlinkat(r0, &(0x7f0000a32000)='./file0\x00', 0x0) [ 78.941132] cgroup: cgroup2: unknown option "" [ 78.955527] binder_alloc: 10013: binder_alloc_buf, no vma [ 78.961175] binder: 10013:10024 transaction failed 29189/-3, size 24-8 line 2957 [ 78.974617] binder: 10013:10036 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:26 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f000059c000-0x9)='/dev/sg#\x00', 0xfffffffffffffff8, 0x8000) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000437000)={{{@in6=@loopback, @in6=@loopback, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000d4c000)=0xe8) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000f1c000-0xe8)={{{@in=@loopback=0x7f000001, @in6=@dev={0xfe, 0x80, [], 0x0, 0x13}, 0x1, 0x2ce, 0x1, 0x4, 0x2, 0x20, 0xa0, 0x2b, 0x0, r1}, {0xfff, 0xc736, 0x1, 0x8c0c, 0x4, 0x8, 0x10000, 0x9}, {0x100, 0x4, 0x1, 0x1}, 0x77d, 0x9, 0x1, 0x1, 0x2, 0x3}, {{@in6=@mcast1={0xff, 0x1, [], 0x1}, 0x2, 0x33}, 0x2, @in=@multicast1=0xe0000001, 0x1, 0x1, 0x0, 0x0, 0x7, 0x4, 0x3d}}, 0xe8) r2 = socket$inet6(0xa, 0x2000000000001, 0x0) getresgid(&(0x7f000044e000-0x4)=0x0, &(0x7f00001ff000-0x4)=0x0, &(0x7f000001d000-0x4)) bind$inet6(r2, &(0x7f0000895000-0x1c)={0xa, 0x0, 0x0, @empty}, 0x1c) lseek(r2, 0x0, 0x4) r5 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000be000-0x19)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000c72000)={0x0, 0x65, 0x797121d9, 0x9a0d}, &(0x7f0000a6c000-0x4)=0x10) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f000023c000-0x8)={r6, 0x2e}, 0x8) ioctl$DRM_IOCTL_GET_MAGIC(r5, 0x80046402, &(0x7f000091a000-0x4)=0xfd) setsockopt$inet6_MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f0000edd000)={{0xa, 0x0, 0xf6, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x7}, {0xa, 0x2, 0x7, @loopback={0x0, 0x1}, 0x7}, 0x861, [0x3, 0x4, 0x80000001, 0x5, 0x8000, 0x401, 0x0, 0x7]}, 0x5c) sendto$inet6(r2, &(0x7f0000d46000), 0x0, 0xfffffefffffffffe, &(0x7f0000e42000-0x8)={0xa, 0x0, 0x0, @empty}, 0x1c) fallocate(r2, 0x2, 0x100000000, 0x3) setsockopt$inet6_int(r2, 0x29, 0x8, &(0x7f0000486000)=0xf2, 0x4) fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f0000050000-0x8)=0x4) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000f96000)={0x8, [0x6, 0x5d9, 0x3, 0x2, 0x9, 0x2, 0xd4f9, 0x1]}, 0x14) r7 = getuid() socket$bt_l2cap(0x1f, 0x3, 0x0) fchownat(0xffffffffffffff9c, &(0x7f00008a6000-0x8)='./file0\x00', r7, r3, 0x800) r8 = accept4(r2, &(0x7f0000c0c000-0x1c)=@in6={0x0, 0x0, 0x0, @remote={0x0, 0x0, [], 0x0}}, &(0x7f0000d84000-0x4)=0x1c, 0x80800) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000119000)={{{@in=@dev, @in6=@dev, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f00005eb000)=0xe8) r10 = syz_fuseblk_mount(&(0x7f0000930000)='./file0\x00', &(0x7f000021b000-0x8)='./file0\x00', 0x6000, r9, r4, 0x9f3, 0x81, 0x2000) getsockopt$inet_udp_int(r8, 0x11, 0x66, &(0x7f0000b78000), &(0x7f00008e8000)=0x4) r11 = dup(r10) write(r11, &(0x7f0000cdd000)="ef", 0x1) 2018/02/04 21:33:26 executing program 3: r0 = socket(0x0, 0x13, 0x87) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f000031e000)) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000001000-0x8)=0x9, 0x8) mmap(&(0x7f0000000000/0xf9a000)=nil, 0xf9a000, 0x1, 0x32, 0xffffffffffffffff, 0x0) getsockopt(r0, 0x5, 0x0, &(0x7f0000004000-0x4d), &(0x7f0000ee6000)=0x29f1a88462ef51c9) 2018/02/04 21:33:26 executing program 7: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000955000-0x4)=0x0) ioprio_set$pid(0x1000000000000002, r0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x100000000, 0x8001) ioctl$KVM_GET_VCPU_EVENTS(r1, 0x8040ae9f, &(0x7f0000907000-0x1c)) 2018/02/04 21:33:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000be2000-0xc)={@multicast2, @remote}, &(0x7f0000c69000)=0xc) r0 = syz_open_dev$adsp(&(0x7f0000d45000-0xb)='/dev/adsp#\x00', 0x4, 0x4000) setsockopt$llc_int(r0, 0x10c, 0x5, &(0x7f0000ab9000)=0x80, 0x4) r1 = perf_event_open(&(0x7f0000223000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000022000-0xc)) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f000025a000-0x50)={@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @loopback={0x0, 0x1}, @mcast2={0xff, 0x2, [], 0x1}}) ftruncate(r1, 0x3) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000f85000)={0x0, 0x1000, "4680a674e90b85c441fe59d9308fa48f885822155590e23796a2ebbe1fe7bdb8e7cd66510e0508c7674f267d378fa5fe6db9b0d340691056da06ea224b2266350d6288510c00bbdf36320d45a3e295b7eed7c868c3afbf0d467e10972bd957487611ec4ad453e39726d512490077fd95693cba5725bb16cd4a3313e5516b61676216399dfdb88116b77901960a717ea2aa9a4145fba75462f465f2439e96234bec23657d6ec25853f412670c4ae847052b319ab34bba78446f4234715dae6ee7ab3ad3351b6a66760cc8a73a165a7d728d8ba1a06a1086a26e57023217960f7fac504636633a59e0901cbb112f342eeed0901830ba95ef0cd182707bf6d54bc7e2806e958910cd1f1de294cef0fd870c8d4531bd1a6301174c2e091c89f240c4941c289c4bbf9af2c9aa4d69b9f3021eb69c52c484b14a440126b04dd75e73369afaefba69b7fea0f67b737d8144da9b15be9624194127d7cfe1e91eb21f97dfed4648567406d426b7b39f853e326d54b93d78938766136026a9a14bb9a9005ed8e312adf50ea5879b973605e259f1816ad093b31c2c88f87868823d9acad8171ca6f326db583467d008227d64b0f7e4e61b3ddb201d92ce417cb5e13d79c013c14a33796e5853c4b972d3892202f75a2ddc960bd6e02e7311dd3b5844ea08e2f7ea9159f4c11d094fa3f9920ade18d4768896ad2ab12ab5a77c7ba63246b6e3cddaf39c198e64ed194dc8b03b5ddeab2dd386706551c01286071065183d5a3cbe6545634c16c7de382601be08cb1b64c728ffa4178499757c0ec824d74d67c027e70d9dd2316e543f0e77f2f1aec132399aae19f4490cbf5fa1f78a060fdd211bbc33802f9f0668d628ba1aad57af20370f5b9ee6563d6bc9a272bf6cfcea54221f8e86998f2d7aaf4c27d9db5fa76d1788b6531606657f8d86b98227488effe3f221a0b3d80cbe2a85ad261f3082c7eee40eb7d59b667be5e19f4d57bcf96df6d365112e04b4b8a354c6b5583b0e2a507ba1583584259df7cd5725f484695970677994c458f7e5ed127445c9c28cb37d39308d004923126e42e698292d2905f8db05047083041ec80f88c68e7a4be215688e3f5792d3d3304dbf265faa448ae50109a1daccc8ccda2d4226bf96afe7c85f06b074d3b835363a581955174ac7b50d5f63df706429913820f759053b37514018c833c23e40d7b08a6dc83c76a4b2a82f372ac26829a1f370e7878d1b6b664d794ee431b65297e044430cee1c433c60aca75d80490715160b2bb26f1ba1f075e31237e3d42fa0609aff374f9542670743200a14a75cfb00033ac602e4a4bd7a163be1dbb0dba014a46045b70f6f0e373a83bda9c11d2f8566de7fc411b2ab6e67ed774164db62459f7f5f5999e60e62299767db0bc1352ed23a7ee605d42a041a96c14c506f4e70500f10a2daa859705f0ce535b0f41a91bf4b492012102035b626210251469b7df0c6404f8e0d2c48e1fc97aa568d4604d6e128560572667b0cdf820840d9aa16868610c878a7d259b8fa7192dc08d930cd63f76eecc1504bbb8a1509260ca60dde523e0fe8081244dc315797b0578ea061c6caa7e7a47838189589ead4ef31b1588825e1cadad1acb0c564ab0fee78989f4c0e2853e36c3c05c32bf6f5c616de3be27819304388fe13b644a638133e17538badf981cfdc1620376a17d406fdf38a0a49a4230060f0fb46dae84386035a2e52b7f4d7477f6ad521d9fb148abfa144d3db6a1934d139f5017da5bc14278a1e7bde07c7b16fc4b53f9dcc5b9947eeb0f9830de5e9c74ca4ce6ecd0b7bf5fc96703f926ac98c672834a74cb195d6badf1708428e09e48647e52bd6bbf59a613349014f7ade89cea01780bd484e5a9e2acb6592b075d9e010d03879ee2eec1f5b50499d7bf5e002e7b94394a44b4abfc9f6902073e59d55502b0d1928ee1c2ed46dcd8af2fd70a08333c32b6ae0a54dc6c0710f31cda581daf36251b7af1c73d8181ed5c99239d75c25981de14529d1b1f46459f009f0cc9fe534902087ff36d694e7b4518183a0c7467882e70fc3c8851bc8249d34770c4d4bf9d24075f96dda12976510894dd93fdf77903adb67489e3b40d33814a72b1133a223032aa1cacdf743f60c0aa9b54b2ce451d55c74c18955ca744a2fb8b3e5c054452856994b2977fb67b1a363de8785a91ea8ab8f995cdc274e017801c7eae5de6869e01b3c995fdb19f539774c73bf278fb11e3b3ae193a29b368841b26507f38c7f7d7d2cd8a9b26b67da79f476d11d89e83c9e3d2e6bf22445d4663f0ecceef489bfdd0a0b1216a331931a547c722e5f60c36c0cf514bd5b971e45529c1bde1ab8b0e57c2eef1776829849b1615cfba22b61c5a3fae9e0977c9becf2d2ceb77525ba76f634a862511a4055ab56b5ee5b9cc695de8914a4d0bd64c65fd21edd28da75b0248f50c3b0c8166d8fa1d636cdc1722752f600f36140e136fe9ea38b877fb3730695ad6494b6a550adee3c2998e91908ddac451073399409bd6b90d31d641374c74d374e4c432745d9ea4fd7284b26492455721c1e6712945f25616eeda5ac06beeb13d1fe9681e2d7e9c4e1f3f328815f1074c9f54ec7726c4df065e3a4d9a859b5c09a6a4da54df7f203d44e25c66b2d265cb797542f261ec2e49e2904dd3934ad6efe5deed23c8e74b6189f8a5f79bc211355a5ac1519623aa749e955fa25a056f664373921ede66a1dd92668134e0f489482c7ec5c7859829ad6ead0188021f343865c8d5d9ed3ab15635bc0707a3fedc5c9d536b896a5d764ce174ab8f5694b569e96ce2d0449939649480880c376e50160f47e6e9847820328ed7ddee6006a15d5bcf479b9932337c16ccda88525fbfa06549da771f09223cd4920e850de7194fa62f4bc35d003e312bb2d28dcf9e3165cec80ba339325e322189e45942436edd82da8b5ebd33e9df2a9c80cf5a4fa2ce70a123dacf30a8be7e41e95f34e57536ad6fff87cbe9932423a40199b32af8034e599055832b74648fda5bf1295a522c3693bb80daea46c0347d493779511d4bd00d5ef9a2774531f8280a59b131bfd2d4ade24618d216137fb0790340733f9929abf7ad353ed5daa58a3e54027b8fa00e9a26650ef2aa023be276f55af8de668cc31f39daca09a09ec1b9d7b85510469fa69510c121805c32fdbb6c5ea7e08b136b51380a16571b002f8eefcf265fd77e28dc720f9a47ea6534f4282e0e94bac5257e06c8b61daace726439fb9ce5e4c2194f252c8a5817e6910b5c7d9f31664b7c6ba1c07efe10bed31dd4d6b49a6c72402ed4ad46a5bb1e48bc5978a242a4e180edfb38a77c925715c3c138a515ec09eaf62eb9b303324d1fe26739f9467c6a46a08b5e84e6d4fa74db4e1e869fdcc780cdedf43828f6f9423eee46707c1402b7bcf1833101259a8f3da5163a9e2d25381b8c683eb564613aa0205ac87e5f27b125190af7e8645dbd4b0eaeac8cd63df400c71c556c2accf1e0f13668370925518c98413d3c8c9279c60a4021d8b43569e6d821162b93a944b955a9c99a7a9161083b346ba61ef192901561ce1e23feb57a2f9ebbf3e97191547fd4486e8c5643e0620a2947a68776bcf64752470a739aff6b318a0c4366d57a1838d7f983482d92a982a2c7498c822061f123091ac33e5cb04b09e3829146df453336caa9b45939b35ccd892492fc371c602a0fae64292c872d7c13835f21ae2610e8558b25d4521537dbefd7d44ba4e05e5348fcabb61a0d9b9cc61287ccf29adc4ffc5ea4d323f710427a4a70dd9b8131a54dfeee9e066a356d002bb21b5e87f4c8f90ede5912dabd10fd33b64a89e515cfff2bbf2748e102ae2c0c185f56fe2996bfdb2fce4993f290c9fbf518f30a4b88847d9cd0e2678287fd70f9dbb13f5b5d6da8b19453894f764813bba39e7a8759ac7f2883a7110d5a8f15cf7aa5e098915737cff662af5e74869963bff556eb63f87d167ca8ff54a42b7398fe6c07ef15c8c3cd82d4ca253b3aab0510bd326d491e8929dd4e63db02ff0a3747ee8f19d1be2c76146666c69224e3a220269e6b930e48c290cb394d94a7ee598714552b04d4c4c3e23fe53d3b16e205c36ba9c306dd179465098e9f8fe3d678ef98128f9fb994691767ea7c89ad84e5a5a1d95f76bc6eaed3a7c14db60d88932d371433845a3f8fdc894f01a20f574185dc873d0aa502e9c477cc9db0533a5398b1c3de5c4c69726fb29775f9732670e3ad6584b973875bfdbc4dcc1b87b33e2407398ac7ac973549c2659883ad88003780c779f98a92d0cd10cbc804daa94e6bc3e93305b8d4304d9ca218f5bedcd31a79448d1577952bc0bd7f04ca9f539b54b13bcf226d1dcea314fa2c9130cded5ef8ac39c7c9fe3db45b05d050ced3efce6656fbf7c3bfea220872cf7121f09cd75d504d2805bcd1f0440512ba8ba68506a00ae6da1f548cb2f2d562954b3f55067d5ba7620f586fb35d617f498e8dc78fdb9471bc8a1545371e8c2156d970589951894588aa8cc2c5c7b2f4501c4ecbb4fad5002a1060c7d886f49ec6da9074ca49974e3322ce68ac53b6bb25356e88ffabfd7f9285cad74bd9bf987d983776088910172758e82f8c6d4e243c1c0af3738e89b57118185a8ff4dc8036660880d9a538eec8c69b354bb3f7c2a8af6f935ecf758062f858ebe397ddecb54890f3d840e9b93221780b793eaf5034f1c73c2a18a2eb4ce0a7537564a01fcec6846c8e6efcb4539009eea11a97821a022a999e9e540997607b92913daa7c28748a878e38fdb0a876fc33914315cd5e96f16b42b7e5f1a45fc5a3349fa289a953ef568a6d9b7edf4735d135b257899e08d42dc11e6c616035dcdb448d82aca9f493ae74b248ed9045b3e2839ae99f206110b847186b6af3a52091392c9e551943ce7ef25366781e72e3019311d49946b53417991f649c22f7f6b0989190f1d2173b21f4a97ef44caa2a3fe0ca694f8c4401171e1b08afd0bbb1ff8766e9d7d1b0f1a0955cddf061efb6ebf24132928dcef925b7fdd8cd39084667ce8ab5a9c20ff0e56fe5fc803565e21d63b0359e3fef9c39a5ac2f45f59b93d7be00a498c35b72bae99f9d6c6ec44ca51fb320cb977204b863c7e9c460fad543b106b31b2fa202622a66084d843a4138b36cf5bf56d1c2e65b777bf3797ca739d0335c0b8c3b7a0be487450b79397b9660b3a46d28fcef4417b62cbddbfd05e8e63fdee8ba5bf623266d48343b6e6391364a5dd37b7de45204dbbe40b1403fd5fb066a6ab120fde81597658360b08710e54e3f58d0bfd8c52f0d4a3087630f95f4687469d4760a3a94f4c6d6ab7b67ba0e0a00da706fdebb0d991b2b7e51ff515e6cfbc0190cac9a789760915a5d8e77c73a5b49e4208cb6ab6a6d0810d2a79f62f6e0097d2e43c36f5f4c1beff760f2cb7545eadf2098e0916d659f16004d2df71358b326676594b2c5b3469eedbb20450c34d0a4ce4ef63963451e74771ecc99ec4367219ff2ee6daca6b28afc2010f7b8c95bca9f356121aff67b45ed2634d08149baf7e7c5ab273520ae14e17810787f93910d5377a414977281fc209cf0fb00c36323ad597da3147a805dd5ebb6f37db1f8fae4f594c17a76efa4a700f4cee0c68657f605629af28c56b7ad83c12900c3b901a29c30900b9909e33653bbb087c7d8acc0165322ba7c1987cd3435585be20262a8a3cb490166370c8846ac3780a6bacf140e537d5686bb71224472ec47fc1c2129c4e3b2d40264467afeb7a4558"}, &(0x7f00004cf000-0x4)=0x1008) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f000084f000-0x8c)={r2, @in6={{0xa, 0x3, 0x100000000, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x6}}}, 0x8c) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0106434, &(0x7f0000b96000-0x10)={0x2, 0x0, 0x10001, 0x7}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0106434, &(0x7f00004e3000-0x10)={0x5, r3, 0x0, 0xffff}) openat$audio(0xffffffffffffff9c, &(0x7f0000644000)='/dev/audio\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000abf000)={0x1, 0x3, &(0x7f0000002000-0x28)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x6c}, [], {0x95}}, &(0x7f00002cf000-0xa)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000149000-0xc3)=""/195}, 0x48) 2018/02/04 21:33:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:26 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00006dc000-0x10)='/selinux/status\x00', 0x0, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000870000-0x8)={0x0}) ioctl$DRM_IOCTL_LOCK(r0, 0x4008642a, &(0x7f0000108000-0x8)={r1}) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:26 executing program 0: utimes(&(0x7f0000003000-0x8)='./file0\x00', &(0x7f0000001000)) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) select(0x40, &(0x7f0000000000)={0x2, 0x200, 0x0, 0x2, 0x1, 0x5, 0x86, 0x7ff}, &(0x7f0000c34000)={0x6af7, 0x1f, 0x10000, 0x100000001, 0x0, 0x7fff, 0x83b2, 0x415a}, &(0x7f000000b000)={0x5, 0x6, 0x1, 0x3ff, 0x8, 0x10000, 0xff, 0x8}, &(0x7f0000000000)={0x0, 0x2710}) 2018/02/04 21:33:26 executing program 2: mmap(&(0x7f0000000000/0x1c000)=nil, 0x1c000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) connect(r0, &(0x7f000000c000-0x26)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xffffffffffffffff, @dev={0xac, 0x14}}}}, 0x26) mmap(&(0x7f000001c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsa(&(0x7f000001c000)='/dev/vcsa#\x00', 0x80000000, 0x20001) mmap(&(0x7f000001c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TCSETAW(r1, 0x5407, &(0x7f000001d000-0x14)={0x80, 0x7, 0x1, 0x6, 0x2, 0x5, 0x11e2, 0x3ff, 0x3, 0x95}) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000005000)='/selinux/load\x00', 0x2, 0x0) [ 79.005576] binder: undelivered TRANSACTION_ERROR: 29189 [ 79.016755] cgroup: cgroup2: unknown option "" 2018/02/04 21:33:26 executing program 7: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x40) mmap(&(0x7f0000012000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0186416, &(0x7f0000012000)={0x1, 0x100000001, 0xfffffffffffffffd, 0xa25, 0xcef4369685ad3686, 0x3}) syz_emit_ethernet(0x7e, &(0x7f000000c000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @local={0xac, 0x14, 0x0, 0xaa}, {[]}}, @icmp=@dest_unreach={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x32, 0x0, @dev={0xac, 0x14}, @multicast1=0xe0000001, {[@ssrr={0x89, 0x13, 0x0, [@empty, @rand_addr, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @loopback=0x7f000001]}, @timestamp={0x44, 0x8, 0x0, 0x0, 0x0, [{[]}]}, @end, @ssrr={0x89, 0xf, 0x0, [@empty, @loopback=0x7f000001, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}]}, @ra={0x94, 0x6}, @generic={0x0, 0xc, "107777ff0010020003f4"}]}}}}}}}, 0x0) 2018/02/04 21:33:26 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001000)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) bind$packet(r0, &(0x7f0000e1d000)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="fb65497c1ebf"}, 0x14) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00008ea000), 0x4) syz_emit_ethernet(0x3e, &(0x7f00004ab000-0x126)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, {[]}}, @icmp=@time_exceeded={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @multicast2=0xe0000002, @multicast2=0xe0000002, {[]}}}}}}}, &(0x7f00006c1000-0xc)={0x0, 0x1, [0x0]}) r3 = dup3(r0, r0, 0x80000) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f00000fc000-0x4)={r0}) 2018/02/04 21:33:26 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000195000)='/dev/sg#\x00', 0x5, 0x10000) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000f9c000-0x10)=[{0x3, 0x9}, {0xb, 0x4}], 0x2) openat$pfkey(0xffffffffffffff9c, &(0x7f00000a1000-0x15)='/proc/self/net/pfkey\x00', 0x40, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x8000, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0xede, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0x0, @perf_bp, 0x800000}, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x32, &(0x7f0000005000-0x100)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x7, 0x4, 0x0, 0x0, 0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x0}, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, {[@cipso={0x86, 0x6, 0x0, []}]}}, @udp={0xffffffffffffffff, 0xffffffffffffffff, 0x8}}}}}, &(0x7f0000001000)={0x0, 0x1, [0x0]}) 2018/02/04 21:33:26 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000001000-0xb)='/dev/vcsa#\x00', 0x3, 0x8000) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f00009f3000)="153aa42a7da6ee96d75ecce3642a6df5fff0e66e6db6c9d497fd8ab32d") mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000)=0x428, &(0x7f0000f51000)=0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x802, 0x0) io_setup(0x2, &(0x7f0000412000-0x4)=0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f00001bd000-0x14)={0x100, 0x40, 0x9, 0x3, 0x1, 0x9, 0x0, 0x8d, 0x1, 0x3ff}) io_submit(r2, 0x4, &(0x7f0000047000-0x10)=[&(0x7f0000d60000-0x40)={0x0, 0x0, 0x0, 0x8, 0x1000, r0, &(0x7f00001c7000)="277d4582e805dd15675b01be062cd1fc7e76fe89638d9c3a5a30e164f5c30169efea812fc5c3480c094b39cb26b2713be636cda1a3e60733736b77a4e75a176a95295fb77a4af3adc0b0a83197f3faf7653a78f9f7b5490fd2202e635e0ad2b2fd09fde8db35d6359dca5a123b218cd37bd1b4c4cabbe291aa15f6eb9c44c8f62248d7f265af7bb0c34a284f6c4964bda5b404ceaa3e", 0x96, 0x78, 0x0, 0x0, r0}, &(0x7f000007b000)={0x0, 0x0, 0x0, 0x1, 0x9, r1, &(0x7f00008f3000-0xb1)="3ae65643244ed6a180b13f6839dd2871ddb1deda6a829c9269823092976b0e38b7ecdbad3b5dc644bc52780739ce3c9f3b578f351bd2532ab20b23cad6bf50fb2cf54b7ca9975bd642c4d857b70909cb9ec7aa4fef1943f8d6b7a6bf0fa2688d7707c5d6dbe15bccefc2a98d8456f3ff02c51b5e0ed3e427f15450d2400a448b02429e61837fb0f3659de9087ed122af4af5562438afe6c77acc02ff3ddd88704efcc2500546913a10da2af6ecb52b052b", 0xb1, 0x3, 0x0, 0x0, r0}, &(0x7f0000893000)={0x0, 0x0, 0x0, 0x1, 0x200, r1, &(0x7f000010a000-0x77)="829e545211a95c71cdbce12339e053212f41077d06d8e8e47b42217598c7c37a799eca155b68d3a2fb47a8a4b1f175600461e7455956ebde11d3ea12e4aeff4c94a393a7d22861c41f4b913457338ff4355ea1a498615bb3cd2f95ee426c5a2e560ec7bf7ebeba158d285e45c21c38c5e9d41c80ea6ed9", 0x77, 0x2386, 0x0, 0x1, r0}, &(0x7f00009cb000-0x40)={0x0, 0x0, 0x0, 0x1, 0x7fff, r0, &(0x7f00002d9000)="e9d8999a820249c66abff94480f6f24ff76a4ea6036c04e6145dd01462eeb5cb4e7dc683cd7884362746eb7ceef71184e842ba9ed7a9fe815631178db887d8b45a7a5266605ba0b3d89410a959da7aa542c087765d508a6884bb03ee23e592", 0xffffffffffffff78, 0x2, 0x0, 0x1, r0}]) write(r1, &(0x7f0000633000-0xa0)="2b484ac5cd776279f5eb91059dfd0d83ca31856d4615c82ba328eb0100d4fd702fdbdbd148238708422382ebac000000009914d944f90408e03b3a36e940e12d59d8bb060b7b7131d4d56b8693cb295d4c86d9c21b2ff6105d3124542f115e0e692fe6084ca29b214afa95078931c0a029f7c5d4ded3b025342a096087ab4ba100000005de51342d2678d5f111386599bee9ab50a3c1c80e48657b9b4ee9ae7e", 0x67) sendmsg$nl_generic(r1, &(0x7f0000e54000)={&(0x7f0000765000)={0x10}, 0xfffffffffffffcfe, &(0x7f0000572000)={&(0x7f000054b000)={0xfffffffffffffe8e, 0x10, 0x301, 0xffffffffffffffff, 0xffffffffffffffff, {0x1f}, []}, 0x14}, 0x1}, 0x0) 2018/02/04 21:33:26 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000000)={&(0x7f0000004000)={0x1d}, 0x10, &(0x7f0000003000-0x10)={&(0x7f0000009000-0x80)={0x0, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5925f75a699fa9c8f7bbf2a7123d72ba0ea206d213937de62d977e6fc768a581c7d0578023e55746b849844fc207b0865a0f028bd6f2ce30cd18966bb5a40c2e"}}, 0x80}, 0x1}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) [ 79.067706] binder_alloc: 10046: binder_alloc_buf, no vma [ 79.073439] binder: 10046:10050 transaction failed 29189/-3, size 24-8 line 2957 [ 79.100165] binder: 10046:10062 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:26 executing program 7: mprotect(&(0x7f0000d16000/0x1000)=nil, 0x1000, 0x1000001) 2018/02/04 21:33:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = signalfd(0xffffffffffffff9c, &(0x7f00001d5000)={0x7}, 0x8) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000fb6000-0xa)='/dev/cuse\x00', 0x410000, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000e02000)={r0, r1, 0x5}, 0x10) mq_timedreceive(r1, &(0x7f0000e08000)=""/187, 0xbb, 0x8, &(0x7f00000fe000)={0x77359400}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00003f8000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(authencesn(crc32-pclmul,ctr-twofish-3way))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000ba1000), 0x0) 2018/02/04 21:33:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:26 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffff9c, &(0x7f0000000000)={&(0x7f0000000000)=@pppol2tp={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @broadcast}}}, 0x26, &(0x7f0000fea000-0x10)=[{&(0x7f0000001000-0xfb)=""/251, 0xfb}, {&(0x7f0000001000-0x86)=""/134, 0x86}], 0x2, &(0x7f000061f000-0xfd)=""/253, 0xfd, 0x9}, 0x123) setsockopt(r0, 0x1f, 0x2, &(0x7f00001d2000)="bdc86e102b1673983f366d1a91837a63ce057877b8cdb2d3c4ae092edfaeae141d7e066212fdf480d7aa27a60ee0e6c94b418e9a6bceabc16a985cf0a86f841938444bc729dd8a218e43a5f3309e5b92d53bcb111fede9fe64879b83339b14e9575adc58fd48cd9c224eb8573424d9dadaaa99e105aceb7ea9e7f9120e2ec599aa004ae594f697f6baad824e9888fc7c018b576f302fd2b2279258e1aa6fc7aa7d658078792caf7ef49208b98c0df45b14b1023afc30a707b8dff0ed", 0xbc) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) accept4$nfc_llcp(r0, 0x0, &(0x7f0000002000-0x4), 0x0) r1 = socket(0x2, 0x2000080003, 0x4) getsockopt(r1, 0x0, 0xce, &(0x7f0000002000-0x8)=""/8, &(0x7f0000001000-0x4)=0xfffffcf3) 2018/02/04 21:33:26 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f0000cc9000-0x40)={0x0, 0x0, 0x200}, &(0x7f0000587000), &(0x7f0000680000)={0x0, 0x0, 0x0, 0x20}, &(0x7f0000fab000)={0x77359400}, &(0x7f0000205000-0x10)={&(0x7f0000cc9000-0x8), 0x8}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000a4000-0xe8)={{{@in6=@local, @in6=@remote, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@empty}}, &(0x7f0000dfe000-0x4)=0xffffffffffffff77) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000eb4000-0x16)='/selinux/checkreqprot\x00', 0x200000, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000bb8000-0xa0)={0x0, @in6={{0xa, 0x3, 0x80000000, @dev={0xfe, 0x80, [], 0x0, 0x13}, 0x1}}, 0x1, 0x4, 0x6, 0x9, 0x1}, &(0x7f000070a000)=0xa0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000623000)={r2, 0x1}, 0x8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000b6c000-0xe8)={{{@in=@multicast1, @in=@multicast1}}, {{@in=@rand_addr}, 0x0, @in=@multicast2}}, &(0x7f0000fc9000)=0xe8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000d2a000)={r2, @in={{0x2, 0x3, @loopback=0x7f000001}}, 0x3, 0x101, 0x3, 0x800, 0xffff}, &(0x7f00006b4000-0x4)=0xa0) getgroups(0x0, &(0x7f0000293000)=[]) chown(&(0x7f0000c77000)='./file0\x00', r0, 0x0) 2018/02/04 21:33:26 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000001000-0x8)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000660000)=0x0) fcntl$setown(r1, 0x8, r2) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$llc_int(r0, 0x10c, 0xc, &(0x7f0000964000)=0x6, 0x4) setsockopt$sock_void(r0, 0x1, 0x3f, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_settime(0x0, 0x1, &(0x7f000077c000-0x10)={{0x77359400}, {0x77359400}}, &(0x7f0000ca8000-0x10)={{0x0, 0x0}}) clock_getres(0x7, &(0x7f0000f9f000)) ioctl$TIOCLINUX3(r0, 0x541c, &(0x7f0000042000)=0x3) sched_rr_get_interval(r2, &(0x7f0000858000)={0x0}) futex(&(0x7f000029e000)=0x4, 0x7, 0x0, &(0x7f0000337000)={r4, r3}, &(0x7f00004b3000-0x4), 0x4) [ 79.161173] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=30669 sclass=netlink_route_socket pig=10074 comm=syz-executor2 [ 79.177613] binder: undelivered TRANSACTION_ERROR: 29189 [ 79.228243] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=30669 sclass=netlink_route_socket pig=10074 comm=syz-executor2 [ 79.242492] binder: 10093:10095 transaction failed 29189/-22, size 24-8 line 2842 2018/02/04 21:33:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000f23000-0x4)='net\x00') ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) syz_open_dev$sndctrl(&(0x7f0000b9c000-0x13)='/dev/snd/controlC#\x00', 0x6, 0x0) open$dir(&(0x7f000040e000)='./file0\x00', 0x4001, 0x10) getdents(r0, &(0x7f0000da8000-0x91), 0x0) 2018/02/04 21:33:27 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) setrlimit(0xe, &(0x7f0000a19000)={0x6, 0x5}) 2018/02/04 21:33:27 executing program 3: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$nfc_llcp(r0, &(0x7f0000001000-0x1c)={&(0x7f0000000000)={0x27, 0x7, 0x7, 0x7, 0xdfb5, 0x80, "468f0fbe6419e20e0fc2ca3520772f1055eea37ce41d151b9a77c744d4666b25efd0e837c3039a836a8a36fbabd8c4c1ff76909492494f1dbecad4e5f6ce6c", 0x5}, 0x58, &(0x7f0000d41000)=[{&(0x7f0000ba0000-0xb1)="b190328664131a9a5927186af7590bf2e1184eddcfbf7663c6c0a5c398a794f59af344c5636b992e2d63fcccac92f371ce8993e77e7cfddb82e652847cdcc1c570df8c5243b93db6f1bcc279175a3d4dfd3687dea03acbed96692b05b36f87fe05b58b02dca362845c62a6d9f47e358ad464eaf515f32d631411a4ddf4cd01d41ac9617bcc87e41400154228c642afdf9b3665c62bab2981444382862dfd33507b0dc381fa36483a45b306605cd2d20241", 0xb1}, {&(0x7f0000000000)="c951227ef418614a1c071b86c466e8fcd311d6dcbbec965574e4d8446dfe61302a28d97d67025c508e7d665f47f61963f21a41d05439d1f5e4023309df4843ac613d9ffd1c026a3a339fc99d0c3d5cb3b9ef5f7001674902d8c8252872bcd22dac1dd38be66f70d1c3bf94eb138cd9ee551175d4c2419e09a7f28e741b6f8a11a70e132d480d3b2d5f3f794afe80da6ca54a06ff8ac9c7a3eba2fa011a95e9ac6d554d4f97b5e36b5d3be735eb653cbeff89ab52825f", 0xb6}, {&(0x7f0000962000)="d252ad5195fa96a9363c80838e603a36bfe393dc0e053b91daab4fdd3eb395cbb2bf1b294fd67d9dfc9143b31db2df0e6de88d59838dd4f10cedffebae76ad7d2b8bb71303f0", 0x46}, {&(0x7f00009b5000-0x1a)="115e0dce32e8e90abcf60eb97039c7fbe7ac407ca31a24698244", 0x1a}], 0x4, &(0x7f0000000000)={0xac, 0xff, 0x5, "a9450cb1c2fdc9d05c112146a1fddd4f2e552297ff46cab8839ec893cb7bef5d2d6e3058541deb40877b2bf8d5d128dffa49fe1dd51a4a57129b925b49eaece3839ac04f6f04858b6b3b87d9c079f7ffdd26f9ad97c5dc217432288a1ff3344b111e9fa8bf915d58ec2a145f41ccecd02f5a8fa5da7c7679547bd581662eb08305956db746f1c1d54d758ac504abdc9f84bf2f6eeb2af48562788a98b519ea"}, 0xac, 0x5}, 0x50) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) dup2(r1, r1) setsockopt(r1, 0x114, 0xa, &(0x7f0000000000)="00020008", 0x4) 2018/02/04 21:33:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f000029c000)='/dev/sequencer2\x00', 0xc0000, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f000042b000)={0xaa, 0x2}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000ce1000-0x9)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CHECK_EXTENSION_VM(r2, 0xae03, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x4000000000000) creat(&(0x7f000028c000)='./file0\x00', 0x2) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000eaf000-0x400)={"8a927799b01a02f625061eda96dd379385fc78b28fcbf8eb8455a6fb67a8de46d4d40000a01a47191dc792f414ac8437036bb34b6632c900073c4cdc084a1966c440f15811d016f5b50e90810603f10a2c83eb8c062194269ab67e4bb4b3c5199cadd60d3f6fc72a7eb011b622072532ff9fbc9d9c4d1e045191ee2b0d584c8fd736ee3e7d73d5267b67a69251b1a8647e90692d30ecfb806326f17f0a7a24aa58b111193c88181907d958cb62807d63dfb58775215937ae2b00b46c6d5816f2fc52eeab0000000000000003252929e628ad2c34a0ef717fb2504d9bd66eabce002faf0512145c072f3087a5566c38fda729442c3ebd62e970a9a3eb242747993601a1a186b8376d39c69c4ce503b2638feeae79076a9708b3bb19f38377382ea7b4c9c2d674b80ef2e6da0000a8200de4794547b4ca6430ac512116d358949a2988d6c5d54017aa2fc8b8e3ecf28c41d4c83474ba93a8ad32b16371b42350bf984abb465228cfd848e54abc383d21d0a3315f1b85999ca1bf10bd30a1371757b13aed4aa5db7c777995fd42ad446d812755f8552563c7639ce00da8ee3ece9ded52625aa3f0a1d7b76b32536d39eeae158271064ea79bddf1032b6e6ac794f37ec9d0c3bc4923cc7b631c6df64f28d75d99443d6653db3c857961190e8f82a233000001002ce4f47168ef93f01aef51c60000000000000006af34b21ed8437a371c0b427cd8c94f3952ee752b758eb5bf9f0a0c4f4793cd6638a2a23d68cb6e86925599fbc1361b8ce27b41d79027894b6c0003cc97a64088edf383a51eef947915369bdd4fc3cd00000000000000058fbba284c5b6ffc5257a19eaee59d117d34c73e50fbd33ceb4508cfa4eecb712bb11fc4a114a13542dee77b2651783f619d9260036ccc70d695105d1ddb56f1ac26584547d8d5cecb3c60000000000000004ae0a253b587d712c6113acdf49fa0108de0f7b3717528e35b7e70733538a8eec8fb17616d2198d02ba4e7690fab7933b676deddb27755d6a8f29c643dfff0e4bffc2b13b1057a3120600cbb70000339db4862dafad481a63e7f90d14c54803d8b100e0ad5cae9a0a7b0300ef3b0000000000000002f4b2eebf5bcd42688b08ff0a0000000181f01c13c7cb674ff41cb3c7f6896d41e86bda845164825e28b9fb719e695a9eb9710f924aefde1c96c6be4274594038347691a088f9bcaeba90315d3b3cfc24388cc15d0004a1bd610582c5b74fa6c6e70004440f71871a5e8b85000000005806743e8e075b8624686feb21dbdb9afd74dd0067d82a72c099a2d52a599494388cb56cdb5ef9190980f9128e689e07e98b2ed59e1537fc7de144dc2030374b0f5fcfd8f2ef242803f7bcbc07145f65b400000000000000e8acf080852c49d353a00a5aac3d6a33e2075506a1fd25799f1637b1bafaf09954ef"}) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) sigaltstack(&(0x7f00007d9000/0x4000)=nil, &(0x7f000029c000)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2018/02/04 21:33:27 executing program 2: mmap(&(0x7f0000000000/0x6000)=nil, 0x6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x80000000005016, &(0x7f0000004000-0x8)=0x8) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f0000008000-0x48)=@hopopts={0x0, 0x8, [], [@jumbo={0xc2, 0x4, 0x200}, @pad1={0x0, 0x1}, @jumbo={0xc2, 0x4, 0x10001}, @ra={0x5, 0x2, 0x4}, @generic={0x3, 0x11, "2fc72b8d0b8094a0d842075b86fb57d140"}, @enc_lim={0x4, 0x1, 0x101}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @dev={0xfe, 0x80, [], 0x0, 0xc}}]}, 0x48) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000007000-0x110)={0x6, {{0xa, 0x1, 0xfffffffffffffffb, @loopback={0x0, 0x1}, 0xffffffff}}, 0x0, 0x1, [{{0xa, 0x0, 0xffff, @mcast2={0xff, 0x2, [], 0x1}, 0x7ff}}]}, 0x110) 2018/02/04 21:33:27 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f00009b6000), &(0x7f0000744000), &(0x7f0000f8b000), &(0x7f0000804000)) mknod(&(0x7f0000e79000-0x8)='./file0\x00', 0x1040, 0x0) r0 = inotify_init() r1 = getpgid(0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f0000bdc000-0x4)=r1) execve(&(0x7f0000f8b000-0x8)='./file0\x00', &(0x7f0000f68000-0x8)=[], &(0x7f000020a000-0x20)=[]) perf_event_open(&(0x7f0000015000-0x78)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = gettid() gettid() sched_setaffinity(0x0, 0x8, &(0x7f0000294000-0x8)=0x9) kcmp(r2, r2, 0x0, r0, r0) creat(&(0x7f0000b7a000)='./file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000053d000-0x8)) 2018/02/04 21:33:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00006ec000)="8907040000", 0x5) sendto$inet(r0, &(0x7f0000890000), 0x0, 0x0, &(0x7f0000970000-0x10)={0x2, 0xffffffffffffffff, @empty}, 0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndmidi(&(0x7f0000908000+0xb92)='/dev/snd/midiC#D#\x00', 0x0, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000005000-0x14)={0x2, 0x4, 0x5, 0x40, 0x40000000}, 0x1c) r2 = socket$bt_cmtp(0x1f, 0x3, 0x5) pipe2(&(0x7f0000a2a000), 0x800) fdatasync(r1) setsockopt$bt_BT_CHANNEL_POLICY(r2, 0x112, 0xa, &(0x7f0000410000-0x4)=0x9, 0x4) [ 79.269147] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:27 executing program 7: mmap(&(0x7f0000000000/0x22000)=nil, 0x22000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f000001e000-0x9)='/dev/dsp\x00', 0x8000, 0x0) mmap(&(0x7f0000022000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000022000)={0x0}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r1, 0x4008641c, &(0x7f000000d000)={r2, &(0x7f0000002000-0xa4)=""/164}) sendmsg$nl_generic(r0, &(0x7f0000008000-0x38)={&(0x7f000001a000)={0x10}, 0xc, &(0x7f0000013000-0x10)={&(0x7f000000d000)={0x30, 0x32, 0x401, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@nested={0x1c, 0x1, [@typed={0x18, 0x1, @ipv6=@empty}]}]}, 0x30}, 0x1}, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000005000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) mmap(&(0x7f0000022000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000023000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000023000)={r0}) getpeername$packet(0xffffffffffffff9c, &(0x7f0000009000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty}, &(0x7f0000022000)=0x14) recvfrom$packet(r3, &(0x7f0000006000)=""/95, 0x5f, 0x101, &(0x7f0000015000)={0x11, 0xf6, r4, 0x1, 0x4, 0x6, @empty}, 0x14) 2018/02/04 21:33:27 executing program 5: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f000023a000)='/dev/autofs\x00', 0x200000, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000001000-0x16)='/selinux/checkreqprot\x00', 0x400000, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000d08000)={r1}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000001000-0x8)={0x0}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f0000000000)={0x6, 0x7, [{0xb1, 0x0, 0x7}, {0x1000, 0x0, 0x9}, {0x4, 0x0, 0xda89}, {0x2, 0x0, 0x3af}, {0xffffffffffff0001, 0x0, 0xffff}, {0x5, 0x0, 0x3}]}) getsockname$inet6(r2, &(0x7f0000001000-0x1c)={0x0, 0xffffffffffffffff, 0x0, @loopback}, &(0x7f0000001000-0x4)=0x1c) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000000)={&(0x7f0000000000)='./file0\x00', 0x0, 0x10}, 0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x7fffffff, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:27 executing program 3: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$setfpexc(0xc, 0x3) recvmmsg(r1, &(0x7f0000000000)=[{{&(0x7f0000002000-0x80)=@generic, 0x80, &(0x7f0000000000)=[], 0x0, &(0x7f0000001000)=""/254, 0xfe}}, {{&(0x7f0000001000-0x10)=@ipx, 0x10, &(0x7f0000002000-0x8)=[{&(0x7f0000002000-0xc1)=""/193, 0xc1}], 0x1, &(0x7f0000000000)=""/84, 0x54}}], 0x2, 0x0, &(0x7f0000002000-0x8)={0x0, 0x1c9c380}) [ 79.343923] binder: 10111:10120 transaction failed 29189/-22, size 24-8 line 2842 2018/02/04 21:33:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000644000-0x10)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00007c9000-0x4)=0x10, 0x800) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f0000f11000-0x88)={0x7ff, {{0xa, 0x1, 0x1ff, @loopback={0x0, 0x1}, 0x5}}}, 0x88) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000bc0000-0xa)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCSETA(r1, 0x5406, &(0x7f00000ed000)={0x7fff, 0x0, 0x0, 0xddc}) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b4000-0x24)) write(r1, &(0x7f0000347000-0x70)="4f7ad0c9edffe9486f1748144523c0c253773e00d4bba29028eac32e8de58f5930fd4c8ebb78dcf50bbc54c90c0ea17b4763dde5f9eedfc811b38375640258335444c9fe3d13", 0x46) r2 = syz_open_pts(r1, 0x600000) writev(r2, &(0x7f000036f000-0x70)=[{&(0x7f0000dcb000)="10", 0x1}], 0x1) ioctl$TCSETS(r2, 0x5402, &(0x7f0000a31000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x10000}) ioctl$KDGKBMODE(r2, 0x4b44, &(0x7f0000690000)) 2018/02/04 21:33:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$admmidi(&(0x7f0000121000)='/dev/admmidi#\x00', 0x3, 0x202000) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f00002ca000)={0x9}, 0x1) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000770000+0xd5b)=0x8, 0x4) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000af0000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) io_setup(0xf99, &(0x7f00009fa000)=0x0) io_cancel(r2, &(0x7f0000b50000)={0x0, 0x0, 0x0, 0x3, 0x2, r1, &(0x7f0000129000-0xcd)="c49b4d777f80dddb52872bcdcd7d07e378ba3256f46934e921182ebae700ea39a62e7d042c50847bbfd08699b2f19645db04c56c3116267f27fe24055c65330ca3fe21420d2d8034efa47c06b042430cf85d487e97521605b8f39b407e2fcf1f2d6075611292b891a2224c8f8a78d084a2e0c330ab5ea10a5eafc01a5bbbe71ac3b70328a0643815ab53d2fc5a7eaec5046b7d42ecf46db47613e95c1c4dbb2caf7196571312a3f6e749429fb814d745ddaa87b313ea7ef91dee021baaa49b19ae1a875c24c5ce5af2e0cd6184", 0xcd, 0x9, 0x0, 0x0, r1}, &(0x7f0000a52000-0x20)) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f00001f7000-0x120)={0x9, 0x1, 0x400, 0x8, [], [], [], 0x4, 0xff, 0x0, 0x6, "667b6464c129d34657d30cd1548f98d1"}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$l2tp(0x18, 0x1, 0x1) bind$inet6(r3, &(0x7f000061d000-0x1c)={0xa, 0x3, 0x2, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, 0x7bc9afde}, 0x1c) connect$l2tp(r4, &(0x7f00005fb000-0x2e)=@pppol2tpv3={0x18, 0x1, {0x0, r3, {0x2, 0x1, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e) sendmsg$nl_crypto(r4, &(0x7f0000380000-0x38)={&(0x7f0000b4e000-0xc)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000704000)={&(0x7f0000e6d000-0x10)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3, "", []}, 0x10}, 0x1, 0x0, 0x0, 0x8800}, 0x81) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000c1d000-0x28)={'vcan0\x00', 0x0}) r6 = getpgrp(0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00004b9000)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000584000-0x4)=0x18) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000cd2000-0xc)={r7, 0x1}, &(0x7f0000292000-0x4)=0xc) ptrace$getregs(0xc, r6, 0x4, &(0x7f0000358000)=""/138) setsockopt$inet6_IPV6_PKTINFO(r3, 0x29, 0x32, &(0x7f00004f8000-0x14)={@local={0xfe, 0x80, [], 0x0, 0xaa}, r5}, 0x14) [ 79.419426] netlink: 20 bytes leftover after parsing attributes in process `syz-executor7'. [ 79.421889] binder: undelivered TRANSACTION_ERROR: 29189 [ 79.476410] netlink: 20 bytes leftover after parsing attributes in process `syz-executor7'. 2018/02/04 21:33:27 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x805, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000aa7000-0x98)="ff020400ae0000010000000000000000000001000000020594e15b82f3d219ccf965f0a499ec31b90050ec2471b5680747a301ef83becdfcf0d025b90a6b6fbf3cebdfff5aaa1a160b5d172852cc0000000000008001bbaa2acb91f8b5c8209c9d80a6c08eca900d247e4f427aa4473e395c5ca00000000000000009e1619d51de9932b0fa93f2b08a349c77f1eca6073f3f92d23b27ed11", 0x28f) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00008cd000-0x10)={0x0, 0x1c, &(0x7f0000e76000-0x1c)=[@in6={0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, 0x7}]}, &(0x7f0000e4e000)=0xc) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000e0e000-0x9)='/dev/dsp\x00', 0x801, 0x0) fcntl$dupfd(r2, 0x0, r2) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f00005db000-0x8)=@assoc_value={r1, 0x4}, &(0x7f0000a95000)=0x8) 2018/02/04 21:33:27 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000514000)='/dev/ppp\x00', 0x200, 0x0) ioctl$KVM_SET_ONE_REG(r0, 0x4010aeac, &(0x7f000086f000)={0xffffffff, 0x8}) 2018/02/04 21:33:27 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndseq(&(0x7f00001c1000-0xd)='/dev/snd/seq\x00', 0x0, 0x2000) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa}) r1 = syz_open_dev$vcsn(&(0x7f00002f0000-0xa)='/dev/vcs#\x00', 0xfff, 0x8200) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f00000c1000)=""/17) ioctl$UFFDIO_REGISTER(r0, 0xc028aa03, &(0x7f00000a1000-0x20)={{&(0x7f000014d000/0x800000)=nil, 0x800000}, 0x200000}) 2018/02/04 21:33:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000ac0000)='pkcs7_test\x00', &(0x7f00008d9000)={0x73, 0x79, 0x7a}, &(0x7f0000095000-0xd1), 0x0, 0xfffffffffffffffe) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000d99000-0x4)=0x0) r2 = syz_open_dev$audion(&(0x7f000076a000)='/dev/audio#\x00', 0x1, 0x0) ioctl$KVM_SMI(r2, 0xaeb7) connect$ipx(r2, &(0x7f0000390000)={0x4, 0xffffffffffffffff, 0x7, "3ae60246677c", 0x6}, 0x10) r3 = fcntl$getown(r0, 0x9) kcmp(r1, r3, 0x6, r0, r0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000fd8000-0x4), &(0x7f00005e7000)=0x4) 2018/02/04 21:33:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x1000000010, 0x802, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000f7f000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) sendmsg$nl_route(r0, &(0x7f0000f7c000)={&(0x7f0000f7b000)={0x10}, 0xc, &(0x7f00008ca000-0x10)={&(0x7f0000aa8000)=@newlink={0x2c, 0x10, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r1}, [@IFLA_ADDRESS={0xc, 0x1, @link_local={0x1, 0x80, 0xc2}}]}, 0x2c}, 0x1}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00002b8000)) 2018/02/04 21:33:27 executing program 2: openat$vcs(0xffffffffffffff9c, &(0x7f00004fc000)='/dev/vcs\x00', 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000e89000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x80) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x21, &(0x7f0000a42000)={@multicast1=0xe0000001, @multicast1=0xe0000001, @rand_addr}, 0xc) 2018/02/04 21:33:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000c48000-0x14)={0x6, 0x4, 0x84, 0xf}, 0x14) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000ffd000)={r0, &(0x7f0000dfe000)}, 0x10) syz_open_dev$sg(&(0x7f0000d72000-0x9)='/dev/sg#\x00', 0xfffffffffffffffc, 0x8000) 2018/02/04 21:33:27 executing program 2: r0 = socket$inet6(0x10, 0x3, 0x10) sendmsg(r0, &(0x7f0000003000-0x38)={&(0x7f0000000000)=@nl=@kern={0x10}, 0xc, &(0x7f0000002000)=[{&(0x7f000000e000-0x56)="5500000018007fafb72d1cb2a4a280930506000000a84308910523692500080008000500000000001900a30700000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab91d4", 0x55}], 0x1, &(0x7f0000006000)=[]}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00009c3000-0xc)={0x0, @empty, @rand_addr}, &(0x7f0000acb000-0x4)=0xc) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000571000-0x50)={@loopback={0x0, 0x1}, @remote={0xfe, 0x80, [], 0x0, 0xbb}, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x7, 0x2, 0x0, 0x100, 0x80000001, 0x10, r1}) 2018/02/04 21:33:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 79.854541] binder: 10161:10165 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x20000000000000a, 0x2, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000742000-0xc)='/dev/amidi#\x00', 0x80, 0x20000) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f00006d1000-0xa8)={0x5, 0x0, [{0xf000, 0xb1, &(0x7f00001c9000-0xb1)=""/177}, {0x110000, 0x0, &(0x7f0000745000)}, {0x106000, 0x6d, &(0x7f00008dc000-0x6d)=""/109}, {0x3000, 0x12, &(0x7f0000c00000)=""/18}, {0x0, 0x68, &(0x7f000055e000-0x68)=""/104}]}) perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) eventfd2(0x0, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x8000000018, &(0x7f0000aa1000-0x14)={@remote}, &(0x7f0000768000)=0x14) 2018/02/04 21:33:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000cc3000)='/dev/kvm\x00', 0x8000000000005, 0x0) perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000271000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) name_to_handle_at(r2, &(0x7f00007fd000-0x8)='./file0\x00', &(0x7f0000143000)={0x19, 0x1, "fbcd1b20d33678e9d2f0ccf8537b8ef99a"}, &(0x7f00003c4000), 0x1000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00006a5000-0x9)='/dev/kvm\x00', 0x80, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000305000)={0xfffffffffffff801}, 0x8) socket$rds(0x15, 0x5, 0x0) r4 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000f47000-0x1c)={0x0, 0xffffffffffffffff, 0x0, @ipv4={[], [], @rand_addr}}, &(0x7f0000d89000)=0x1c, 0x80000) setsockopt$inet6_dccp_buf(r4, 0x21, 0xe, &(0x7f0000095000)="d915d19e6a62089bd38606f54fc44fa324cf318c5ad1aa9c243dcd3a0458861e6adc31c9432f48e4c629d0af151cde9e5ca80b362375a35b078b23d64bfeb6e987b62963d3cdef8b54c84e82417002a71f2f83946b7188a7a78b8269c050d2d21a23f875400efe80866e429d0257855902f77f9bb019d7fb41040af08ce3174351fa4b8f1aaf0414d7b77f3669efadedbc01e74f79e0a65dd504942670359ae0d09efee1fd9792827ba52b158ced61cecf0d12a01a9eceecd7b1107a14557cf5e00cbff01f", 0xc5) pipe2(&(0x7f0000e3f000-0x8)={0x0, 0x0}, 0x80800) r7 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KDSKBSENT(r5, 0x4b49, &(0x7f00005a0000-0xfc)) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1c, &(0x7f000070f000-0x4d)=""/77, &(0x7f000060b000)=0x4d) r8 = dup3(r7, r6, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000518000-0x8c)={0x0, @in={{0x2, 0x2, @rand_addr=0xfff}}}, &(0x7f0000201000+0x467)=0x8c) setsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000149000-0x14)={r9, 0x0, 0x10000, 0xe74b, 0x4, 0x7fffffff}, 0x14) ioctl$KVM_GET_XCRS(r6, 0x8188aea6, &(0x7f000054b000)={0x3, 0x7e6f62e7, [{0x6d3, 0x0, 0x5}, {0x7, 0x0, 0x7e35}, {0x3, 0x0, 0x86cd}]}) listen$netrom(r6, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x1f, &(0x7f0000fa7000-0x98)={0x0, @in={{0x2, 0x0, @dev={0xac, 0x14, 0x0, 0xc}}}, 0x0, 0x800000000001}, &(0x7f0000eb9000)=0x98) clock_gettime(0x0, &(0x7f0000000000)) ioctl$KVM_SET_LAPIC(r7, 0x4400ae8f, &(0x7f0000352000-0x400)={"a71ba78a9bf31d2df0d0c297457757a174467809efaffaa995f9046fba369e65eebcca0cc52e08f49af68e2eee45bef7bcfe37cbf5f1c958f299beb073e7f0b97d8bf2b87c39d9466f93e26900e2fa5ecd73c7ed7a0d7152a6e1ec07cc9757db7da6b895740e70ad007f55c30bbde0509fcf2dc2f88611144a443a0ae64365a717bb8008fe12a929f4761f6fce77bf80b6bcacca040fba643c7cbb6839a3055b460cb3d1facc8f44a5066c26eddea2dbe57f77ae385da8128e18e55db5440051716678e4a98ba4a3556c0682868097c7b2f00424f32fc7b583e5897073c64c2baa03da154ebcfaaa7d1f2c9be4d3172c23aea7e835ad34cdce7a643208af22e9d99ebf883f2069313ee4696a6b99a0d0295070672d57e4bf558684c3cb04c966912fdaad3dd0d228b64af9587a942adfa392a71ebb63baa020b260e68c4b653831560dafbb70714c893aad4fc5b3681929a155a0f49b82f29bf22e27f69a8e53d56fe871456837ea6376bc9a639c030dc669cded5f107bfe2cae4e4f7f4a1c563f938940bc3625fa6b086e75db3707768ada7ffd15cb8d1b1ec2d61091b9a0e4682e85bf98e3ac3a4b11091c04998d13996950b61ad1c7faceb7df2dcd8dc5473fe20b111645a0f401dc442f9d3d68cb27b714c5591efe007adae00a23a2646322d5116f2c6862afce543fd378f797086e5ff2efd2c657e8ee741f2fbf6b73d1cc65c5ab894c47f52a426a25d994bc12e66bf375da54d8e9e7f9204996be42d47f6458b0b5259fbaf4b32d7ace94bba254eb1e5470ae5c2e9e66536e07d31dac9e2fc68e5bdde9fb20382e349cd495b4563f6717bfa865e1c9f99ae12c66330f34d02bf09411c972c35d8a739f4d3b02994d78d7204012cce368e577d00102f1ca9175921c680515f4badd3d943e41d955765f7f32858f189329b8e15ccbf184017c93fb37ee12fcaf012bd6f38b176e582f1b00cd0a36531b3719d5b35b750ab952fec4c58b7fc779237aeaebadde64166ca50497275aeb393ce72b7302e58086a7c013d70247f2769a4aae81e3221b20cea0167ee6cc9f2b89bc78777d52de142230ecbc610bfdee5b9a0c0d614758504313fe09325fd60e10a02069d9e62d795f4f9d017ef82e55ee7ba7c92e85f5c483894be07cdb22a07d23a1401ac066a62f006d106b59da4eca0238421fff405a4517fb3b90abb776846a36e4bebd6e5215c8a73829daa3c53363057acd375c5fa537584879d01ef84820567768b4cd3174fab6a7f368c917ddc1600cfbe0a58472b030f6d70925c854a16988fa76733063261aefa3d2195341787e95c4e41a26561d8797b9e1adefde29227081dfecdd40a0616905f499c9d8d27c71b6693b74863f5ed54089ab76c873fa3507031df8a0ad613bbd21c5f4a7b2c2627b786f5b06a5d5df651e65b54caadb6822c78a"}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000ded000-0x20)={0x10005, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$sock_inet_SIOCDARP(r5, 0x8953, &(0x7f0000323000-0x44)={{0x2, 0x0, @rand_addr=0x3}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x64, {0x2, 0x1, @broadcast=0xffffffff}, @common='bcsh0\x00'}) ioctl$KVM_SMI(r7, 0xaeb7) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000db9000-0x60)=[{&(0x7f0000ac5000)=""/187, 0xbb}, {&(0x7f00001db000-0xb2)=""/178, 0xb2}, {&(0x7f0000d69000)=""/229, 0xe5}, {&(0x7f0000a4f000)=""/34, 0x22}, {&(0x7f0000603000-0x7b)=""/123, 0x7}, {&(0x7f0000001000-0x83)=""/131, 0x83}], 0x6, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f00000d5000/0x18000)=nil, &(0x7f0000de9000)=[@text64={0x40, &(0x7f0000bff000-0x41)="0f20d835200000000f22d80f0118470f35f3ab77644ebe0f59128182818201bc8c6a000000674b0f015e9dc483996ba7d900f300004f4f21ae5ddc", 0x3b}], 0x1, 0x0, &(0x7f0000b8d000-0x20)=[], 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 2018/02/04 21:33:27 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000488000)='/dev/hwrng\x00', 0x400, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) connect$ax25(r0, &(0x7f0000000000)={0x3, {"77551906c5e62a"}, 0x5}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = fcntl$getown(r0, 0x9) getpriority(0x2, r2) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0xffffffffffffff3a, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f00009cf000-0x8)={0x0, 0x0, []}) prctl$getreaper(0x1b, &(0x7f0000a94000-0x4)) r3 = add_key$user(&(0x7f00002ac000-0x5)='user\x00', &(0x7f0000dcf000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f00004e9000)="1634d51d2ea2336944e3c177021c8f8849fc535f877287b83ebb407ff6c7a4b090fa37f1b58f3816867e9b0e344c53237aa9ee1f58689bbdd18b8020b80f792379834c538d6d1dad0f772af760f1d379b6f7796e9f56f5070c5d9fb9bc554757099535bf058be9a16061c480d2eae1266ef8aaeb75b416195995fa3a74370622ceb6826812022c377141480a5d9ade0e1fb342c9e620812f63e7fe5b820f023445b88c4a635a8682720e7536bd244ca49ddadc35f6736b7974ccf94e277b", 0xbe, 0xffffffffffffffff) r4 = request_key(&(0x7f0000b09000)='blacklist\x00', &(0x7f0000914000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000899000)='trusted[ppp0#\x00', 0xfffffffffffffff8) r5 = add_key$user(&(0x7f00000f4000-0x5)='user\x00', &(0x7f00004a5000-0x5)={0x73, 0x79, 0x7a, 0x3}, &(0x7f000008c000)="aaf5f104b74f61669e21053d7b8261606602bc29c4", 0x15, 0xfffffffffffffff8) keyctl$dh_compute(0x17, &(0x7f0000347000-0xc)={r3, r4, r5}, &(0x7f00002cd000)=""/150, 0x96, &(0x7f00008f2000-0x4)={&(0x7f00009c4000-0x40)={'crc32c-generic\x00'}, &(0x7f00006c6000)="49c7853e42e45c55ce0d3218a0fbbb3a7476b64da1164d418a1d1ab268bf78b8f1032d4ac4c4a7b1a6579d", 0x2b}) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000e4d000-0x4)={0x3, 0x1, 0x8000}, 0x4) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0x6) 2018/02/04 21:33:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000445000-0x8)={0x0, 0x7}, 0x8) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000fb1000-0x5c)={{0xa, 0x2, 0x4512, @mcast1={0xff, 0x1, [], 0x1}, 0x5}, {0xa, 0x2, 0x7, @mcast2={0xff, 0x2, [], 0x1}, 0x6}, 0x5d, [0x144000000000, 0x40, 0x1, 0x100000001, 0x81, 0xff, 0x1, 0x1]}, 0x5c) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000321000)=[@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}], 0x1c) socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f000063a000)={0x0, 0x110401fd}, 0x8) connect$inet6(r0, &(0x7f00008c0000)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000cdf000)={0x0, 0x3f, 0x8000000000000034, [0x0, 0x3c]}, 0xc) 2018/02/04 21:33:27 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000001000-0x2)='\x00', 0x1) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) 2018/02/04 21:33:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(&(0x7f000021a000-0x3)='/dev/vcs#\x00', 0x7, 0x2) ioctl$sock_ipx_SIOCIPXNCPCONN(r0, 0x89e3, &(0x7f00008b1000)=0x1ff) sendmsg$nl_crypto(r0, &(0x7f00005ca000)={&(0x7f0000736000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00003b4000)={&(0x7f0000af9000)=@delrng={0x10, 0x14, 0x1, 0x7, 0x0, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1}, 0x40000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockname(r1, &(0x7f0000ff2000)=@pppol2tp={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @remote}}}, &(0x7f0000da8000)=0x26) r3 = getpid() getsockopt$bt_sco_SCO_CONNINFO(r2, 0x11, 0x2, &(0x7f0000eaf000)=""/12, &(0x7f0000b14000)=0xc) fstat(r0, &(0x7f000059c000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000451000)={0x1, 0x6, 0x4a, 0x9, 0x80, 0x80}) sendmsg$nl_netfilter(r2, &(0x7f000062b000-0x1c)={&(0x7f0000f7b000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00006cd000)={&(0x7f000090d000)={0x4ec, 0x3, 0xb, 0x400, 0x1, 0x0, {0x0, 0x0, 0x5}, [@generic="d8f1598ddaf0254df0826d46bf0eeadfd752b2319b5228090870893ef3ee867721cd02a1be8354930bc661b969e955214400e623cf32be7ac894b1e13f04cbc0d6a56250c50bcec7e44490963f63c57ebfadab8a9253d85e72fa97e7e07546e069a958abba874b8aff98f66c9f10580f41f6d38a71ff0fd27f3b5fa5cdce6bb8cecaf5678231f11476cffb5d8f1412e50ec3cea597ece55fc84efb46ad94b053", @generic="89aa16dd242abf61d8b2dc4403ff266f238f8800667199c7d49a60a660805371903ea3ac973ff1cea0f34b71ffdbc8f0e1f7f5d4b1db624a4776872be2e0bd71f426d7c2134020ab7379dc42b20c39ed2c51fcdbe7d6d29dd1d33da400a4d99583abcd5493eebc642ad850d3eeba421f150176f907b149ca94cbf8cb647b62ab49339cf5f3cca71ee5e839eb679081970747f8c520c6269cab93719317869e2782b4f84b62ae63fa69be0c057c76e3902dc7992144a45127bc28f4e83777384010282193aa07438c51cd8c73c8445bb94828d618d1f8b8a6f4ed5e4980", @typed={0xc, 0x1, @pid=r3}, @generic="61d3bcc41f959ce8dadbec0d4c26d020c50efc434b3103343cbd1b814d21f8d86c0116f2eb749da9411249a2d3a1ed4af2cc0aad73b9dae969f48b7402ff5692c47f01171e1d788601358e010513195edcd82df3bd3f6b0ee04ab1eac3f850a1b0d367f52168c939f491f46cba2bc45fca63c9d1045e3e96447e1eb87ab8228186e3218ef6c7c62e4105e027566a1a95b06ac0402a6eb0cd4aa99f8268261bb81d8e1cb0bca42ce97bea28ff49b8d798b700bee053bc6ae7a3aa733deacfa3bff7c33083a59b0bbc00e3589caddd6ecf706b1dede611c61197e7ca12d4bf", @typed={0xc, 0x2c, @ipv4=@remote={0xac, 0x14, 0x0, 0xbb}}, @nested={0x1b8, 0x81, [@generic="7d6a2497597210de43808e811e0ae7ebde63aab376aeaa02efeab88cb12e27df8b8b04d92c7e1a3eb18b0bd37baa5762d5a1bd2b9b1c1d336261b6cb50832788627ceb0c9415e123a2b11598c0d463cc1980f2f43a8f37c3f62dd0ca4bfa47b1f22c94ed74e39049a1e714d6e80474c41353868e67558ede623edeb52d2a5aea441a4c282b11a76e3970ba5134825aecc93876f7066adfdfc418fa0b9311c486cd2635b895ce3550522632330b76a86095f105d1fb14c031cb6448e38dad4366dec3fcc4d75df5c66bb255f1", @typed={0x18, 0x49, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @generic="3e8ea93942a2908416945870e6d8332c8b681f8de572e117", @typed={0x8, 0x95}, @typed={0x10, 0x1, @u64=0x7}, @typed={0x10, 0x46, @u64=0x4}, @typed={0x4c, 0x96, @binary="110dade06db7076b609b1cdff6c000cf2f5500e8a70e26e90344138bd279f580a901b8eceaaaa62aa6128498acfda13375a3b38803406c22e9fcb07af54bad3845"}, @generic="b261a5dd7cae2b1fb70bd187c97dc74fd09d95c7b8359cf700b7104556baca2470102b8436b7212f414cd5b9b8f56a3d5b4942da5d054401", @typed={0xc, 0x4a, @uid=r4}]}, @typed={0xac, 0x26, @binary="9c1ed45d14b245c6abf4c3b4e99361143987478d36b9685162809676b5bc298fda01f805c0d386d72e62d060102f1d6431874cddc29975c7ff8a97a5fdd0f8a6b20c86a566a43a45e548bc92083fc4904d35fc70e0bf249f6a02e3932ece2d0d24c34d0817eede78436c40fec5246cd14285d34dcd0d91380a65e5da300c88fde3a7119641ede7b3bae2e6732eaeefee23a3919b3a83372c3eae3cc0ed0efc642a67c6ca"}]}, 0x4ec}, 0x1, 0x0, 0x0, 0x24000010}, 0x80) ioctl$int_out(r2, 0x5460, &(0x7f00007a4000-0x8)) [ 79.925974] syz-executor3 (10159) used greatest stack depth: 11856 bytes left [ 79.945836] binder: 10182:10183 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) shutdown(r0, 0x0) r1 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_int(r1, 0x10d, 0xc3, &(0x7f0000039000), &(0x7f0000351000-0x4)=0x4) 2018/02/04 21:33:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:27 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009be000-0xa)='/dev/ptmx\x00', 0x183a40, 0x0) ioctl$TIOCGPTPEER(r0, 0x5441, 0x8) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) close(r1) ioctl$TIOCSBRK(r1, 0x40044591) pipe(&(0x7f00009b3000-0x8)={0x0}) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f00002bd000-0x8)) bpf$BPF_PROG_QUERY(0x10, &(0x7f00009c7000)={r0, 0x7, 0x1, 0xf0, &(0x7f00003fc000)=[0x0, 0x0], 0x2}, 0x20) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000258000-0x4), &(0x7f0000c36000-0x4)=0x4) 2018/02/04 21:33:27 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x1, 0x10) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000b07000)='/selinux/status\x00', 0x0, 0x0) write(r0, &(0x7f00005ce000-0x27)="26000000240001f8feffffff00008d4001000025010000000df7040040a68fe90c026b010035", 0x26) getsockopt$netrom_NETROM_T1(r0, 0x103, 0x1, &(0x7f0000013000-0x4), &(0x7f000097a000-0x4)) eventfd2(0x8, 0x800) [ 80.054489] binder: 10202:10205 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:27 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x90, &(0x7f0000ca0000-0x90)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, '\x00\b\x00', 0x5a, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[@dstopts={0x3f, 0x8, [], [@enc_lim={0x4, 0x1, 0x5}, @hao={0xc9, 0x10, @mcast2={0xff, 0x2, [], 0x1}}, @jumbo={0xc2, 0x4, 0x2}]}], @dccp={{0x2, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:27 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000001000-0x11)='/dev/qat_adf_ctl\x00', 0x80, 0x0) dup(r0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f00003de000)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f00001e3000)=0x3) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f00003bc000-0x28)={0x0, 0x0, &(0x7f000017c000-0x1b)=""/27, &(0x7f000074f000)=""/243, &(0x7f00008c9000-0xfe)=""/254, 0x2}) r2 = memfd_create(&(0x7f0000a7a000-0x10)="2f6c65762f7668a473742d6e6573e3ed", 0xd23093c1646257b5) ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, &(0x7f0000538000-0x4)) 2018/02/04 21:33:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000007000-0xd)='/dev/vcs\x00', 0x0) getsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00006a3000), &(0x7f00003d3000-0x4)=0x8) r1 = dup2(r0, r0) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000c01000)=""/45) r2 = syz_open_dev$sndseq(&(0x7f0000009000)='/dev/snd/seq\x00', 0x0, 0x2) r3 = dup2(r2, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f000002c000)={0x0, 0x0, 0x400000, 'queue1\x00'}) clock_gettime(0x0, &(0x7f0000285000)={0x0}) accept4$netrom(r0, &(0x7f0000878000)=@full, &(0x7f000027a000-0x4)=0x48, 0x80000) write$sndseq(r0, &(0x7f0000040000)=[{0x0, 0x0, 0x0, 0x0, @time={r4}, {}, {}, @addr}], 0x30) io_setup(0xa0f, &(0x7f0000f1a000-0x4)=0x0) syslog(0xf, &(0x7f0000abd000)=""/232, 0xe8) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000267000-0x10)='/dev/sequencer2\x00', 0x2000, 0x0) io_cancel(r5, &(0x7f0000145000-0xe)={0x0, 0x0, 0x0, 0x2, 0x9, r1, &(0x7f00002e4000-0x13)="ff12c62b62dea3f0b36b2de5aec0b26d4e5602", 0x13, 0x0, 0x0, 0x1, r6}, &(0x7f0000ccb000)) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r2, 0x4040534e, &(0x7f000003a000)={0x2e, @time}) 2018/02/04 21:33:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000005000-0x44)=[], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00002c6000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x80000) r3 = creat(&(0x7f0000d32000)='./file0\x00', 0x0) ioctl$PIO_FONTRESET(r3, 0x4b6d, 0x0) read$eventfd(r2, &(0x7f0000c62000), 0x8) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00005f7000)={r2, 0x0, 0x0, 0xffffffffffffffff}) write$eventfd(r2, &(0x7f0000762000-0x8), 0xffffffffffffff93) 2018/02/04 21:33:27 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndmidi(&(0x7f00006c5000-0x12)='/dev/snd/midiC#D#\x00', 0x4, 0x80) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x3, &(0x7f0000881000)) setitimer(0x0, &(0x7f0000524000-0x10), &(0x7f0000415000)) 2018/02/04 21:33:27 executing program 6: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f00008e6000-0xc)={0x3, r0}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$PPPOEIOCSFWD(r1, 0x4004b100, &(0x7f0000001000-0x1e)={0x18, 0x0, {0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @generic="10a9d0a0404d90e4245fdbd254b7647b"}}) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f000043c000)={0x9, 0x1, 0x3ff, 0x5, 0x4}, 0xc) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000001000-0x5c)={{0xa, 0xffffffffffffffff, 0x0, @empty}, {0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}, 0x0) 2018/02/04 21:33:27 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000f28000)={@generic="76b86ee5db95846d3704990a0156a3f0", @ifru_addrs={0x2, 0x2, @loopback=0x7f000001}}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f000039c000)=0x400000000000001, 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x14, &(0x7f00000b2000)=0x2, 0x4) sendto$inet(r1, &(0x7f0000482000), 0xfffffffffffffd1f, 0x800000120000001, &(0x7f0000172000)={0x2, 0xffffffffffffffff, @dev={0xac, 0x14, 0x0, 0xa}}, 0x10) recvfrom$inet(r1, &(0x7f0000f84000-0xc2)=""/194, 0xc2, 0x2, &(0x7f0000a3b000)={0x2, 0xffffffffffffffff, @dev={0xac, 0x14}}, 0x10) 2018/02/04 21:33:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000b66000-0x8)={0x0}) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x8) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:28 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000859000)='/dev/usbmon#\x00', 0x0, 0x0) r1 = socket$inet6_dccp(0xa, 0x6, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000a79000)={&(0x7f0000d53000-0xa)=@file={0x0, './file0\x00'}, 0xa, &(0x7f0000995000)=[]}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x4, 0x4, 0x4, 0x9}, 0x14) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000028000)={r2, &(0x7f000000b000-0xb5), &(0x7f0000571000-0x1)="16"}, 0x20) setsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f00004b6000-0x4)=0xfffffffffffff247, 0x4) r3 = dup2(r1, r2) getsockopt$inet6_dccp_int(r3, 0x21, 0x10, &(0x7f00001d2000), &(0x7f000022d000)=0x4) 2018/02/04 21:33:28 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000005000-0x44)=[], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 80.250374] dccp_invalid_packet: P.Data Offset(0) too small [ 80.268473] binder: 10218:10226 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00003dc000-0xa)='map_files\x00') getsockopt$netrom_NETROM_IDLE(r0, 0x103, 0x7, &(0x7f00004fb000-0x4)=0x8, &(0x7f0000677000-0x4)=0x4) openat(r0, &(0x7f000014c000-0x8)='./file0\x00', 0x40000, 0x40) mkdirat(r0, &(0x7f0000032000-0x8)='./file0\x00', 0x0) sendmsg$nl_crypto(r0, &(0x7f0000911000)={&(0x7f0000985000-0xc)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000824000)={&(0x7f00003a2000-0x130)=@del={0x130, 0x11, 0x0, 0x5, 0x2, {{'drbg_nopr_sha256\x00'}, [], [], 0x400, 0x400}, [{0x8, 0x1, 0x6}, {0x8, 0x1, 0x6}, {0x8, 0x1, 0x800}, {0x8, 0x1, 0x6}, {0x8, 0x1, 0x3ff}, {0x8, 0x1}, {0x8, 0x1, 0x40}, {0x8, 0x1, 0x5}, {0x8, 0x1, 0x10001}, {0x8, 0x1, 0xffffffffffffff7f}]}, 0x130}, 0x1, 0x0, 0x0, 0xc4}, 0x20000800) 2018/02/04 21:33:28 executing program 3: mq_timedsend(0xffffffffffffffff, &(0x7f0000002000-0x8a), 0x0, 0x0, &(0x7f0000014000-0x8)={0x0, 0x1c9c380}) socket$netlink(0x10, 0x3, 0x11) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x400, 0x200001) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e05411, &(0x7f0000437000-0x8f)=""/143) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) open$dir(&(0x7f0000001000)='./file0\x00', 0x101000, 0x108) 2018/02/04 21:33:28 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000440000)='./file0\x00', 0x10) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000207000), &(0x7f0000597000)=0x4) r1 = socket(0x5, 0x6, 0x20000007) fstatfs(r1, &(0x7f000054a000-0xaf)=""/175) sendmsg$nl_route(r1, &(0x7f000022b000)={&(0x7f0000f83000)={0x10}, 0x2e2, &(0x7f0000f76000-0x10)={&(0x7f0000f86000-0x58)=@newneigh={0x28, 0x1c, 0x303, 0xffffffffffffffff, 0xffffffffffffffff, {0x100000000000007, 0x0, 0x0, 0x0, 0xc0, 0x32}, [@NDA_LLADDR={0xa, 0x2, @link_local={0x1, 0x80, 0xc2}}]}, 0x392}, 0x1}, 0x0) [ 80.386375] binder: 10241:10250 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:28 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001000-0x9)='/dev/dsp\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000001000-0x58)={0x800, 0x7, 0x1a, 0x4, 0x9, 0x4}) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r0, 0x4008ae93, &(0x7f0000001000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00005f6000-0x4)=0x0) ptrace$getregs(0xc, r1, 0x0, &(0x7f0000202000-0x95)=""/149) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000cb7000-0x16)='/selinux/checkreqprot\x00', 0x420800, 0x0) ioctl$KVM_GET_XCRS(r2, 0x8188aea6, &(0x7f0000fae000-0x38)={0x3, 0x8001, [{0x2, 0x0, 0x38e0}, {0x3, 0x0, 0x3ff}, {0x101, 0x0, 0xbdd}]}) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000635000)=0x615, 0x4) write(r0, &(0x7f000032a000)="2400000052001f01000000000000000007000710080000feffffff08ffffffef000009", 0x23) 2018/02/04 21:33:28 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000ec6000)='/proc/self/net/pfkey\x00', 0x0, 0x0) readv(r0, &(0x7f0000a6f000-0x30)=[{&(0x7f00004f8000-0xda)=""/218, 0xda}, {&(0x7f0000e5c000)=""/164, 0xa4}, {&(0x7f0000cf1000)=""/76, 0x4c}, {&(0x7f000032b000-0x1000)=""/4096, 0x1000}, {&(0x7f0000644000-0xc1)=""/193, 0xc1}, {&(0x7f0000d34000)=""/167, 0xa7}], 0x6) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000359000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000a5e000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000da7000-0x15)='/proc/self/net/pfkey\x00', 0x0, 0x0) mmap$binder(&(0x7f00001e2000/0x1000)=nil, 0x1000, 0x0, 0x10, r2, 0x0) 2018/02/04 21:33:28 executing program 3: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0xfffffffffffffffe, 0x2) bind(r0, &(0x7f0000001000-0x32)=@pppol2tpin6={0xa, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}}, 0x32) 2018/02/04 21:33:28 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00002e1000)={@syzn={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000e61000-0x14)=@ethtool_modinfo={0x42, 0x0, 0x0, "872a73c216314833"}}) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000d55000-0xe8)={{{@in=@empty, @in=@loopback, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@dev}}, &(0x7f0000cd0000)=0xe8) r2 = getgid() syz_fuseblk_mount(&(0x7f00007d5000)='./file0\x00', &(0x7f0000083000-0x8)='./file0\x00', 0x4000, r1, r2, 0x1509, 0x6, 0x8009) ioctl$sock_ipx_SIOCIPXCFGDATA(r0, 0x89e2, &(0x7f0000aff000)) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00009cc000)=[@in6={0xa, 0x3, 0x8, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x0, 0x16}}, 0x94}, @in6={0xa, 0x3, 0x2, @loopback={0x0, 0x1}, 0xfffffffffffffeff}, @in={0x2, 0x1, @dev={0xac, 0x14, 0x0, 0xf}}, @in={0x2, 0x3, @multicast2=0xe0000002}, @in={0x2, 0x1, @dev={0xac, 0x14, 0x0, 0xd}}, @in6={0xa, 0x1, 0x7, @ipv4={[], [0xff, 0xff], @rand_addr=0x6}}, @in6={0xa, 0x1, 0xb2, @empty, 0x5}, @in={0x2, 0x3, @loopback=0x7f000001}], 0xb0) 2018/02/04 21:33:28 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000005000-0x44)=[], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:28 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffff9c) ioctl$KVM_ENABLE_CAP_CPU(r1, 0x4068aea3, &(0x7f0000377000-0x68)={0x7b, 0x0, [0x200, 0x8000, 0x100000000]}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000af6000-0xc)={0x1, 0x1, 0xfffffffffffffff9, 0x3, 0xffffffffffff27c1}, 0xc) clock_gettime(0x0, &(0x7f0000560000-0x8)={0x0, 0x0}) ppoll(&(0x7f0000169000-0x20)=[{r0, 0x100}, {r2, 0x2}, {r2, 0x500}, {r2, 0x8000}], 0x4, &(0x7f0000c4a000-0x8)={r3, r4+30000000}, &(0x7f0000c0c000-0x8)={0x2}, 0x8) syz_open_procfs(0x0, &(0x7f0000688000-0x8)='ns/user\x00') ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) 2018/02/04 21:33:28 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mount(&(0x7f0000a31000)='./file0\x00', &(0x7f0000351000-0x8)='./file0\x00', &(0x7f0000e6d000)='affs\x00', 0x2010000, &(0x7f00000f6000)="8289e2f19b73283dfd63de244999817203f8143ed9d54af70da48a674e86dbd1bbc283e060115bb825ee58f6") mkdir(&(0x7f000083e000)='./file0\x00', 0x10c) mount(&(0x7f0000a7b000-0x8)='./file0\x00', &(0x7f00009ba000-0x8)='./file0\x00', &(0x7f0000e53000)='mqueue\x00', 0x0, &(0x7f0000fcf000-0x1)) mknod(&(0x7f0000f6d000)='./file0/file0\x00', 0x8003, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000d76000-0x9)='/dev/vcs\x00', 0x200080, 0x0) uselib(&(0x7f0000be6000-0xe)='./file0/file0\x00') recvmmsg(0xffffffffffffff9c, &(0x7f0000ded000-0x140)=[{{&(0x7f00002f2000)=@in6={0x0, 0xffffffffffffffff, 0x0, @loopback}, 0x1c, &(0x7f0000fb4000)=[{&(0x7f0000e50000-0x70)=""/112, 0x70}, {&(0x7f0000f29000-0xc2)=""/194, 0xc2}, {&(0x7f00005d2000-0x8)=""/8, 0x8}], 0x3, &(0x7f00004c7000)=""/143, 0x8f, 0x1}, 0x74}, {{0x0, 0x0, &(0x7f0000bcc000-0x38)=[{&(0x7f00005da000-0x1000)=""/4096, 0x1000}, {&(0x7f0000e3d000)=""/2, 0x2}, {&(0x7f0000e5e000)=""/61, 0x3d}, {&(0x7f0000149000-0xf5)=""/245, 0xf5}, {&(0x7f0000b8c000)=""/101, 0x65}, {&(0x7f0000840000)=""/251, 0xfb}, {&(0x7f0000d25000-0x1000)=""/4096, 0x1000}], 0x7, &(0x7f0000b52000)=""/46, 0x2e, 0x1}, 0x8}, {{&(0x7f000058d000)=@pppol2tpin6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @mcast2}}}, 0x32, &(0x7f000079a000)=[{&(0x7f00003c1000-0x63)=""/99, 0x63}, {&(0x7f0000c2f000)=""/82, 0x52}, {&(0x7f0000512000-0x91)=""/145, 0x91}, {&(0x7f0000361000)=""/59, 0x3b}, {&(0x7f000065a000)=""/190, 0xbe}, {&(0x7f000095c000)=""/213, 0xd5}, {&(0x7f0000f54000-0xd3)=""/211, 0xd3}, {&(0x7f0000e53000-0x18)=""/24, 0x18}], 0x8, 0x0, 0x0, 0x81}, 0xaaa8ad8}, {{&(0x7f0000c94000-0x6)=@hci, 0x6, &(0x7f0000845000-0x8)=[{&(0x7f0000e14000)=""/207, 0xcf}], 0x1, &(0x7f0000ee7000-0x15)=""/21, 0x15, 0x7}}, {{&(0x7f000010c000)=@ipx, 0x10, &(0x7f00001c6000)=[{&(0x7f000004f000-0xa)=""/10, 0xa}, {&(0x7f00003e6000-0x2f)=""/47, 0x2f}, {&(0x7f0000abb000-0xd3)=""/211, 0xd3}], 0x3, &(0x7f00003d2000)=""/204, 0xcc, 0x2}, 0x2}, {{&(0x7f0000a11000-0x10)=@ax25, 0x10, &(0x7f000083a000)=[{&(0x7f0000a44000)=""/130, 0x82}, {&(0x7f0000398000-0xd8)=""/216, 0xd8}, {&(0x7f00004a6000)=""/39, 0x27}], 0x3, 0x0, 0x0, 0x80000000}, 0x800000}, {{&(0x7f00007c6000-0x10)=@can, 0x10, &(0x7f00005f5000)=[{&(0x7f000012d000)}, {&(0x7f0000c04000)=""/29, 0x1d}, {&(0x7f00002de000)=""/219, 0xdb}, {&(0x7f000093c000-0x18)=""/24, 0x18}, {&(0x7f000004f000-0x31)=""/49, 0x31}], 0x5, &(0x7f0000ec2000)=""/247, 0xf7, 0x8}, 0x10001}, {{&(0x7f0000d7b000)=@in6={0x0, 0xffffffffffffffff, 0x0, @dev}, 0x1c, &(0x7f0000905000-0x8)=[{&(0x7f000052f000-0x49)=""/73, 0x49}], 0x1, &(0x7f0000c2f000-0xd0)=""/208, 0xd0, 0x5}, 0xfff}, {{&(0x7f0000996000)=@pppol2tp={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @dev}}}, 0x26, &(0x7f000096f000-0x8)=[{&(0x7f00006c0000-0x72)=""/117, 0x75}], 0x1, &(0x7f0000571000-0x39)=""/57, 0x39, 0x1}, 0xffff}, {{&(0x7f0000edd000)=@nfc_llcp, 0x58, &(0x7f0000d52000)=[{&(0x7f0000db6000-0x7c)=""/124, 0x7c}, {&(0x7f000062c000)=""/111, 0x6f}, {&(0x7f000028e000-0x94)=""/148, 0x94}, {&(0x7f0000dd3000)=""/18, 0x12}], 0x4, 0x0, 0x0, 0x101}, 0x5}], 0xa, 0x0, &(0x7f0000f08000)) recvfrom$unix(r0, &(0x7f000050b000-0x16)=""/22, 0x16, 0x10000, &(0x7f00008ca000-0x8)=@abs={0x1, 0x0, 0x3}, 0x8) 2018/02/04 21:33:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000e54000)) connect$pptp(r0, &(0x7f00005e4000-0x20)={0x18, 0x2, {0x0, @multicast2=0xe0000002}}, 0x20) 2018/02/04 21:33:28 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000be1000-0x10)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000e88000)=0x10, 0x800) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000d12000-0x10)=@generic, 0x10) openat$rtc(0xffffffffffffff9c, &(0x7f0000596000-0x2)='/dev/rtc\x00', 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000d17000)='/dev/sequencer2\x00', 0x101000, 0x0) ioctl$sock_SIOCGPGRP(r1, 0xc004510e, &(0x7f00005ce000)) 2018/02/04 21:33:28 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = syz_open_dev$tun(&(0x7f0000a9e000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000f32000)={@common='eql\x00', @ifru_names=@generic="c15c9a8b74308b1b2c5d0ce63d9d8226"}) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000484000-0x44)={{0x2, 0xffffffffffffffff, @multicast2=0xe0000002}, {0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}, 0x0, {0x2, 0xffffffffffffffff, @multicast2=0xe0000002}, @common='eql\x00'}) mmap(&(0x7f0000000000/0xff0000)=nil, 0xff0000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x1, 0x5, 0x9}, 0xffffffffffffffc0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00004fa000-0x1c)={0xc, 0x4, 0x4, 0x100000001, 0x0, r2}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f0000048000)={0xd, 0x3, 0x4, 0x9, 0x0, r3}, 0x2c) 2018/02/04 21:33:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setrlimit(0x7, &(0x7f0000a9d000-0x8)) r0 = eventfd(0x0) ioctl$void(r0, 0x5451) [ 80.504362] audit: type=1400 audit(1517780008.226:67): avc: denied { map } for pid=10265 comm="syz-executor4" path="/proc/706/net/pfkey" dev="proc" ino=4026532929 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_net_t:s0 tclass=file permissive=1 2018/02/04 21:33:28 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000)=[], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:28 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000c0a000-0x20)={@ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}, &(0x7f0000001000-0x4)=0x20) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x10) ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000001000)={0x0, 0xa9f4}) 2018/02/04 21:33:28 executing program 3: mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000005000)={0x4, {0x2, 0x2, @empty}, {0x2, 0x2, @loopback=0x7f000001}, {0x2, 0x3, @multicast1=0xe0000001}, 0x8, 0x87f, 0x9, 0x2, 0x4, 0x0, 0x101, 0x8e, 0x3}) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockname$packet(r0, &(0x7f0000007000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000007000)=0x14) sendto(r0, &(0x7f0000007000)="c6816c3e9031bf6fbac72db024aaed9a5634e91afbce591512c4bdec9abea9c9ae7d1ba35091d5f3b57b6e1ef0de7b25429cb2f60e130c5cbfc16c4a1478b60b1b17b87bc9d42f984c40273d0e897a5cacc14d005bea8afbf333f7954ff88d94734dd0510aa84d6e3ad115eecc2e8d114a0075e2c974a5ed14bacc3aa455412068eeab9eaac3dc16fba71160891cf487ac72f73925cdae2ec6c01504781cef05fd022c8a5c24eda9fbfc93b82fc49780c2e5d0d256b06fb53d122c1a683e868d5e1ea4bc6b14", 0xc6, 0x4000080, &(0x7f0000007000-0x14)=@ll={0x11, 0x1c, r1, 0x1, 0x6, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}}, 0x14) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) write(r0, &(0x7f0000cc4000)='\x00', 0x1) 2018/02/04 21:33:28 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00007d8000)={@dev={0xfe, 0x80, [], 0x0, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x316) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000de8000-0x14)={@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x14) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f000013f000-0x14)={@local={0xfe, 0x80, [], 0x0, 0xaa}}, 0x14) r1 = syz_open_dev$mice(&(0x7f0000b20000-0x10)='/dev/input/mice\x00', 0x0, 0x80000) bind$ipx(r1, &(0x7f0000596000)={0x4, 0x971, 0x524, "da62fd43da85", 0x7}, 0x10) 2018/02/04 21:33:28 executing program 7: mmap(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x7fffffff, 0x2000000008972, 0xffffffffffffffff, 0x0) madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) clone(0x0, &(0x7f0000000000), &(0x7f0000001000-0x4), &(0x7f0000001000-0x4), &(0x7f0000000000)) mlock(&(0x7f0000a67000/0x2000)=nil, 0x2000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001000-0x9)='/dev/dsp\x00', 0x10b040, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000ccd000)=""/146) 2018/02/04 21:33:28 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) prctl$setmm(0x23, 0x7, &(0x7f00003b2000/0x2000)=nil) bind$alg(r0, &(0x7f0000ab9000)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc-aes-aesni\x00'}, 0x58) [ 80.656555] binder: 10279:10286 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f00008f1000-0x8)={0x0, 0x0}) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000f91000-0x9)='/dev/dsp\x00', 0x80, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00003a5000-0xe8)={{{@in=@empty, @in=@loopback, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@local}}, &(0x7f0000d17000-0x4)=0xe8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000c63000-0x8)={0x0, 0x200, 0x2}, &(0x7f0000ab1000)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f00008a9000)={r4}, 0x8) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f000088c000)={@local={0xfe, 0x80, [], 0x0, 0xaa}, 0x9, r2}) accept4(r0, &(0x7f000049b000)=@pppol2tp={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @empty}}}, &(0x7f0000748000-0x4)=0x26, 0x80000) setfsuid(r3) 2018/02/04 21:33:28 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f0000e5e000)='1yzkler\x00', &(0x7f0000073000-0x5)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0x0) keyctl$link(0x8, 0xfffffffffffffffb, r0) r1 = request_key(&(0x7f0000061000)="656e63007074003fb8eb4260dc33714a70fc8253cabac29b40b736c3d74883dbbb1e2d4e99315e8319a1b63334205b9e39fdaf505fc7a903e174996496a9de8b78fde8d8150c47cedbdfa963d50cb409161521d0bb52fd1999f9f609afa0117832c4a0cd9e7f5c14e6e4a1dd92d4aa6b1a07eeb8a5077b2b603b1dcb99eb48c8d4e1b38d2e02c5dc9e287405d9", &(0x7f0000110000)={0x73, 0x79, 0x7a}, &(0x7f0000a88000)="02", 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f00006d7000-0xa)='/dev/cuse\x00', 0x4002, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000920000-0x160)={{{{0x2, 0x1, @remote={0xac, 0x14, 0x0, 0xbb}}}, {{0xa, 0x1, 0x7fffffff, @mcast1={0xff, 0x1, [], 0x1}, 0x1}}}, 0x2, 0x39, 0xffffffff, "9ce70676f8b6fc458c160ff40f9e4e6172cc0c09312104a8a51c4b0dba76a80a193d4970765b4c13d24d3c166ecd1595b531e1008ae3cb05e0a9c4d6df2c2d2df5e8476114d070de51363e70bcf5750c"}, 0x160) pipe2(&(0x7f000040e000-0x8)={0x0, 0x0}, 0x800) ioctl$KVM_SET_SIGNAL_MASK(r4, 0x4004ae8b, &(0x7f0000016000)={0x80, "9abecc04cb025b8dcc70eec2c16550c5ad1a4f9e876ac9ee2d9ab67e0420228cb23ed24fd937f5ffeeef3d3d19b4be3f55f50f6cbe235b2e2ff8a8a29d9f9a861704d1041d85706740ca618ce547e4b852d140be32e56b3cecdfd7a631b8dc8c2f7332f4040d336c0dec03e8e91806ec3370e1c854bee3ccf5e23c632d802390"}) keyctl$search(0xa, r1, &(0x7f0000f83000-0xd)='dns_resolver\x00', &(0x7f0000943000)={0x73, 0x79, 0x7a}, 0x0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f000036e000), &(0x7f0000b61000-0x4)=0x4) setsockopt$inet_sctp_SCTP_NODELAY(r3, 0x84, 0x3, &(0x7f0000389000)=0x8, 0x4) 2018/02/04 21:33:28 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$audion(&(0x7f00002fa000-0xc)='/dev/audio#\x00', 0x7fff, 0x92140) bind$alg(r0, &(0x7f00002a6000-0x58)={0x26, 'rng\x00', 0x2005, 0x1012, 'drbg_nopr_sha1\x00'}, 0xfffffffffffffe03) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000eb3000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000fd4000), 0x0) 2018/02/04 21:33:28 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x1, 0x0) r1 = memfd_create(&(0x7f00005e9000-0x2)='\'-', 0x3) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000ac2000-0xb)='/dev/hwrng\x00', 0x40600, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f00003ba000-0x8)={0x0, r2}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000024e000)}, 0x0, 0x0, 0x2000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f000058b000)={0x0, @in={{0x2, 0x1, @empty}}, [0x3ff, 0x7, 0x0, 0x3, 0x0, 0x100, 0x0, 0x101, 0xd4e, 0x6, 0x4, 0x80, 0x9, 0xb1, 0x1]}, &(0x7f00009ae000-0x4)=0x108) setsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f00008af000-0x4)=@assoc_id=r4, 0x4) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f00008a7000)=@req3={0x10001, 0x0, 0x1, 0xffffffffffffffff}, 0x1c) ioctl$PERF_EVENT_IOC_REFRESH(r3, 0x2402, 0x4) sendmsg(r0, &(0x7f0000030000)={&(0x7f00004f5000)=@generic={0x10000000001e, "0100000900000000000000000226cc573c080000003724c71e14dd6a739effea1b48006be61ffe0000e103000000f8000004003f010039d8f986ff01000300000004af50d50700000000000000e3ad316a1983000000001d00e0dfcb24281e27800000100076c3979ac40000bd15020078a1dfd300881a8365b1b16d7436"}, 0x80, &(0x7f0000448000-0x10)=[], 0x27f, &(0x7f00006eb000-0x1398)=[]}, 0x0) 2018/02/04 21:33:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00001d7000)='/dev/sequencer\x00', 0x2, 0x0) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f00001ee000)=[0x371, 0xfffffffffffffffd]) 2018/02/04 21:33:28 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000)=[], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:28 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000-0x18)={0xaa}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000470000)={&(0x7f0000176000/0x4000)=nil, 0x4000}) 2018/02/04 21:33:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00006bb000-0xf)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000e4e000)=0x200000000) write$vnet(r0, &(0x7f0000a8d000)={0x1, {&(0x7f0000c91000)=""/24, 0x1e9, &(0x7f0000b4d000-0x65)=""/101, 0x0, 0x2}}, 0x2a) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000fd4000-0x10)='/selinux/status\x00', 0x0, 0x0) bind$netrom(r1, &(0x7f0000e7f000-0x10)=@ax25={0x3, {"2d325d58e46639"}, 0x100000001}, 0x10) r2 = add_key(&(0x7f000006e000)='id_resolver\x00', &(0x7f0000508000-0x5)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000f53000-0x73)="d2b40d2b76c35e52467664a67c0e8090ba8a2be78eca502e72305b0e6bc0c591a8148eeedc17cfd9250e31f53d9b484d3ec51468d943e05d0f06e4aa568ad5651d8916fab1ec1a260f610926f042a06c0efd6d4dda36077fb91ef9b0dc764f52ce92a77391dee32db83cfb10b667a6f0896aaf", 0x73, 0xfffffffffffffffe) r3 = add_key$keyring(&(0x7f0000aa5000-0x8)='keyring\x00', &(0x7f00003af000-0x5)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, r2) setsockopt$netrom_NETROM_IDLE(r1, 0x103, 0x7, &(0x7f0000a5f000), 0x4) keyctl$search(0xa, r3, &(0x7f0000c09000+0x518)='big_key\x00', &(0x7f000041a000-0x5)={0x73, 0x79, 0x7a, 0x0}, r2) write$vnet(r0, &(0x7f000046e000-0x68)={0x1, {&(0x7f0000c7f000)=""/28, 0x1, &(0x7f0000e9b000-0x49)=""/73, 0x0, 0x3}}, 0x68) preadv(r1, &(0x7f0000124000)=[{&(0x7f00004ab000)=""/144, 0x90}], 0x1, 0x0) 2018/02/04 21:33:28 executing program 6: mmap(&(0x7f0000000000/0x102000)=nil, 0x102000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f000001f000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [], {@ipv6={0x86dd, {0x0, 0x6, "a2fbc8", 0x0, 0x3a, 0x0, @dev={0xfe, 0x80}, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, {[], @icmpv6=@echo_request={0x80}}}}}}, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f000001f000)='/selinux/policy\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0106434, &(0x7f00000d2000-0x10)={0x7, 0x0, 0xb4754cdc7fe327e3, 0x8}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0106434, &(0x7f0000045000)={0x2, r1, 0x0, 0x80000000}) [ 80.758232] binder: 10299:10313 got transaction with invalid offset (0, min 0 max 0) or object. [ 80.767954] binder: 10299:10313 transaction failed 29201/-22, size 0-8 line 3020 [ 80.785215] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/04 21:33:28 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x81) syz_open_dev$sg(&(0x7f0000572000-0x9)='/dev/sg#\x00', 0x0, 0x0) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000c60000-0xa)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) r6 = getpgrp(0x0) fcntl$setown(r2, 0x8, r6) ioctl$ASHMEM_PURGE_ALL_CACHES(r3, 0x770a, 0x0) fcntl$setsig(r5, 0xa, 0x12) r7 = gettid() tkill(r7, 0x100000000000016) close(r0) 2018/02/04 21:33:28 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000066d000)='\x00', 0x1) connect$nfc_raw(r0, &(0x7f0000265000-0x10)={0x27, 0x2, 0x3, 0x7}, 0x10) clock_gettime(0x2000000, &(0x7f0000396000)={0x0}) futimesat(0xffffffffffffffff, &(0x7f00005a4000)='./file0\x00', &(0x7f0000985000)={{r1}, {r1}}) sigaltstack(&(0x7f0000985000/0x1000)=nil, &(0x7f0000001000-0x8)) sigaltstack(&(0x7f00005c2000/0xd000)=nil, 0x0) 2018/02/04 21:33:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) syz_open_dev$sndtimer(&(0x7f00000bb000-0xf)='/dev/snd/timer\x00', 0x0, 0x6001) 2018/02/04 21:33:28 executing program 3: r0 = socket$can_raw(0x1d, 0x3, 0x1) write(r0, &(0x7f0000002000), 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001000)='/dev/hwrng\x00', 0x4000, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_mreq(r1, 0x0, 0x0, &(0x7f0000002000-0x8)={@local, @local}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000001000)=@assoc_id=0x0, &(0x7f0000001000)=0x4) setsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000001000-0x14)={r2, 0x0, 0x9, 0x4, 0x6, 0xd216}, 0x14) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000275000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvfrom$inet6(r1, &(0x7f0000003000)=""/33, 0x21, 0x100, &(0x7f0000001000)={0xa, 0x3, 0x9, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x5}, 0x1c) uselib(&(0x7f0000002000)='./file0\x00') getgroups(0x4, &(0x7f0000000000)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff]) syz_fuseblk_mount(&(0x7f0000001000-0x8)='./file0\x00', &(0x7f00009bc000-0x8)='./file0\x00', 0x4000, r3, r4, 0xdda, 0x1, 0x400) [ 80.854784] binder: 10330:10339 got transaction with invalid offset (0, min 0 max 0) or object. [ 80.883983] binder: 10330:10349 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 80.889862] binder: 10330:10339 transaction failed 29201/-22, size 0-8 line 3020 [ 80.943570] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/04 21:33:28 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000bba000)={0x2, 0x78, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f00004fe000-0x8)='keyring\x00', &(0x7f0000f03000-0x5)={0x73, 0x79, 0x7a}, &(0x7f0000783000)="81e9", 0x2, 0xffffffffffffffff) keyctl$revoke(0x3, r0) request_key(&(0x7f0000118000-0xb)='asymmetric\x00', &(0x7f0000efa000+0x89a)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00003db000)='keyring\x00', r0) r1 = request_key(&(0x7f00001d0000-0x5)='user\x00', &(0x7f00002e2000)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000a96000)='\\.wlan0)posix_acl_access\x00', 0x0) socketpair(0x9, 0x1, 0x1, &(0x7f0000726000-0x8)={0x0}) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r2, 0x4008af23, &(0x7f0000bf8000)={0x0, 0x1}) keyctl$unlink(0x9, r1, r0) 2018/02/04 21:33:28 executing program 0: mmap(&(0x7f0000000000/0xfab000)=nil, 0xfab000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000755000-0x9)='/dev/dsp#\x00', 0x7, 0x4000) close(r0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000f8b000)={{{@in6=@dev={0xfe, 0x80}, @in=@multicast1=0xe0000001, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa}, {}, {}, 0x0, 0xffffffffffffffff, 0x1}, {{@in6=@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0xffffffffffffffff, 0x6c}, 0x0, @in=@loopback=0x7f000001, 0xffffffffffffffff, 0x0, 0x0, 0x9}}, 0xe8) sendto$inet6(r1, &(0x7f0000fa1000-0x2a), 0x0, 0x0, &(0x7f0000f9f000-0x1c)={0xa, 0x1, 0x0, @dev={0xfe, 0x80}, 0x200000007}, 0x1c) flock(r1, 0x1) 2018/02/04 21:33:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000d9a000-0x9)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000094000-0x18)={0x6f99319557475dd, 0x0, []}) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000d8e000-0x16)='/selinux/checkreqprot\x00', 0xa02, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f00001b3000-0x50)={@common='syzkaller1\x00', @ifru_ivalue=0x99d}) 2018/02/04 21:33:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = signalfd(0xffffffffffffffff, &(0x7f0000f95000-0x8)={0x3}, 0x8) ioctl$int_in(r0, 0x5452, &(0x7f0000337000-0x8)=0xfffffffffffff4ee) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000f16000)='/selinux/policy\x00', 0x0, 0x0) ioctl$sock_proto_private(r1, 0x89e4, &(0x7f000060e000)="d32f4bfe5e11665dad836a2ac53c05bcc43c04000bd490bd7737eaf74db2a30ef9a5f9f3b6629db9e7ab788898deff4007aced87aa51e941b48977abf5dfc265448d70fd2d59cb94e8ce14a7c8183c1664eb7d44dd03083acf2e34e6273ac71fa8984166d3207000b38b2403c6a35987f95ce680416dac43c7778c3f49392b0d484479022c274b3ebc27b728f074a40838762afa1b8a777f243d18d44bcc86812959ce5ff58f5c5f15953e48ac8dd532ee60fe5bada80bc2fee433dbf9a2b587efe62ad24b130ebd6fa3bf6e8e00d9bf9c825a24782fd70e1267b920ff921ca198d851a7d92b74cf88bbf4cffeb73a") getrlimit(0x2, &(0x7f0000fe9000)) 2018/02/04 21:33:28 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000)=[], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:28 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) tee(r0, r0, 0x4, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000f02000-0x28)={@common='ip6gre0\x00', 0x0}) socketpair$inet_icmp(0x2, 0x2, 0x1, &(0x7f0000b31000-0x8)={0x0, 0x0}) r4 = syz_open_dev$sg(&(0x7f0000a26000-0x9)='/dev/sg#\x00', 0x7, 0x2) ioctl$KVM_GET_DEVICE_ATTR(r4, 0x4018aee2, &(0x7f0000f69000-0x18)={0x0, 0x8, 0x200, &(0x7f0000c3b000-0x8)}) ioctl(r1, 0x9, &(0x7f0000809000)="aa0d792f89df8c7899220ad6e23070354e80e09046a8403305813ac0c35688bf4343665bd4670d791aab16444ddfc397a6b36f47f65c7cbfea4a88f06e0b14227eddc6981f79153356127d3312df980b44e98149ccff7d2bb6b4bdff16a4ca") ioctl$sock_inet_SIOCDARP(r3, 0x8953, &(0x7f0000105000-0x44)={{0x2, 0x2, @local={0xac, 0x14, 0x0, 0xaa}}, {0x1, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xbb}}, 0x40, {0x2, 0x3, @rand_addr=0x80000000}, @generic="00bc28674b79a03f4a0fcd7f616261a7"}) sendmsg$nl_route(r1, &(0x7f0000fde000)={&(0x7f0000497000-0xc)={0x10}, 0xc, &(0x7f0000088000-0x10)={&(0x7f0000208000)=@dellink={0x20, 0x11, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r2}, []}, 0x20}, 0x1}, 0x0) 2018/02/04 21:33:28 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = request_key(&(0x7f0000ca1000-0xa)="81001f000016005e", &(0x7f0000796000-0x5)={0x73, 0x79, 0x7a}, &(0x7f0000cc6000-0x7)='loeth1\x00', 0xfffffffffffffffd) r1 = add_key$keyring(&(0x7f00002af000)='keyring\x00', &(0x7f000094a000)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000b1f000+0xd5e)='keyring\x00', &(0x7f00006af000-0x5)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, r1) r2 = add_key$user(&(0x7f00003bc000)='user\x00', &(0x7f00009d6000-0x5)={0x73, 0x79, 0x7a}, &(0x7f000020f000-0x1)="fa", 0x1, r1) r3 = add_key$user(&(0x7f0000893000)='user\x00', &(0x7f000017f000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f000094e000-0xdb)="b33ab76079ebe0d94f729cd653e520a59ad7d97fe21769e7c4db44c249b544230ba287fb8bd6ed266ccf59ef70995bf2e8e0ecd3fff32853747eda22d2818d08ca27e0ec821620e365a0e6b9485f2d925493f62113e33e5f8c7eba67fc19a9497f0000000000000001066cd640b336616fe0f3c3002801b4627ee7597689525e8e81f750a86eb580fb4690ea52246bd3d32b1a91f944edb74b1f50ae08c5387ed8fd0598b600579f3af40b64e1c324f6928f6672f98f7e149be31bd78b506e8b", 0xc0, r0) keyctl$dh_compute(0x17, &(0x7f0000f50000)={r2, r3, r3}, &(0x7f0000cca000)=""/1, 0x1, &(0x7f00006ec000)={&(0x7f0000e18000-0xe)={'crct10dif-pclmul\x00'}, &(0x7f000078f000-0x3a)}) 2018/02/04 21:33:28 executing program 3: mmap(&(0x7f0000000000/0xd28000)=nil, 0xd28000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xd2, &(0x7f000003b000-0x4), 0x3c) r0 = getpid() mmap(&(0x7f0000d28000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) migrate_pages(r0, 0x1ff, &(0x7f0000d28000)=0x1, &(0x7f00000d5000)=0xfffffffffffff000) [ 81.021325] binder: 10368:10374 got transaction with invalid offset (0, min 0 max 0) or object. [ 81.058552] binder: 10368:10374 transaction failed 29201/-22, size 0-8 line 3020 2018/02/04 21:33:28 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000f1c000-0x12)={@common='yam0\x00', 0x1}) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x2000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$audion(&(0x7f0000eb9000)='/dev/audio#\x00', 0x40, 0x200000) ioctl$DRM_IOCTL_SET_VERSION(0xffffffffffffffff, 0xc0106407, &(0x7f0000160000-0x10)={0x8, 0x7fffffff, 0x0, 0x5}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt(r1, 0x0, 0x81, &(0x7f0000703000)=""/193, &(0x7f0000e54000-0x4)=0xc1) 2018/02/04 21:33:28 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f000066c000-0x58)={0x26, 'aead\x00', 0x0, 0xfffffffffffffffd, 'echainiv(ccm_base(ecb(cipher_null),md5-generic))\x00'}, 0x58) openat$mixer(0xffffffffffffff9c, &(0x7f0000cc8000)='/dev/mixer\x00', 0x0, 0x0) dup2(r0, r0) [ 81.061723] binder: 10368:10384 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:28 executing program 4: mq_open(&(0x7f0000192000-0x1)='\x00', 0x0, 0x0, &(0x7f0000d8a000)) r0 = getpgrp(0xffffffffffffffff) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setparam(r0, &(0x7f0000001000-0x4)=0x2) 2018/02/04 21:33:28 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x0, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00002ad000-0x8)='./file0\x00', 0x800, 0x1) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000776000-0x14), &(0x7f0000285000)=0x14) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:28 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000143000)={@generic="18629e0ad7cbbbb5d5524fed5157c4e6", 0x6}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendto(r0, &(0x7f0000000000)="df3b2fa81209815b930256a39abb1165c0637c4609675da138842dbe8d6868bea9a22359b399ac6526af3425872d72a2db689df039d82a70aabc042af7f89515e952d249557f0a8356af05a092ed499c9a4e9e3758bc552b390996f244c373778559386ef932", 0x66, 0x20008080, 0x0, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f00001f0000)={0x6}, 0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f000051f000-0x11)='net/ip6_mr_cache\x00') read(r1, &(0x7f0000425000-0x8c)=""/140, 0x35b) 2018/02/04 21:33:28 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$midi(&(0x7f00004c9000-0xb)='/dev/midi#\x00', 0x8, 0x48080) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xee) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00008a0000-0x9)='/dev/kvm\x00', 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = dup3(r1, r2, 0x80000) ioctl$sock_inet_SIOCGIFNETMASK(r4, 0x891b, &(0x7f000075d000+0x915)={@generic="12423eab9d9f3fb4e6d781ca455d6dd4", @ifru_flags=0x4000}) ioctl$KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000014000)={0x0, 0x0, []}) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000cb1000)=0x66d) 2018/02/04 21:33:28 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f000033c000)='/dev/ppp\x00', 0xb0000, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000d9f000)={r0, r0, 0x5, 0x8, &(0x7f0000bd2000-0xe1)="9b60d3e09359f8acad0464a87bf36e2252ed86dc26117e0646d3516701ec2e460aa9eeac15ef9870f92ad609f39f9edc46a503fc32cae63de49c171d451182706bfa6422ff102f2935b987d5163ef3a7ac29064d95c0e61741ce71067c4b6e1385d55095bdf74e3293a8f3dd74e28cc8df2d6e409cd8242922f04b46f47944fa98b8c9c979badcca411544994d0882cd8f3949467fc2cf6b6d706c689ac2f5f91e8a6979d66dc22f716a5b8d6e0e64566114c32df2ec5665d877af3bdcd8dfeeeb69a036e8a89c30c3a6036fc39fc681ed0ad70d73124e2793150df57180673d3f", 0x9, 0xfffffffffffffff8, 0xf9c, 0x7, 0x2, 0x7, 0x1, "ca9a6998ca71347e4eaafa5aeeb215a8a57d188f767945645be8b7f28bda3d389ce5"}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000f02000-0x28)={@common='ip6gre0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000fde000)={&(0x7f0000497000-0xc)={0x10}, 0xc, &(0x7f0000088000-0x10)={&(0x7f0000208000)=@dellink={0x20, 0x11, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r2}, []}, 0x20}, 0x1}, 0x0) 2018/02/04 21:33:28 executing program 4: socket$nfc_raw(0x27, 0x3, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f000024f000)) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000001000-0x16)='/selinux/checkreqprot\x00', 0xa000, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000dd1000-0x4)={0x7}, 0x4) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000001000-0xcd)=""/205) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x403c5404, &(0x7f00003ef000)={{0x1, 0x2, 0x1, 0x3, 0x5}, 0x4}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) pipe(&(0x7f0000419000)={0x0, 0x0}) getsockopt$inet_buf(r2, 0x0, 0x3b, &(0x7f00006d6000)=""/187, &(0x7f0000e8a000-0x4)=0xbb) ioctl$KDADDIO(r1, 0x4b34, 0x4) bind$inet(r2, &(0x7f00006a9000-0x10)={0x2, 0x3, @empty}, 0x30) [ 81.128305] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/04 21:33:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000e02000)={@common='lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00009e7000)={&(0x7f000077a000)={0x10}, 0xc, &(0x7f0000ad1000-0x10)={&(0x7f000036a000-0x58)=@newneigh={0x24, 0x1c, 0x509, 0xffffffffffffffff, 0xffffffffffffffff, {0x2, 0x0, 0x0, r1, 0xfffffffffffffffd}, [@NDA_DST_IPV4={0x8, 0x1, @loopback=0x7f000001}]}, 0xfea4}, 0x1}, 0x0) getgroups(0x8, &(0x7f0000383000-0x20)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0]) r3 = getegid() setgroups(0x2, &(0x7f0000bc9000)=[r2, r3]) 2018/02/04 21:33:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000536000-0x10)='/selinux/status\x00', 0x0, 0x0) ioctl$KVM_PPC_ALLOCATE_HTAB(r0, 0xc004aea7, &(0x7f00002a5000-0x4)=0x2) pipe2(&(0x7f000041e000-0x8)={0x0}, 0x84800) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000653000-0x40)={0x7, 0x2, 0x3, 0x7ff, "a4e0378b5dd075ac088a6bb9650530be826c30d51c89eb7dcb38a97821e5f02fa102bef8ab70fa5cc6e03033", 0x7}) 2018/02/04 21:33:28 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000584000-0x4)) timer_settime(0x0, 0x0, &(0x7f0000d20000-0x10)={{0x0, 0x1c9c380}, {0x0, 0x989680}}, &(0x7f0000ce4000)) r1 = pkey_alloc(0x0, 0x5da5e4e7f16b2a84) pkey_mprotect(&(0x7f000079a000/0x2000)=nil, 0x2000, 0x2000000, r1) clock_nanosleep(0x0, 0x1, &(0x7f0000c22000)={0x77359400}, &(0x7f0000a2b000-0x8)) ptrace$poke(0x4, r0, &(0x7f0000441000-0x4), 0x800) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) tkill(r0, 0x15) 2018/02/04 21:33:28 executing program 2: mmap(&(0x7f0000000000/0xd000)=nil, 0xd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000005000-0xd)='/selinux/mls\x00', 0x0, 0x0) mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffff9c, &(0x7f000000e000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000003000-0x4)=0x14) sendto$packet(r0, &(0x7f0000005000-0xf2)="74c930da13d3e9651dd7678111bf6ec6d59bc72e313577ce45c24af4fa5ea316136abff2272148a394360b0739cfe1c6921f81db90bad8cc20af89faa468a10f28e0c02b11f30cf668094a0838bfe7a3df811be5260565fa43f2078fd4048367cfd1cda9a81293165b8d43ef1b5a879dd011c4962bd5fde27b0d663ec4398079c4d8b23971709afde7469011741a86a9a11486a9d39938f63ef6de8e87cfc47d459b45c9e491ff3ce6959122d9e2c566e8257ad365cf8f45b66b2228db3ce96be4fb016037a8f1af8f64ba453ec0a4a7d894ce83501422304a673d211fd773e882bc2adcf1d75467164991b3bc424257669e", 0xf2, 0x80, &(0x7f000000d000-0x14)={0x11, 0xd, r1, 0x1, 0x20, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}}, 0x14) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f000000d000)='/dev/autofs\x00', 0x80000, 0x0) mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffff9c, &(0x7f000000d000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000000)=0x14) recvfrom$packet(r2, &(0x7f0000005000-0xab)=""/171, 0xab, 0x2, &(0x7f000000b000)={0x11, 0xf8, r3, 0x1, 0x20, 0x6, @empty}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f000000d000-0x48)={0x0, 0x0, &(0x7f0000001000)=@raw=[], &(0x7f000000d000-0xa)='syzkaller\x00', 0x0, 0x15, &(0x7f000000c000)=""/21}, 0x48) 2018/02/04 21:33:29 executing program 6: keyctl$set_reqkey_keyring(0xe, 0x5) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dspn(&(0x7f0000900000-0xa)='/dev/dsp#\x00', 0x51c4, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00005f6000-0x3)='io\x00') bind$alg(r1, &(0x7f0000466000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(authenc(rmd320,cbc-camellia-aesni-avx2))\x00'}, 0xfffffffffffffe72) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmsg$alg(r2, &(0x7f000009e000)={0x0, 0x0, &(0x7f000038f000)=[{&(0x7f0000c91000-0x66)="94", 0x1}], 0x1, &(0x7f00003bb000+0x296)=[]}, 0x8081) socket$inet_dccp(0x2, 0x6, 0x0) sendfile(r2, r1, &(0x7f0000807000), 0x3f) r3 = add_key$user(&(0x7f000087d000)='user\x00', &(0x7f00000aa000)={0x73, 0x79, 0x7a, 0x2}, &(0x7f000005c000-0xd2)="a9a499c1aaaba6bfe0de56ce3b06db45ce192b011e33016844d9d4c610eb876b75532d34520f126d8fa9ad4b2fe3bea3b3fd8fda70c420c8c02bba961a650ece8c5a799e29decca97be28b3777d4249c43c1be11408c35820140ab2067fbd155f902c4dc9546668273f1a3c00193e51f0d2b5317bb82ffbbd3df1affc6afc92199cb71d67f930058d5f0fb456d9f01ca7085fcc669436d735d7d67063e85f09231ee4eba5890fa7673a540400a6cdd8aa8ab994097bd03b50f5a21dd66ca7fb6ae4acf95d63a0fa6fbb5be686b39a5e2d91b", 0x26, 0xfffffffffffffffb) r4 = request_key(&(0x7f0000c6d000)='trusted\x00', &(0x7f000020d000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000f93000-0x1)='\x00', 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00009bf000)={0x0, 0x0, 0x0, 0x101, 0x6, 0x0, 0x9, 0x13, 0x9, "f456d8d16bb8a396ffd39b9a2abc5fc996ddc0690b015741b683c6f5e9ee8d64fca37139469b54f0e746f9140a993f3452cd90021febb9e8dc1d64b76dffbe60", "e37add057986aa6375dd2fb66ce3dff41e09be71f09bf870df474c4e34f5de2669cb442b62c7087f8806c06600349677cf3612f3bdba27c8fc6211369b395e94", "166ec9b1021891231ebf783e7b8daca99ba0356e4de94a83d495ac53d5dadbca", [0xff, 0x6]}) keyctl$instantiate(0xc, r3, &(0x7f000095d000-0x12)="1cbe9b6a380a3a0851a00393386ebc14650f", 0xffffffffffffff0a, r4) [ 81.205319] binder: 10406:10420 got transaction with invalid offset (0, min 0 max 24) or object. [ 81.235451] binder: 10406:10430 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 81.239687] binder: 10406:10420 transaction failed 29201/-22, size 24-8 line 3020 2018/02/04 21:33:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = epoll_create1(0x0) clock_gettime(0x0, &(0x7f0000d1f000)={0x0, 0x0}) select(0x40, &(0x7f0000a77000)={0x100, 0x3800, 0x9, 0xfff, 0x8, 0x3f, 0x65, 0x2}, &(0x7f000011c000-0x40)={0x7fffffff, 0x4, 0x4, 0x100000001, 0x80, 0x5, 0x20, 0x1b98}, &(0x7f0000b87000-0x40)={0x6, 0x81, 0x2, 0x101, 0x1, 0x10000, 0x3, 0xfffffffffffffff9}, &(0x7f0000473000-0x8)={r2, r3/1000+10000}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000012000-0xc)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) [ 81.300764] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/04 21:33:29 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x0, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:29 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000aaa000-0xc)='/dev/autofs\x00', 0x280002, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getcwd(&(0x7f0000adc000)=""/180, 0xb4) 2018/02/04 21:33:29 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000ab7000-0x78)={0x0, 0x78, 0x20, 0x5, 0x100000000, 0x6, 0x0, 0x4, 0x201, 0x0, 0x10000, 0x7, 0xaef, 0x1, 0x80000000, 0x3, 0x0, 0x100000001, 0x5, 0x5efe, 0x6, 0x7ff, 0xffffffff, 0x1, 0x10000, 0x6, 0x9, 0x9, 0xff, 0x0, 0x44b, 0x100000001, 0x7, 0x3ff, 0x540000000000000, 0x6, 0x0, 0x6d, 0x0, 0x8, 0x2, @perf_config_ext={0x0, 0x2}, 0x880, 0xc8ac, 0x1f, 0x3, 0xfffffffffffffffa, 0x0, 0x1}, 0x0, 0x8f2b, 0xffffffffffffff9c, 0x1) read(r0, &(0x7f00001f4000)=""/4096, 0x1000) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000ec6000)='/proc/self/net/pfkey\x00', 0x0, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000359000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000a5e000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r1, &(0x7f0000080000)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) poll(&(0x7f000071d000-0x20)=[{r1}, {r2}], 0x2, 0x0) 2018/02/04 21:33:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f000058b000)=[@in6={0xa, 0x3, 0xeb, @dev={0xfe, 0x80, [], 0x0, 0xc}, 0x10000}], 0x1c) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000deb000)='/dev/ppp\x00', 0x80, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x4000000003, &(0x7f0000097000)={0x0, 0x0}) clock_nanosleep(0x2, 0x0, &(0x7f00007fd000)={0x0, r1}, &(0x7f0000a2c000-0x10)) clone(0x0, &(0x7f0000b47000), &(0x7f0000e35000-0x4), &(0x7f0000d5a000), &(0x7f0000927000)) getresuid(&(0x7f0000bf5000-0x4), &(0x7f0000c9b000), &(0x7f0000a9b000-0x4)=0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000947000)=0x0) sendmsg$nl_generic(r0, &(0x7f0000b6c000)={&(0x7f0000ea0000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00007a9000-0x8)={&(0x7f0000d69000)={0x1364, 0x23, 0x300, 0x3, 0x1, {0x17}, [@typed={0xc, 0x93, @uid=r2}, @nested={0x110, 0x63, [@generic="55263527ea08f428818e5b97651bf4f1dccb2ed90f7483a5ae845e", @generic="eaa62de5b96dfb882b857725312373ce32e42a7969ed8a325fa154512e6028ce2f7340332656ff23436043f973dc556b0e482bce409d4220abcd0259ab03a42b09f7beeaee93c22e7bb5ac6f59250c967f7ead5295b21f4a9a7c33d3f1e867d578b19bad0aa849ee93b045873f6745840e3591e188991bb551504d436c491bb7737095efd2cd66dd5db12742fc210fa30cb3beffd52a6a29051360efa8b1db71d4de", @typed={0x4c, 0x60, @binary="c54fe03780bee3cfb36a16b40000a37c45ec524cfb4f004bd890154b96c9a2e7e5083845be0e0089c51bef31d0ec01eff72c5407b41243e34558da65763c97e105d026"}]}, @typed={0xc, 0x1d, @pid=r3}, @nested={0x11c4, 0x44, [@typed={0x8, 0x1e}, @generic="a3c76f92f1a651468aaf932cf3a3ab12c495a0eb7ea2e2298f6367cebbce8afe13ce10ef80b72b1113ee293539bcbeb13463ad75289307777f40f9b35f25913f153c37813da6fe05ac7c117bad66a1f483f34798302a94f1d645460fdf43d8a23bbe81a78f07e9e025411f69957ec726515fea395b620ea7c0222d", @generic="e0e65dc6dad20927e5f3b89e1860011b3032ecd1e5cac09c77eb37ecd001835986ecd2d6a3a9eace0d119fda5f8bc1548cfe90a0eb03d71c2908759c5858eb0a303a319ae2033fefd67507e995b40737b56306666d373ad28669c9e7e34b2041d20eb42ae82c046a20b752ed6cdb6033b63a7520c455ad732a896caa7a7c3d142c24bceca875fec853117b0dbf9f1153a34a05da47b3431b0143a817a723434550175d85b0f511b3c9cc31848be95d1666f01907bfedbaae903b869793d7ba972c86531e09db5ae1000300abc571d99048040e482062fba69488380c1d65ccdbc7cac3b36788cc578093141aa5890953202d0d4907ad76d0a52b01d00f22c241816b525a56a82349f6d1d53bd8da56e531ed7cdd4587249eda053e521b4b33f303980865828177cb45c0dacb9d1588c2c0cb71e00c358b726828c7f12aaccf2d9da8b6031180f2a9e98fe5d34d809ae72c40de3d4da1021419419e0dfcf5a4b0e991d4da4551d9db7efa6a6d26f116ff84975e946168eae83ad42168a26ddc04affb26c86dbfa5aebe021a81f51146dffc122cf4316783ff51182d6a3f908c12439a765ae2fbc686ff469c827c1e60da2656e784c74af57a919b115de81b852008c1741383e6f6ed4c02c37145d0427d27a19578626059bc1e144992b33755360bebcc7eda11094cec1f38cb38110878ee8b5f639ee52aae8010f67ce86058935133fc1e388765a1e1b8192b0648de81f2b6cf00d07f3b2bc17611cfef37ffe7254629b45f822e23a387814fcec8b2d5e7878b4ffdb3ab0bbd1c0621db7c596164fb8af3889c3c75538d6ae65ac02b9754ee08a03c6de30151aab213b9d98c7bcd8a06b80f56c9e708d1e0b76dfe11d4e3d563baa406ed51c7b6e73a6faa4a9cec566e013e4c37f8fad9af80f463c169033f9c12cb44dccfb7349e72dae11b771a2dac0ef771565a745801c21e47c742764901e4911ccd4cf0c82e7fcd9c5f32e9db81d0b0ccb41631e3887e39494e3b5a7ee23869315a2176b8ac3eed83e46ea1e38e3eee6028accd99210931c48bf88011c513311d2d0a909537dfef7c56598f4c111059b098f37ab19481654577be836a3bbc0bf336f6dd674fad02c0df0b0846d4d9db2b603c2ec121d740c9c847ec338e49175b29c2abdb949fb59ba4799faa3af2d7c90b2c9fd236acabe4cf798f724591a1fe6ce1a0555e79091d02ac03a7495f4860b6d9d227e68aed0fbfbd684a674c4034f4a3ed4724fb02a0f1156ceb3ae53c1cd13311a2818450f86c0a675e377b36c9bfa021c1cbda2dc4915f11b943ae93beeec65e9d07ecf275c848b7f96bf9affa85709c1365feb7c3f8b1d34b2446356bf84b475a365470e39ce3ca476fe3399bb4eeeb534c2aec154efe3781464ff80fdf1824903aa24f3463e181cdd7c0a572607ac4fa036199bed7ce93f76ba70ef8a32c512c18b3fe4f577db077d0d95a4e2a298e8c0f7c9ceb658080f87ebea302e082f8a0d9957d443d07ad9dbe373934e77e507754d50f95ffd333b9b1685b20a816e1e3a7ccb1be139305ff0ed9d802778b3c954f1e0d037821ad8c917e1806a04d99ba8064c1e89ef563d2a719de848b774fe4f6d5c1ecf7e40392ffc6cf6e57982b6f96f2c4b576d99cf83b3899e8288f4f18c45d01a95ad106f251bf17733e132d8ba8269a585be64d195a7f1b76bf3f7011b0c1c67ef196d2beb27a5079e28e427ccad3fcc897db863605c84c22bcc0022e95a6febb8089393949ae2f7094aec89ad3408ead7e513ed3941193d4de964dc20315836bab7d0e2ddccf31fccdd4d3c6bc22a961004d1795dbfcc4dc4593f57face6505d824058314781a50e655b0d170a48c6eb27c0ff6231e7effd23563ba4dfc61862b3dfea3bdbad9862e1b5177281859a9a8e7fe5f8cce286882b38ab19c397490717a2df170f678970f6f23dd017b46485c2fc8ce8489d714efd7db5e9678325a1f3a73b37ab83443ec0b93971bc379f8934e41792db1622f8310374bf0f4c8d692f1583d7eb1301a415c76285c46f42d023e9444c83f3be8454df688c04b1439d055f8e9679a3e0d1509266569b9dd1853c59e13a0af2af441ccfd56678cd73eedd04c7c11c42e51e56ce6384b3e59e6bc5e8e770b48078ef10b56f93740105200d8f0b818127d0829b3d3355aff68a4cb3627779268cc9b76c69e738c474e5a112d4983bdc1068bc288cee2cd41dc9ed404d88c815801c59fd50ae5942f65d14e95e4145b229f6cf1647e776472efa7b4334adc1fb811ff8dca5af1bd31a447268227650a0dbdb2ab57d65c3ccc2e7a085c81ab0f06ab6b39a847e4c4db4a0c90643f40aa7eb9f51d1f51e8e7fe5c763a8a044fa6fe5b82bbd11318d47cbcd9e5d679dc8fb3737ca0e13e71c8bc00aa0fc351491b0c3157930525cb1a4d273baf2d075d5ca9cf95fd2ee9ae8f1c599e292683135af57286b49a0775d2c5d8ac8693febe001da6106dd473e6c593d82e9c77afd02f9b62b0daea5e727e1b48ff83cccda3830ccf4b7023e4117b90f5a61075aa966019d9e8fc20b4ee41776757be2862029f47705ac46afe6b10bc13c7d7c990b9e042933257d2abb84d2d3d84a767a86d27645f1b007c5ea829ad1a4db662731d55746fed566630aea8bca9aa6f952628a912c7decccaf6c6c3e7c7c44bf7fb7524d65b820beabfc11a91d1f69e0ddfa613195791b0fa79c8994139fc78a05a625f297e9c3a80d9afd5597477b4292dc20a7074799e0d583b213e2655b1e42606aab81bf6202ba2cabb3d5c82243dc4c24f839340b6b6d237465095735b67eb9be723bebf7dd87d8026c16668d89cda0ddb8f496e82583123394cbe7bead80d2c7f623d3920a52064eb8e7a6b1ff4a51e815fb5b40d4102bac962385b2e281185e2bef5148966bcb45c8fdac60c095f12309e16fee222962ea81e8fbb1d5c4c02b1ba4bb227b1b165e7e7fb01a81435a28e1e94789f3e0ae6f69703f9e325eeb3b53ee34026677585e849ff2b16b71a9b3fd27c8991299b8bae116164d0870cc89165ae4ea56b3e830e0231e8f1858bb9462b521e0adacd7d12f730b60b769a60fe24eef766bbd00de7ff2288825cb4a584ee966ff0b8f83e12c50138bb0ef54d7a1c7ff243f90f157cd5754cd7e9593014686ac75e0687ef96d9a754dea5d8c3c8eaeedcf90eab9702806d35d79aa8861aa128cbdecfb1657e734790f2ecec80fc2702054fa571059fe616a45264a49cdfe2eede1a5f16e920ec388a2e614dc01ac2a748b9231c1d07e09dd77835856e2fb254e23373154bc0b62df3fc9f2cba17a314db98e99868f480bb164f1c1a4c1067daa996aba886f9b016977947e4653de0cf6f62eda079023f8697c6b0c971b0847a53741a78f126ede01fa0c15d7aa519bb78aa5617dd0305692f9d32999c1001c062a9a3c65f4f21da09b2823f6bfbd95db9e0b6830a9a408be82da3d3b1c54d4fff73b55409bb023ce8eb057a1a29f4dbecc63167a0eacc6f60ddd1279e5041fb3ccd3abfc2fd44a9b144d36e7e066fea76a20dd7a27168c04562be5bfbdd208cafc762c734e84c7cd5d631fcf7af893d635ca87f96bef2fafbca10aee6f170a0a00297d0a243c63bd888887b5f44fbe91f09cd19c2167d6e5cc7e3338d53be136e0f8b6a527d9d53f94f53d16c91ee61c2bab1033c0d272f0680d69d08395111a723ca0cd1b5b30ca5ee5c3899be4d90fb5eb7008415742b269c2e5675b4e394dcb065a869db3a8ab4bfd836ac30a59903ca20ced580f1a3ec28ffd38e18cc08adab4084bffb82c0767bd9355b565bb3f8246b09be474a23722df824cd8a9051ece7ebad79a1ae3a6f0e0c6798f0b89d7656e94b4c43aa2d539ff590b9fc967e7d0661cd15b24c214fe7daa9b9040e80a0980bcdcdd52f2d9b46d08ca4a9688de5416f7aea99b22edbbbfd1f4a20cc17e35b9770bf340ac50f328ad781e635e93e2c54d6825bc03bb5fabf5e29036162e49911ad5d77b91303b1e1b89fb7bfb3471581aca0abbdd24d02a0b6fc78428b0c6cbb227cd2dac33b83f7d9ec1dcaba40927c1681bf44c811e36d57993f4b56514ca4dfacb7cc575f0a92e9188c9d2bab5a659031704dfe4997d9ee71386c3c5e0fcc82a05a7911f2ea3536665e8597dc76ef6c9f9baee5908b55b9fb313d97919733a97930a6990f82961555b321055a93dce2036e5de19cca125d62ae4a0fb4da9864afb93835f12fc77e182d6b1c0190dfda722a23c9ce14fd7045c3a81f28c31e4ec02b2b6bce728176b9bad4713a445e5b1cefaf38d01d864c887df7127eabd47a153b159a4c8f9fbee49770bb9ba8bf912bc170e3b004bca50176c222bf6f9405c15ecb210997225dbe6afeae302f48e49a92217a67d7105fceff92265554ed341e196bf3350b6eac942cf4e2426f33e00ab95fb0996d80ef89654b2e06e90202d574ba30823292544909efeb68f92d471372e3a4efe785e23e0475ac25787437a6beeeaab63ccb57422f4bca4bd96a2ef04dae626156bba1d854c058529d8a1b79b6baa57677285df35c42d4cb5ba4055f3c4d4c876bbb3fd3a3442c5401a450f77789847dcb209812564316c02a73023fea33ecf5d95673aecdc66ee6326fa55b63de1fe2cdf88b9901cc55ba6947de3a42eb91e797b7dccd057ecc95954e0c9257032166c84243c728dfe40a6a494e2bb375849848e728afad34f70274f40bd4d5eec483b5a5669197f53f39112ca9b80d700b18d430db61bcfb9f463bfd06b9c9bfbcc13863c4f9378d8767c4cfc7ddd03847af321aa8cd5044e84de9efe314158e5ef3244502d5cf4e895a5bcf946e95a0603b4190bb57ba7cc4848a967acedc85f756c1a01599edb7bcb1b71524d364812bbd66f3c7df84ba5826f70bd701db10e9e6593097bf930f00faceb40bdabe8edc98e3ceb18d3eb2a421603b50cd2b839c572a44c3bc60ceff86c9a1d5d14575d32c47b991c07e9291169cbd235ca8fc36c73b1fccd2346592e5c5aeff410a597eab3877f3bcc6a96decfe12c11ee0ebfb148dbd0d8ffe1ac9507287417af048afeb8925b4f2012894cea2cee90753f966a46fc70f560ac94687e25f6626089fbce97125eb2a49b72e02576fecd4e3693e8d9a4afa96363e25e3948709f669029fda4774fc42f059fc233c4ee4f2f37a84c74ee10f404e0bd090fd8b0ba494f94e63afd9467997e20de8ee5180e339c6aa076daf4f265658acf3cd6f310ce056fdde77216f053c141d019efb333e4f67c6271c0387e4c466fcb75ad70690519bba476748b9fd0ac105fa0cc1898084ff010f2b4807cb6d2a2b9d4ea75ec3b0c07373dd0c82d8320cf467faf15894bff03c1fe7aefbc11c48de7a70bbad710b0b6d8d82dce811a29cb8306fe118b5fbbfdfe5c3966b400f9b64c9810361fd5c3d7356dfbd80b0d42a6edaf4d37ec90474b66b0c11380b3527f8bf41b4fec34b30ef300ae365dd1c79af78e797bada0428827ae1fcbefcf6af61875a25aa3fb07550d64577180014f2d3cb21a12961098a79681c9b3c1512e454566c8a6aa8687812cdae7790bc75351e5584f95fe193598cf419067aee7ed72b2f1598198e6344df8e4849010c21e59ee8f0d4290accad1826423c2aa692b38be1d166c903768706f841c4d0d829bca4d6a74dfb1c1eb08ede8c7a1e894b842b61b9a1302f20f53a529fe69fc24831bea633b9763b59a8174523e2a6709feecebb7d1fd4bd25dbad9303bf7e708b746fc57657bd8881e4f1b6be1a8", @generic="38776e46bcbd734d858c", @generic="3a9f2a3ccc4f4d1c08d80f8849daba379f17fc3a1287cdaa4c43ee790fe24ade1b69dd64e857c6511a7cf71f81a4fd7c5aa32bf5f7527e6d8c53372c3caf2d5b98596548c5faa1b348b2bab99de9353070", @typed={0xc, 0xb, @u32=0x100000001}, @generic="da7a307155591be91df2c8294adcdab75bbbcf0a4fb2f688150430e1a0430c4959cd9728f026cfcf7a1c279d932df373a57c933600ada820d5c776fab3e8f2af08ed6b820b669bc8dfb5e55e951051ed3fa4da251a2f280155d143eb7d2e3b66b497d19c33a9469e5db0c97f1ef0ce62af5358c1564c6568247869e6682f7d284ace06da6a05e2414ec02c9968b9442e7782bcaac8ce81f143c3c68ff7817875c369d84487dec50c645e7840bbc5080d41e410b7c43a5715e046c61aa2e7bac0e742b9c29c56f54c46b0788ad107efdff6c50cf3"]}, @generic="cb32d0f7af737f96836faefbf56309cd485135887516e15b910fb1e1d530c1890c89ef2699c2403db2079b93819c13c309e60148203b5dcc2753666f4cc1418dcef811f37660a8ada151534a4986fd5238103db250ad8f13763f714239829322d724"]}, 0x1364}, 0x1, 0x0, 0x0, 0x4001}, 0x54) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f00006ad000), &(0x7f0000322000-0x4)=0x4) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f00009d7000-0x8)) 2018/02/04 21:33:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000243000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r0, 0x7, &(0x7f0000011000-0x20)) fcntl$lock(r0, 0x6, &(0x7f0000004000-0x20)) syz_open_dev$audion(&(0x7f000084c000)='/dev/audio#\x00', 0x3, 0x10000) 2018/02/04 21:33:29 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) io_setup(0x1, &(0x7f0000ae7000-0x8)=0x0) io_cancel(r0, &(0x7f00004b1000-0x40)={0x0, 0x8e2844b54643be17, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000872000+0x65d)="f0e97ccb260800f7516faace56892fafd992202a2e2ca17d371ecbfe28b5c6820e365371", 0x28c, 0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff}, &(0x7f0000f1b000-0x20)) 2018/02/04 21:33:29 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000f06000-0xb)='/dev/mixer\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r0, 0x800455d1, &(0x7f0000499000-0xe4)=""/228) write$selinux_validatetrans(r0, &(0x7f000069a000-0x65)={'system_u:object_r:ssh_keysign_exec_t:s0', 0x20, 'system_u:object_r:xserver_misc_device_t:s0', 0x20, 0x30, 0x36, 0x20, '/sbin/dhclient\x00'}, 0x65) getsockopt$inet_dccp_int(r0, 0x21, 0xe, &(0x7f0000e3e000-0x4), &(0x7f0000673000)=0x4) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f000079a000-0x49)=""/73, &(0x7f0000d34000)=0x49) syz_emit_ethernet(0x36, &(0x7f0000001000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14}, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, {[]}}, @tcp={{0xffffffffffffffff, 0xffffffffffffffff, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, {[]}}}}}}}, &(0x7f0000001000-0x14)={0x0, 0x1, [0x0]}) 2018/02/04 21:33:29 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00005d6000)='/dev/sequencer\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00001ad000)={0x10000, 0x1, 0x201, 0x2, 0x400, 0x6f046835, 0x6, 0x1000, 0x0}, &(0x7f00002d9000-0x4)=0x20) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00006be000)={r1, @in={{0x2, 0x2, @dev={0xac, 0x14, 0x0, 0xb}}}, 0x101, 0x30000000000}, 0x98) r2 = syz_open_dev$sndtimer(&(0x7f00004f6000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f000002a000-0x34)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) dup3(r0, r2, 0x0) 2018/02/04 21:33:29 executing program 0: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = request_key(&(0x7f0000e7a000)='ceph\x00', &(0x7f000052d000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000e7a000)='bdev/\x00', 0xffffffffffffffff) r1 = request_key(&(0x7f0000c23000)="6c61636b00691a00000000000000b672e033", &(0x7f0000e7b000)={0x73, 0x79, 0x7a, 0x2}, &(0x7f000009d000-0x15)='self/system-bdevbdev\x00', r0) keyctl$instantiate(0xc, r0, &(0x7f0000b7e000-0xe9)="c4ba5b9264d1832edcf5879e691845e49b233dae59613165808ecb85cb9a1939a3a0d19cf570aa9764860f1d6051d8d72aba70d578fb690e05ae1b152ed62b6f22efdf718ac9699998f4a9f168d7640d3df86f89f1195dd3e06606c2b21543f8e4b7c277faf2579025fd8024a0dcefdaa6e70f1aefa31d68f33f7027ad775aca699e181032ba5400a0acffb10dafa3509415437a41cc376cef978b0c01ea8160e38a95b7a16abc41e19537a2039a248096176878c744814cafd2966d72adb6047d4a830a14ebec2f9552d7c6e19768ffc19d8c407c862095ba0b5136ca5a0234af2c2a29679c3a8ba9", 0xe9, r1) r2 = memfd_create(&(0x7f0000d3d000-0x27)='GPL*bdevself{GPL-user\'/trustedtrusted%\x00', 0x3) setsockopt$inet_udp_int(r2, 0x11, 0x1, &(0x7f0000000000), 0x4) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000294000-0x4)=0x0) mq_notify(r2, &(0x7f0000c05000-0x58)={0x0, 0x35, 0x5, @tid=r3}) getsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000e7c000), &(0x7f000078c000)=0xb) r4 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r4) mmap(&(0x7f0000e7e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000e7e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f0000e7e000)=@get={0x1, &(0x7f0000e7f000-0xa2)=""/162, 0x1}) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000e7c000-0x8)={0x0, 0x0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r7 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r7, &(0x7f0000e71000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x0, 0x3, 0x0, {0xa, 0x2, 0x3, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x4}}}, 0x32) mmap(&(0x7f0000e7e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000e7f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r8 = syz_open_dev$sndseq(&(0x7f0000e80000-0xd)='/dev/snd/seq\x00', 0x0, 0x40000) poll(&(0x7f000088b000)=[{r2, 0xf846e6a9e7af60e4}, {r5, 0xc000}, {r5, 0x2020}, {r7, 0x2021}, {r6, 0x4}, {r2}, {r8, 0x84}, {r7, 0x2403}, {r2, 0x100}], 0x9, 0x0) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000e7f000-0x4)=0x0) fcntl$setownex(r7, 0xf, &(0x7f00003d8000-0x8)={0x1, r9}) [ 81.425552] binder: 10451:10463 got transaction with invalid offset (0, min 0 max 24) or object. [ 81.449150] binder: 10451:10472 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 81.450899] binder: 10451:10463 transaction failed 29201/-22, size 24-8 line 3020 2018/02/04 21:33:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000805000-0x4)=0x0) setpriority(0x1, r0, 0x800) futex(&(0x7f000000d000-0x4)=0x4, 0x0, 0x4, &(0x7f000000b000)={0x77359400}, &(0x7f0000048000), 0x0) symlink(&(0x7f000088b000-0x8)='./file0\x00', &(0x7f0000c28000)='./file0\x00') futex(&(0x7f000000d000-0x4), 0xc, 0x1, &(0x7f0000c44000)={0x77359400}, &(0x7f0000048000), 0x0) r1 = syz_open_dev$midi(&(0x7f000055b000)='/dev/midi#\x00', 0x2, 0x111080) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00004e7000-0xc)={0x0, 0x58, &(0x7f000018b000)=[@in={0x2, 0x3, @local={0xac, 0x14, 0x0, 0xaa}}, @in={0x2, 0x0, @broadcast=0xffffffff}, @in6={0xa, 0x2, 0xff, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x2}, @in6={0xa, 0x0, 0x7297, @mcast2={0xff, 0x2, [], 0x1}, 0xffffffff}]}, &(0x7f000088e000)=0xc) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000d8d000-0x18)={r2, 0x1ff, 0x20, 0x8000, 0x1cb}, &(0x7f0000b56000)=0x18) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000413000-0x16)='/selinux/checkreqprot\x00', 0x400000, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000c5d000+0xcfa)={&(0x7f0000ef3000)='./file0\x00', r3}, 0xc) setpgid(r0, r0) 2018/02/04 21:33:29 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000808000-0x9)='/dev/sg#\x00', 0x81, 0x181002) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000eb3000-0x20)={@dev={0xac, 0x14, 0x0, 0x15}, @loopback=0x7f000001, 0x1, 0x4, [@multicast2=0xe0000002, @multicast2=0xe0000002, @dev={0xac, 0x14, 0x0, 0x11}, @local={0xac, 0x14, 0x0, 0xaa}]}, 0x20) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f000001c000-0x38)={&(0x7f0000016000)={0x10, 0x0, 0x0, 0xffffffffffffffff}, 0xc, &(0x7f00006bd000-0x10)={&(0x7f0000213000-0x8c)=@ipv6_newroute={0x24, 0x18, 0x301, 0xffffffffffffffff, 0xffffffffffffffff, {0xa}, [@RTA_PREF={0x8, 0x14, 0x1}]}, 0x24}, 0x1}, 0x0) ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f000005a000)=@pic) 2018/02/04 21:33:29 executing program 2: mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000003000-0xb)='/dev/vcsa#\x00', 0x9, 0x400000) mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f000000b000-0x4)=0x8, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000009000-0x9)='maps\x00') preadv(r1, &(0x7f0000003000-0x10)=[{&(0x7f0000005000-0x1000)=""/1, 0x1}], 0x1, 0x1000) 2018/02/04 21:33:29 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x0, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:29 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000867000)='/dev/rtc\x00', 0xa0000, 0x0) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000943000)={{0x1, 0x10f001, 0xe, 0x81, 0x0, 0x40, 0x3b0, 0x6, 0x2, 0xaa8f, 0x8, 0xff}, {0xe416d680bb91dc71, 0x14000, 0xe, 0xb4, 0x2, 0x3, 0x5, 0x6, 0x4, 0x10000, 0x7c7, 0x4}, {0x100000, 0xd000, 0xe, 0xfffffffffffffff9, 0x25, 0x1, 0x0, 0x8e2, 0x7, 0x80, 0xfffffffffffffffb, 0xe9600000000000}, {0x2, 0x1, 0xa, 0x8, 0x80, 0x2, 0x9d, 0x2, 0x7ff, 0x3f, 0x4, 0xde76}, {0x10002, 0x0, 0x0, 0x6, 0x8000, 0x7, 0x9, 0x2, 0x2ae5, 0x5, 0x3ff, 0x82}, {0xf000, 0x10000, 0xd, 0x50, 0x3, 0xfffffffffffffff7, 0xa6fb, 0x7, 0x100000001, 0x5, 0x4db, 0x9}, {0x0, 0xf000, 0xd, 0x8001, 0xde06, 0x0, 0x4cd, 0x7, 0x8, 0x4, 0x9, 0x800}, {0x11f000, 0x13000, 0x0, 0x0, 0x1f, 0xe1, 0x1f, 0x2, 0xffffffff, 0x1000, 0x3, 0x3cc}, {0x0, 0x2}, {0x2000, 0x4}, 0x40000021, 0x0, 0xf000, 0x4000, 0x0, 0x1000, 0xd004, [0x14, 0x101, 0x8]}) 2018/02/04 21:33:29 executing program 6: mmap(&(0x7f0000000000/0xfe6000)=nil, 0xfe6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x100000006, 0x0, @dev={0xac, 0x14, 0xffffffffffffffff, 0xfffffffffffffffd}, @remote={0xac, 0x14, 0x0, 0xbb}, {[@timestamp={0x44, 0x4, 0x5, 0x0, 0x0, []}]}}, @tcp={{0xffffffffffffffff, 0xffffffffffffffff, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, {[]}}}}}}}, &(0x7f0000754000)={0x0, 0x0, []}) mmap(&(0x7f0000fe6000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000fe6000)={0x0, 0x0}, 0x4000) mmap(&(0x7f0000fe6000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000fe6000)={{{@in6=@ipv4={[], [], @loopback}, @in=@dev}}, {{@in=@remote}, 0x0, @in6=@local}}, &(0x7f0000ab3000-0x4)=0xe8) mmap(&(0x7f0000fe6000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000fe7000-0x1e)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TIOCSTI(r1, 0x5412, 0x1) 2018/02/04 21:33:29 executing program 5: socket$inet(0x2, 0x800, 0x1b7) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) llistxattr(&(0x7f0000002000-0x8)='./file0\x00', &(0x7f0000002000-0xa8)=""/168, 0xa8) 2018/02/04 21:33:29 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r0, 0x40000000000005) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f000079f000-0x1c)={0xa, 0x2, 0x1, @loopback={0x0, 0x1}}, 0xfec7) r2 = accept4(r0, 0x0, &(0x7f0000f7f000-0x4), 0x0) sendmsg$kcm(r2, &(0x7f00002f8000)={&(0x7f0000bc3000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x14, &(0x7f0000308000)=[], 0x0, &(0x7f00006f4000-0x33c0)=[{0xc, 0x10d}], 0xc}, 0x0) [ 81.504969] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/04 21:33:29 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000c98000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00008fd000)) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00002e4000-0x10)='/dev/sequencer2\x00', 0x80200, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000381000), &(0x7f00007f0000-0x4)=0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f00003fc000-0x4)=0x9) 2018/02/04 21:33:29 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000b11000)='/dev/vcs\x00', 0x400100, 0x0) syz_emit_ethernet(0x82, &(0x7f000000c000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x74, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @local={0xac, 0x14, 0x0, 0xaa}, {[]}}, @icmp=@dest_unreach={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x16, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2f, 0x0, @dev={0xac, 0x14}, @multicast1=0xe0000001, {[@ssrr={0x89, 0x17, 0x0, [@multicast1=0xe0000001, @empty, @rand_addr, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @loopback=0x7f000001]}, @timestamp={0x44, 0x8, 0x0, 0x0, 0x0, [{[]}]}, @end, @ssrr={0x89, 0xf, 0x0, [@loopback=0x7f000001, @loopback=0x7f000001, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}]}, @ra={0x94, 0x6}, @generic={0x0, 0xc, "107777ff0010020003f4"}]}}}}}}}, 0x0) 2018/02/04 21:33:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = syz_open_dev$audion(&(0x7f0000195000-0xc)='/dev/audio#\x00', 0x101, 0x0) ioctl$KIOCSOUND(r0, 0x4b2f, 0x6) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000e3e000)='/selinux/status\x00', 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ace000)="1fe0b381b80fa625f31d716fea26801a4d3cd9573b31a1bbe71d42b2217d1acdde70d0c7508186cedc012ff139999894d2cae1d0615839ed1a23612be956b283f5e392fe56c6aa8b3bbd369ddbbe84ee7ab6f0f3ba4bd99749a5c9b613518a654cecdfab45e978bf056ce4edcb46dc90c271b6ae7f74dc27d54557e10b3157d9279426588248149b25bfa98d439f0a161235daa8b25734600f2f4dddb2a15e62ca06b3175e756ff66f8f7951ee9b0a9713f2277b03a2576a4fd4e213ab07cef7b0a18f759bc2a196cc8af883e2c31c00971bd95938647c84d3eb0861b27be53e3d1c29bc6c46cac88816b81c9e282e842a88a667791a98df80ed9e99b590146a003b0134c2323b87b3ad6490a22a771333b9496dc6e68729e29de53ff0dc6943e1dd345ad0b0f40b942ba421772ee178451e2c95cf5ec36bdf94c669494f79df5aed6dc98a213f7ca6ddbfb821359c62fb80b49aee35bd70972fcfd4ffa6f055e6292a70893ebb88923f09d2835ba2c0edc103c107d7f92aa0da9ca576d7cfccb75b33f7eb327c77bb56e26aa41417592147cf8325a99c7b0a7181eb1a12981c098896825654a987ab58b64a30ebb19b141ab4432bd4b5e139a9120c73c5c0921892013baa4543399afe1d79d0edd03a40f04f04aebbb7efeb01b3ae70050d298f63f37932dda3a181fea721aa11150a51116f54d2951f3150b33584ac191584187898d51a66d536c2e6f08492e5cabb468de414cc6b924474d0f460cdeddc35577ca0bfa9a6e04c1714275fcf5dd79aef6e0d137001686e9008832ef34c8eea00bbc9e47f5b86efb22ce4ee593be6ce785f3177ba43ce1276329ea8e1743cbc43af026da9955bb08d099ebafa80c13e92c08165a12afaa2a5d5f12a509e288131be8953428ea6d62ccfccd63f0e6ca296982b944f251f979b1c82cbc056970d3db446264acf35d739400f5ca99f0112d3fa7c50ce2febf22d750ec99cba50fe88f4c5fa2ca494ba4d1e96de5350568203ce4080b0866d187ff1df29ab28c6f7ce6648d24dc357ddae948ff74e7b1c1f5f6a0ba6d1663eb3d1cfdb59c20873df110429cdca418b8fc1c904241fb6b0287740f39b7771d1250aa5f99c8c60dc7b5dd50280d66d015fcf6c53d724eaee745131d6d823262ab3381f75dadbb59b14b7192a7a5a3bc9f0854824225722d0b873a72342fe183b07dd50c5997f6da5e6097a93f3a9f5cb81c0dbc241d2598770758c1cc85430bf3e4d73488f9763c4a21bc61b511696368ece49f7685831176d9f5d5458b205f9856af2391525b9edc78f0461b6b68ea1c6755ad4a3015db9938df24e345c073fcc0609140e039af5e73bfd6a058e8ab77e31364792243f7b3dc08bb5cdd225ce3494e9c30cb6221c0dde36c52cb32cfe286e615b843ec381e73f9ee96d7ce93f614f307faa09e69725a8f5ed62fa7aeeea0b87190c4474a488f9c64754a27f22c538d4d678eadf49c8ba787b9de0baab6b23281fc98a5c9a1c6bacd9b13b8e5dec60821bc3dd31147dd845ab08b6c7c7acb2df401febf1c0ec26266efd0f796d1aa3bbcdd03b6ca6e9300b7c3da9d44ffeeeced5577e4929eb73ee8e605e3c3a3f52b43b902eaf8edfec154cc66e347dd65275d318ed6efeb41129da8c527e05c6965278eab4e61b18296941d4b439f5acb14fe192500b886526c17b1bfa84a118f81303b6173d19fc42905ff8cab8b8cdd5a5c40e8fc5d887a8bc630c30882c5c54236098304dc0acfc49dff85c78fbfb0461c0031b22c4b3a60acb1552d2c49944f12d1cdbd5d1be9c85c5343db1c178a15e8d28490bf86b1f2445bc91e66d1b5f1a51b6c794722c7cbfc073f836396fe3cfb229c940624c97fbf92b244dd22a5c0252caf150546983b47f2775926b0c81ef7a693ff95173e8e4eb7c6ff47a987b8d3902285fd0d2f14ff3383e9b082fe4a8dfec87eb951d2a24a6f4af7af959a3e86b62b85ac586c1756e65ce609b09aca58b607b1c23e010c3ee70ec99e8b5f5c84fafcd8882b5cd3ca434c71c6f8a0fbb74d00d859f8fbf4cac3fecf040d3fc77e86000f6f292dfbab52411c50661f4bb54d50f9fae8e895e58b42989f706411e355b725368f44dc30e7aa26617faa64b8bb9c947bb600950a291fe55fd66ed3d76e6bd08ea54b707c081a4f4983af419942e7994695fb1ebba213c7d7ec882b66d91c33ef334698a2ad44648649e52a7ad76f542d233b7328d9399c76bce59a7dc684ce64e41835d28ac582376418cb887908e733893076d22fb10b4f4ba3c0099844fd71ef968d646e6f65ddf8620959a7e77cce7ca9839a496b761604103bb21c9ccd0b45096a5c287af5ae61c82c2b1f5bf527730339b27aaf42b4dfc8cc76968918f9afc25bbcba438b4469a9535e83aa08e75a9db3b39b3ad35361345dc8cb03cb36fd09a3c8a55133bee2fa1d2ce66aa29e265806e1a13604b055916304b83859e7e9ba4d625c7e9a65f4a7b143622c970077a1e274f60f9a72dae4c1e3640a0e55fe5c94b2456caf302afb5cfd0c7f2456d11153223bb06450c904df8d0ac6c9391abef11e384daf44b546d46c5fc569cc69bf1cc965a5d72a5b8c2b33fddc3b5eece7c972ae90b95c26f2f1aaaf78b1199f44b4f727a7e1dbdbb32b9d562665f32d519cca15facd12d9618c929e38f48423e1eae92d7cc64793ea0714b6113e9f9648a59ad9ccdf1d04310b6e5ea092f1d4b4b8fd1e7d58284431fd48da34613bbfae5b2c29c3d5f37ceec0630a962e30383e011383a99b34dc228ce381099716067f9cf73784fb6641abb25c9139bd2d199f4413139d00d9591170c3586c16fafa3dbefd4e874fc55b2ffa190c7a0a97e8e5e92461260d15b5512cac404ab4c26d4b6c25c167d68323d69c1ef43c63f741f32758b11470bc7fe269e2fd0bde4d74dcbca5734810da7014ba2cedf4b1a221a0a47c50c0ed1fb8c72a3a1384fbf90145eff4739c1746d4c044e6c08257f15f81f1f28293f09fbb0ada60168ff756551fc0cd0166f1757b2d5c7e84ff7cfbfe3c0d4eedddc2a99af4c855aec22827dabc84883d8203003cbe54ee740a3e51db19717ec466438c02aeaec1e31d05770a1a9743b2a0b4cc311fca7651c177fa7c36707add350311973cf858b808080dd6b5926f72f9878396d57c24cafdd813bf8a09d652bd9aff768d6ddee96e45022673fb7c9e093b72a1854c802f4d938a0e33f0399c813c2f8e279680a21573ba5a44a29377fc6a76bf18afa05649320f5010fef75094cb37b781af6712bf735100f5bbcca9f4d353a68d1f504d9f9a04a58bbe5deb7808666bd319726537ec9b5c6f02f0faeb26e1b76a1a9c56ba95639ae3cad6040e1ef23ba6b3b8e0ced8564de444476f31d41b8b17f7e6df3ad6d877b841fc7d75c7ba8a5aaa57354e2887aaef4a359c8d1277e07f51282b188e81d6e785fa3e04bc6e9c57e252cabf692b49a48c201f7db26a8ef4495e3aa426a4cbbf01cefba47c807f6cad109cb7b4954c18f096659a47dc7323cf8691ac9c3bffb1aebfec39311b7dadfa3236099d7e6c6524d3a321daaf3071ebbc7f7c6029c6ef7119e9f6218fa4aede16c480895338595019fd6274a90e4e9aa116c055abe85b58264d132136994bfc30b9fd6f387efd08268c5c0b0ce379de40a0dfec9cf05508df59bace3c75175067cc649a94326478fce53b3d639655ec15fc7fcfd581359374170800ec32e4165ae70b7cf2aef7198c4dda9132d8d7b5a7f544c62a59653cf55bdfee440de4fae4e2bd885bb5246db5448e4037cf4487985bf6e04a284f6bab0679acdb4f1aa974ad17019fd7b6ebf986554b912ee13eb2d512a0b8bd4b971eb4100d7d7569645fde320a8bc48c8c0335ed19e7bdcbeb220019a3a2d14957de643843e2d14b897e58b9c466e88449dc41ef496dd9d28c7e4c746b6887ede3e939e6bddd4ddf43dec984f36a345e2323ba9eb2629f7f152fd83c7b0589b8c43d4f00841be606a742b92ede2c618abacb2fc496b81c1560c72e82011ec288c36ae4174b718a5158b7aef5d20310fbc1a6d8852d6fb1b1a77fb55ffe98d8329e158e115acb8b2ce69e3b602a1a1a33d90b60817eb004e2946ca4191add03adfe7a21091258c4783ed86768a5c7101521e6ea3f2384c11d4548848cc23dd76382493d5cf4bc0ae8c6ecc038824cb93b4056863d5b643559b6f03f328a9c83929ce00795478737d29a1f71bd78fe9cf182f640882b98856d40439ab51a72440688f988fda7a4426813107038915e921b8ef46b86b034623273a486e74bab4e7e7e77d10e5de5b5cc25472da5afa50d140e0366fc514cd1973d7e72f029bf29361d1ec8272f21df3c8fb1e79cd1c71e7a4f39d796ed073fa59d38ef455addde003a970450d014561657a6c0cc007d83e75c769cbeb67be3760dc8340f1f98f28205bb9d0a04d21e9fd87c003ea326f2384c9b87f2ca690a15de0d6e811c1265725a161e81c8080c01134e5a035199ca1bd47ac62c1605c2a2b8dfa84405961c28e47ba1a86b989c118501ad1f2104a2506067847ab08b11f6feb35c801e03824caf675e97299e484bb4ae0bac3529939d1eeaca98d8205efd7a8f6447e7c253d9e6eec62ecc298d704233012310cfa6a1cbcd87d93576e8c9f06f075072c99dfdb6856e1851ff4f0bb710bb888713622a67f4dd2c9f7cc6e47f0a69de6e5cf0a422c2137469c6a635f71bb08d8bfe3ba549430be21eecedba6e9fcb8b4fa3007658b3621b89be42b913e5f2b3ac435227ec8c865dbeb9e6d284941b2c34885b67d0966d4a8c045b2744c75d377943e725b5b05a4f6ca44123cfb0b88b343cefc6659b9c0c0ea06fb158872c4cad7d9d204d89eab549e42d7cc841d06b2214129d86b892019da0572b6a67c57a572681edcfbd00df182d5a43913a519bb7f9373065ee88df363bb7f8952a2386aa28376b481fe8cd572e70ecb858b7168938d792073fe3dce1ac988dc5d1f80a0ef7d785c0c12df9b39d46c2b8d6bfc360f83328fb091a8c85405fbfa6c0a799ad3bf4ee544cb2c97c9759060be65336250aa5ff1a6f9a24a3d75f5103f0c7d2ccfb4e839a735a3f0cef23e67981c0cb0fcff4c4aec240a386514500dadec85cd9e1ce9f6ac43a225febf0c65daadd4e6efab1c0afcd8ad43374761c29b249cad131ac696b4782be875d9b88a5b7c786e6928a04447dd789713be0d0d5a74d8a4252b73ef03d3289034e55fcea47cc871a8b8dd7b741dacac99ffa7513991dd0e8a60b6f041377488d811654e39e66d50349a887996cb715a126bd22bf917904c2ba2183cbfde143384041960603ab3fa91f9a91816691b0d5532f942b025c18a04354ac0ccd6c09e2b44f516d7e260d901b20cc01727989925fbedbc465f5d0c8035893807f83cb0797374e730350b5ad3f78a445a2d3ec57c4e30da40792886fc897c4e9d4f8724502d4c9e06838afa520d53572609216689a6f76297ab4e19aa661c082369b761a7f1b457fe23f4b1677df8514d8dc9c119ee7a7d719235451c11529c57cea2a50fa68e5168390a817d1e5df2b8ebbfc853d938294664543752247c347406fe6666ef64f6091329d3d52d91fe26258cc3755f779d2dd0b78ca6ca36a644d9f9974b0727f193ec54269341dec05616df35cd8b85b2c40c5d028fa6f5e37e3ac23b9f24a8cd3681cbd41a270972f67f9eff397f1aa1d224058ad463fd82b6c1beb9502cff7e5fb7d7e3cc2e0db549edf09aa39dfa9b922e87d2421f8f", 0x1000) 2018/02/04 21:33:29 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockname(r0, &(0x7f000037e000)=@pppol2tpin6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @local}}}, &(0x7f0000171000)=0x32) bind$vsock_stream(r1, &(0x7f0000493000+0x23c)={0x28, 0x0, 0xffffffff, @host=0x2}, 0x10) getsockopt$inet_buf(r0, 0x0, 0x482, &(0x7f000082d000-0x18)=""/24, &(0x7f0000f09000-0x4)=0x151) [ 81.570987] binder: 10486:10489 got transaction with invalid offset (0, min 0 max 24) or object. [ 81.577042] netlink: 'syz-executor3': attribute type 20 has an invalid length. [ 81.598101] binder: 10486:10502 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 81.599357] binder: 10486:10489 transaction failed 29201/-22, size 24-8 line 3020 [ 81.611617] binder: 10506:10507 ioctl c018620b 208fd000 returned -14 2018/02/04 21:33:29 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:29 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000a93000)='/dev/rtc\x00', 0x200000, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x81}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$setname(0xf, &(0x7f0000b72000-0x6)="02") r2 = syz_open_dev$usbmon(&(0x7f0000147000-0xd)='/dev/usbmon#\x00', 0x101, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000474000)={0x0, 0x83, "9db4cd30a5f1a5619bbc93e1d6b4840607e7b0f873e47ed0a5ba426701162e4bc0073b1432660b267f2fb6e0089b4f81defd2d8c752c41dba60b9aa83fabea9f5303bbabfff0db2201ffc5804a84a0757f38e3cb08929acd14c261d6109eb6def7adae18842abc2d5676829b881999f0e140b32ae0e5b877c4df5927d3f70d1347b7af"}, &(0x7f00002fe000)=0x8b) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000bdf000)={r3, @in6={{0xa, 0x1, 0x7, @loopback={0x0, 0x1}, 0x1f}}, 0x8, 0xfffffffffffffbff, 0xfff, 0x3, 0x9}, 0xa0) r4 = socket(0x10, 0x2, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f00003e3000-0x8)=@assoc_value={0x0, 0x5}, &(0x7f0000733000)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000dfa000)={r5, 0xffffffffffffffff, 0x20}, 0xfffffffffffffe36) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f00002c9000)=@sack_info={r5, 0x2, 0x6}, 0xc) r6 = add_key(&(0x7f0000a83000-0x5)='user\x00', &(0x7f0000d9b000)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000b81000)="2dc61504132f320d0fa1a4cbac68225270cad8bb99cf50b29d87ed678a384b028f48b158ebf4f4b68d5d5d79c468ef8246aa60060e95f4845fb6690dbfe3769edf8a3eef2a455afcdc5d5f0af333ff5f69f55f486fc930c1ee253f1d0959e29d9418b3113585f76866f48bbf2f4fdf62e374b4736329f9", 0x77, 0xfffffffffffffffb) request_key(&(0x7f0000743000-0xc)='id_resolver\x00', &(0x7f0000a26000-0x5)={0x73, 0x79, 0x7a}, &(0x7f00001f5000)='user$\x00', r6) 2018/02/04 21:33:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000ed5000)='/dev/cuse\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000dde000-0x1a)=""/26) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f000005f000)={@remote={0xfe, 0x80, [], 0x0, 0xbb}, 0xffffffff80000001, 0x2, 0x3, 0x6, 0x100, 0x1, 0x4}, &(0x7f0000471000-0x4)=0x20) syz_emit_ethernet(0x4e, &(0x7f0000367000-0x4e)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x18, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[@fragment={0x32, 0x0, 0x6, 0x293, 0x0, 0x0, 0x1}], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x4000000000, "f0810e", 0xffffffff, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000e96000-0x340)={0xffffffffffffffff, {{0x2, 0x1, @rand_addr=0x3ef5}}, 0x1, 0x5, [{{0x2, 0x0, @multicast1=0xe0000001}}, {{0x2, 0x0, @empty}}, {{0x2, 0x0, @multicast2=0xe0000002}}, {{0x2, 0x2, @rand_addr=0x593}}, {{0x2, 0x3, @multicast1=0xe0000001}}]}, 0x340) 2018/02/04 21:33:29 executing program 2: mmap(&(0x7f0000000000/0x1c000)=nil, 0x1c000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0xc) mmap(&(0x7f000001c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f000001c000)='/dev/sequencer\x00', 0x109000, 0x0) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f000000d000)=0x6) mmap(&(0x7f000001d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AUTH_MAGIC(r1, 0x40046411, &(0x7f000001e000-0x4)=0x7fff) sendmsg(r0, &(0x7f0000012000-0x38)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000018000-0x4c)="24000000000b07031dfffd946fa2830020200a0009000100000000000000a3a20400ff7e", 0x24}], 0x1}, 0x4) [ 81.637121] binder: undelivered TRANSACTION_ERROR: 29201 [ 81.640751] netlink: 'syz-executor3': attribute type 20 has an invalid length. [ 81.652060] binder: 10506:10507 ioctl c018620b 208fd000 returned -14 [ 81.689477] IPVS: length: 337 != 8 [ 81.696287] binder: 10515:10521 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 81.698641] dccp_invalid_packet: P.Data Offset(121) too large 2018/02/04 21:33:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00003b3000)='/dev/sequencer2\x00', 0xc001, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000bd7000)='/dev/autofs\x00', 0x305201, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc010643a, &(0x7f0000161000)={0x40000000, 0x0, 0x4}) socket$rds(0x15, 0x5, 0x0) 2018/02/04 21:33:29 executing program 3: mmap(&(0x7f0000000000/0x14000)=nil, 0x14000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000006000-0xe)='/selinux/load\x00', 0x2, 0x0) poll(&(0x7f0000004000)=[{r0, 0x10}, {r0}, {r0, 0x2101}, {r0, 0x10}, {r0}, {r0, 0x3e}, {r0, 0x4}], 0x7, 0x0) write$selinux_load(r0, &(0x7f0000012000)={0xf97cff8c, 0x8, 'SE Linux'}, 0x10) openat$rfkill(0xffffffffffffff9c, &(0x7f0000004000)='/dev/rfkill\x00', 0x82000, 0x0) 2018/02/04 21:33:29 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000b37000)='/dev/loop#\x00', 0x0, 0x4080) r1 = syz_open_dev$vcsn(&(0x7f00005e0000-0xa)='/dev/vcs#\x00', 0x8, 0x80001) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000b7c000-0x28)={'vcan0\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000c3e000)={@local={0xfe, 0x80, [], 0x0, 0xaa}, r2}, 0x14) close(r0) 2018/02/04 21:33:29 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_PPC_ALLOCATE_HTAB(0xffffffffffffffff, 0xc004aea7, &(0x7f0000a1d000-0x4)) r0 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00') socket$nl_xfrm(0x10, 0x3, 0x6) madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) mlock(&(0x7f0000b1e000/0x4000)=nil, 0x4000) sendfile(r0, r0, &(0x7f0000b58000)=0x200000, 0xffff) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000653000-0x4)=0x0) sched_setparam(r1, &(0x7f0000165000)=0x1) 2018/02/04 21:33:29 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 81.735469] dccp_invalid_packet: P.Data Offset(121) too large [ 81.740576] IPVS: length: 337 != 8 [ 81.747312] binder: release 10515:10521 transaction 97 out, still active [ 81.754287] binder: undelivered TRANSACTION_COMPLETE [ 81.759538] binder: send failed reply for transaction 97, target dead [ 81.790107] SELinux: failed to load policy 2018/02/04 21:33:29 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000002000-0x50)={@mcast1={0xff, 0x1, [], 0x1}, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @loopback={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x5}) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000bb2000)='/dev/cuse\x00', 0x400000, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000570000-0x4)=0x2, 0x4) ioctl$TCSETA(r0, 0x5406, &(0x7f00009f8000-0x14)={0x3, 0xaf, 0x3, 0x2, 0x8, 0x9, 0x0, 0x7, 0x0, 0x5}) bpf$PROG_LOAD(0x5, &(0x7f0000011000)={0x1, 0x5, &(0x7f0000002000-0x28)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x6c}, [@ldst={0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff1}], {0x95}}, &(0x7f0000004000-0xa)='syzkaller\x00', 0x5, 0xc3, &(0x7f000036e000)=""/195}, 0x48) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000460000)="70323a0f6cb286e5f5e995d1802946b2f9c402a6ed94e06eae08e88ed4291d03495d017de9839c68479cc97bbf54f73387b98122b3ecb7b8fc4a2eb56c3d73b0be91e8fb3bd88dc08eeda2dc21fc7a46125a9868b66a90a8b6f20d6f74f928b520e375c38f51a1137d3e00") [ 81.810909] SELinux: failed to load policy 2018/02/04 21:33:29 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x18, &(0x7f0000d01000)=0x7ff, 0x4) socket$packet(0x11, 0x2, 0x300) setsockopt$inet6_int(r0, 0x29, 0x3c, &(0x7f0000312000-0x4)=0x1, 0x4) setsockopt$inet6_buf(r0, 0x29, 0x3e, &(0x7f00002cf000-0x78)="5780d01c", 0x4) sendto$inet6(r0, &(0x7f0000adb000)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e602721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ef42eeb66c3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a0e1d0607f57f626a5b8d476636ef1ee76307524cf9ae49be4db0ab2c8ea0c5ebd1e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408cc4c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dff02ba9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669c24c206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb25c89074fcb1bba20c41bddd9ca5cd2f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2ebdfad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea09364ab42ee9802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c5912a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a98f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e218daa5a3ef64617beb30cccb31016b13ed8d7bcabb03e176b1c906a38cbda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c71f496cfe9bc88fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97184339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f400582bd95e5ad802050d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60be632697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b787bdb26809d734aaf98b86fcf9fc643a34d03ebbe072820662d20f4774d66c5ae0a0adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac39b204a814f5ece5961621358e36f8a2cf7196c76959824bbb475a7cad8f57853fe05f59f341b5b4967904daf833d91ae9461ef10036f8be7700d66f2d2c3a63dba8eb35e7127246029e222f0b2aebbe767f5125e2d9ea5d5987b9bb96f303e4f3c647c776c5b6306472896dcebe0de6d001b453a4e26dfe433b409586e0faca3ee89e8b936ea46b97a0f663544a8f4784c6b484334949f583b02557645c7d7884910eaf4879da3f4f37ce789b728a49d0546730e2adb0a9cb74620b0cf3a28061a607089a47a23e831c16dd002fc6ad4ebd7c62d265da40d6bfd145698d18d14522e19aa599cd9e412c4644dccb31849bd5e31411c6ff9249be50762cc6fdaa01a7cdcb162dc0516524002b688a462f69b6cce348a6dc5e9356ae3938909ea062f9501220214e83a4e621b8d685925c92c7564e9132cfe10f8acb646b731114ff101479f99d70a4bd6033bf5e4e6675120fa21d0610a685af21ba76162fa5cc571056b295b8f9987fdef14526be89516234dee2d93bf7ceba533af07bb7a6e9f1d5756f81a7558b5e029e662c5dfe00f657bd5a5165c6d44bd90f719342b7ac36eb8f10cdaeda44c079ecb31d324125ac848a27ba173ad35d1acd4e206387ecea474d6a70086d225448e247bfcd51ecae1f15dfe10acc50e7757cca9c5ef80562b63224c3259d6d1fc928264d356b8345ba03e10cd6970c0343ee98359dcb5920b83cb0aa034807f40050c6cf63543e107d85bfa82ce4f5e90f6078a743b0c7ccdd007c7c0115abfd5a9a52873b7b5da78a1ab7404016c5d00aabcfc3e16070b8222a99efebebf6042e6da1dbb3e782d831c0eb4f464b82abc0a8", 0x7d0, 0x0, &(0x7f0000809000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) recvmsg(r0, &(0x7f0000ea2000)={&(0x7f0000135000-0x3a)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @mcast1}}}, 0x3a, &(0x7f00000a4000)=[], 0x0, &(0x7f0000d73000)=""/105, 0x69}, 0x0) 2018/02/04 21:33:29 executing program 2: mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000008000-0x8)='./file0\x00', 0x20, 0x0) pipe2(&(0x7f0000003000-0x8)={0x0, 0x0}, 0x4000) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000002000-0x4)) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000001000)={0x28, 0x0, 0x2711, @any=0xffffffff}, 0x10) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_buf(r2, 0x1, 0x3b, &(0x7f0000009000-0x7f)=""/127, &(0x7f0000001000)=0x7f) bind$vsock_stream(r3, &(0x7f0000004000-0x10)={0x28, 0x0, 0x2711, @host=0x2}, 0x10) mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000007000)={0x0, 0x6}, &(0x7f0000009000)=0x8) mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000004000)={0x89, 0x2, 0x401, 0x3ff, r4}, &(0x7f000000a000-0x4)=0x10) 2018/02/04 21:33:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000666000/0x4000)=nil, 0x4000) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) personality(0x6000003) 2018/02/04 21:33:29 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) readv(r0, &(0x7f0000001000-0x8)=[{&(0x7f0000e9f000-0x24)=""/36, 0x24}], 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xffff, 0x10000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000c4f000-0x8)={0x1, [0x0]}, &(0x7f0000001000-0x4)=0x8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000000)={0x2d, 0x230, 0x4, 0xfffffffffffffff9, 0x7, 0x100000000, 0xfffffffffffffff9, 0x7, r2}, 0x20) ioctl$KVM_NMI(r1, 0xae9a) setsockopt$sock_void(r0, 0x29, 0xc9, 0x0, 0x0) 2018/02/04 21:33:29 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:29 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00008c2000)={0x7, {{0x2, 0x1, @rand_addr=0x7}}}, 0x90) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0x0, 0x200007ff, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f00004c4000-0x1000)="24d13d9a803e68e77b5a00cde775943795680a2091fef97f28548239585552171940b6edb5bc0c952e5483ce0ff180d9c002b807c8f9dce8813c2388c3e9a2fafaeb0d240e4362cf393dbb54cd2b68c1db528655aa2c951fac98aeeb0126b904aa7ab031e67e3dd4202468ae51e024f40d892e738ed3c71d0d7cc6ba79bbb6318b26", 0x82, 0x1, &(0x7f0000fb1000)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) recvfrom$inet(r0, &(0x7f000048d000)=""/194, 0xc2, 0x0, &(0x7f0000bf8000)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) sendto(r0, &(0x7f0000cfe000-0xc3)="df", 0x1, 0x0, &(0x7f00006f8000-0x3a)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x3a) sendto$inet(r0, &(0x7f00002ab000)='\'', 0x1, 0x4001, &(0x7f0000f55000)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) 2018/02/04 21:33:29 executing program 7: munmap(&(0x7f0000f72000/0x3000)=nil, 0x3000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000bba000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) clone(0x0, &(0x7f0000598000-0xe4)="a4", &(0x7f00009ba000-0x4), &(0x7f0000006000-0x4), &(0x7f00003e5000)) r0 = open(&(0x7f0000bf6000-0x8)='./file0\x00', 0x200, 0x1) ioctl$DRM_IOCTL_RM_MAP(r0, 0x4018641b, &(0x7f0000ab2000)={&(0x7f0000000000/0x1000)=nil, 0x3da48, 0x2, 0x0, &(0x7f0000d2b000/0x2000)=nil, 0x400}) ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f00009a6000)=""/162) mlock(&(0x7f0000328000/0x3000)=nil, 0x3000) socketpair$inet6(0xa, 0x7, 0x81, &(0x7f00004e1000-0x8)) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000aed000/0x400000)=nil) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000e5c000-0x4), &(0x7f00002af000)=0x4) 2018/02/04 21:33:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000a1f000)='\x00', 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f000051c000)={0x0, 0x6}, &(0x7f0000849000-0x4)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000ce2000)={r1, 0xf87d, 0x75, "5ef558e3a6cdcada273de6f25e3576c60d7949e6e2eee08c1e60262c848a818701a0ca5728b217e42ba061922614fdc5d77cac7fda8a1d556dd291befcfabd6b5b3fa1e0678590b10b2cf10f6dcaa0481d1d690c66a4bd52e7e0b7e889bc7e0d49c16534b3f4d87d946cbfb854a792d310dfe7552e"}, 0x7d) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:29 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x103, 0x7f28}, 0x10) r0 = socket(0x11, 0x4000000000080003, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000abe000)='/selinux/enforce\x00', 0x442000, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f000027e000)={0x4705, 0x1, 0x3, 0x4, 0x5}) ioctl$KVM_S390_UCAS_UNMAP(r1, 0x4018ae51, &(0x7f00006e9000-0xa)={0x4, 0x6, 0x4}) setsockopt(r0, 0x107, 0xd, &(0x7f0000001000), 0x47e) clock_gettime(0x0, &(0x7f0000f32000)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc2c45513, &(0x7f00005e2000-0x4c0)={{0x1, 0x0, 0x63, 0x8, "16d5aa23385a8f68ca2909c9819a65e9c07dfd6e7f49f136e6178d5ffc28fd924b759f10809fa85d5ee3b09d", 0x200}, 0x7, [0xfffffffffffff001, 0x2, 0x4, 0x8, 0x800, 0x9, 0x3, 0x5, 0x3255, 0x5, 0x1, 0x8001, 0x0, 0x9, 0x3, 0x0, 0xa75, 0x0, 0x80000000, 0x8ef, 0x1, 0xf047, 0x7ff, 0x4c50, 0x2, 0x2, 0x1, 0x80000000, 0x2, 0x2, 0x506, 0x6b, 0xffff, 0x8000, 0x200, 0x4, 0x0, 0xb26, 0x100, 0x0, 0x6, 0x0, 0x2, 0x3, 0x80000001, 0x20, 0x1, 0x6, 0x4, 0x1f, 0x2, 0x40, 0x7, 0x40, 0x101, 0x1000, 0x5, 0x179b, 0x8a, 0x1, 0x7, 0x101, 0x20, 0xffffffffffff8477, 0x1, 0x7, 0x8, 0x8, 0x3, 0x6, 0xffff, 0x10000, 0x6, 0xfffffffffffffffd, 0x1, 0x0, 0x3, 0x7, 0x5, 0x9, 0x100000000, 0x3f, 0x8001, 0x0, 0x7, 0x80000001, 0x520a, 0x130, 0x5b, 0x4, 0x0, 0x1, 0x800, 0x7fff, 0x4, 0x7, 0x4, 0xd430, 0x1, 0x8, 0x6, 0x6, 0x7, 0x2, 0x4, 0x4, 0x3d3b41d0, 0x8001, 0x0, 0xfffffffffffffffb, 0xe50, 0x4, 0x6, 0x2, 0xfffffffffffffff8, 0x4, 0x3, 0xff9, 0x7, 0xe77d, 0x1, 0x400, 0x2, 0x5, 0x20, 0x100000001, 0x800, 0x5], {r2, r3+10000000}}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fsetxattr(r0, &(0x7f0000c5d000-0x18)=@known='system.posix_acl_access\x00', &(0x7f0000c26000-0x2)=']\x00', 0x2, 0x1) r4 = syz_open_dev$sndctrl(&(0x7f0000c45000-0x13)='/dev/snd/controlC#\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r4, 0xc2c45512, &(0x7f00002e5000-0x4c0)={{0x1, 0x0, 0x0, 0x0, "0cae5f86df5cbdea48c673861ea716787b0d88de56c81e04f4ff7d5386c5e76f27fe3af40526b9d782bd0502"}}) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000f24000-0x10)=@req={0x10000, 0xb3e, 0x0, 0x49e}, 0xffffffffffffff71) [ 81.872666] binder: 10556:10559 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 81.905623] binder: release 10556:10559 transaction 100 out, still active [ 81.912676] binder: undelivered TRANSACTION_COMPLETE 2018/02/04 21:33:29 executing program 6: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0186404, &(0x7f0000000000)={&(0x7f0000000000/0x1000)=nil, 0x1ff, 0x6, 0x0, &(0x7f000016c000/0x2000)=nil, 0xffff}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) 2018/02/04 21:33:29 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:29 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001000-0xd)='/selinux/mls\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000000)={0x1, 0x1, 0x2d93}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_pts(r1, 0x100) ioctl$TIOCSWINSZ(r2, 0x5414, &(0x7f000091b000)={0x101, 0xba2, 0x6, 0x9}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000d000-0x70)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00006d4000-0xb)='/dev/audio\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000c8f000-0x50)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_mtu=0x7f}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) connect$nfc_raw(r3, &(0x7f0000d69000-0x10)={0x27, 0x80000000, 0x18000000, 0x2}, 0x10) fcntl$setpipe(r3, 0x407, 0x5) poll(&(0x7f0000863000-0x8)=[{r1}], 0x1, 0xceda) mmap$binder(&(0x7f000094c000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) [ 81.917885] binder: send failed reply for transaction 100, target dead 2018/02/04 21:33:29 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000dfa000)='/dev/sequencer\x00', 0x0, 0x0) userfaultfd(0x800) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00005a8000)='/dev/sequencer2\x00', 0x8002, 0x0) r2 = epoll_create1(0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f000001a000-0xc)) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000f9b000), &(0x7f0000b19000)=0x4) ioctl$TCSETA(r1, 0x5402, &(0x7f000032d000-0x14)) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000857000-0x24)={0x8001, 0x7fffffff, 0x200, 0x4, 0x75, 0x9, 0x1f, 0x8000, 0x0, 0x8001, 0x81, 0xa00e}) write$sndseq(r1, &(0x7f000000a000)=[{0x40081, 0x80000006, 0x0, 0x0, @time={0x77359400}, {}, {}, @time=@time}], 0x1c) socket$bt_bnep(0x1f, 0x3, 0x4) 2018/02/04 21:33:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = syz_open_dev$mice(&(0x7f0000580000-0x10)='/dev/input/mice\x00', 0x0, 0x100) ioctl$DRM_IOCTL_INFO_BUFS(r0, 0xc0086418, &(0x7f0000672000-0x18)={0x3, 0x8, 0x50b, 0x0, 0x10, 0xfffffffffffffffb}) [ 81.976989] binder: 10583:10585 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 82.016506] binder: release 10583:10585 transaction 103 out, still active 2018/02/04 21:33:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x14, 0x5, 0x1000, &(0x7f00002b2000)={0x0, 0x0}) ioctl$sock_netrom_SIOCADDRT(r1, 0x890b, &(0x7f0000399000-0x4)) r2 = socket$key(0xf, 0x3, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000eef000)={0x5}, 0x1) sendmsg$key(r2, &(0x7f00003d5000)={0x0, 0x0, &(0x7f000058b000)={&(0x7f0000440000)={0x2, 0x10, 0x0, 0x0, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, {0x6, 0xfffffffffffffffe, 0x0, 0x4, 0x0, 0x0, 0x0, @in6=@local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0xfffffffffffffffc}}}]}, 0xfffffffffffffe8b}, 0x1}, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000f43000)=0x5) 2018/02/04 21:33:29 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getegid() r0 = add_key$keyring(&(0x7f000030e000-0x8)='keyring\x00', &(0x7f0000c68000-0x5)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0x1d, r0, &(0x7f00003a6000-0xb)='asymmetric\x00', 0x0) r1 = syz_open_dev$audion(&(0x7f0000a7d000)='/dev/audio#\x00', 0x20, 0x1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000ad0000-0x6)={0x0, 0x6}, &(0x7f0000c89000)=0x6) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000647000-0x8c)={r2, @in6={{0xa, 0x3, 0x7, @dev={0xfe, 0x80, [], 0x0, 0xe}, 0x37ad}}}, 0x8c) ioctl$TIOCGPTPEER(r1, 0x5441, 0x5) creat(&(0x7f0000d12000-0x8)='./file0\x00', 0x88) syz_open_dev$vcsn(&(0x7f00003fb000)='/dev/vcs#\x00', 0x2000000, 0x0) 2018/02/04 21:33:29 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 82.023546] binder: undelivered TRANSACTION_COMPLETE [ 82.028702] binder: send failed reply for transaction 103, target dead [ 82.038049] binder: 10587:10597 ioctl 80045430 f7712008 returned -22 [ 82.083534] binder: BINDER_SET_CONTEXT_MGR already set [ 82.085493] binder: 10601:10603 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 82.089121] binder: 10587:10604 ioctl 40046207 0 returned -16 [ 82.110790] binder: release 10601:10603 transaction 105 out, still active [ 82.117784] binder: undelivered TRANSACTION_COMPLETE [ 82.122938] binder: send failed reply for transaction 105, target dead [ 82.132230] binder: 10587:10604 transaction failed 29189/-22, size 0-0 line 2842 [ 82.156715] binder: 10587:10608 ioctl 80045430 f76d0008 returned -22 2018/02/04 21:33:29 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt(r0, 0x1, 0x4, &(0x7f000038f000-0x31)=""/49, &(0x7f0000902000-0x4)=0xffffffffffffffa3) pipe2(&(0x7f0000ae1000), 0x80000) 2018/02/04 21:33:29 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f000060d000-0x58)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000403000-0x8d), 0x0) recvmsg(r0, &(0x7f0000606000-0x1c)={&(0x7f00001d2000)=@pppol2tp={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @remote}}}, 0x26, &(0x7f0000303000)=[], 0x0, &(0x7f00008d5000-0x1000)=""/4096, 0x1000, 0x25}, 0x101) recvfrom$ipx(r1, &(0x7f000075e000-0x1d)=""/29, 0x1d, 0x10000, &(0x7f000027c000-0x10)={0x4, 0x1, 0xfffffffffffffffc, "cbff186139b2"}, 0x10) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000c14000-0xc0)=[{{&(0x7f00001d0000)=@rc, 0x9, &(0x7f0000f7d000)=[{&(0x7f0000e8e000-0x42)=""/66, 0x42}], 0x1, &(0x7f0000136000)=""/136, 0x88}}, {{&(0x7f0000504000-0x10)=@ethernet={0x0, @empty}, 0x10, &(0x7f0000c43000)=[], 0x0, &(0x7f00005aa000)=""/153, 0x99}}], 0x2, 0x0, &(0x7f0000546000)={0x77359400}) 2018/02/04 21:33:29 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000f4f000-0x8)='./file0\x00', 0x0) mount(&(0x7f000003b000)='./file0\x00', &(0x7f00005df000)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f0000b7a000)) socketpair(0xa, 0x800, 0x6, &(0x7f0000b32000)={0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f000076e000)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000853000)={{{@in6=@ipv4={[], [], @empty}, @in6=@remote, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@loopback}}, &(0x7f0000255000-0x4)=0xe8) getgroups(0x3, &(0x7f00005c8000-0xc)=[0x0, 0x0, 0xffffffffffffffff]) r4 = socket$inet6(0xa, 0x6, 0x800) r5 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000299000)={0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000a40000)={{{@in=@loopback, @in6=@remote, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast2}}, &(0x7f0000d05000)=0xe8) getgroups(0x3, &(0x7f0000828000-0xc)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]) r9 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000918000)='/selinux/relabel\x00', 0x2, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00002eb000-0x4)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f000001d000)={{{@in6=@mcast1, @in6=@local, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@empty}}, &(0x7f0000bea000-0x4)=0xe8) getresgid(&(0x7f00000da000-0x4), &(0x7f0000419000-0x4), &(0x7f0000412000)=0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000ee6000-0x4)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f000046c000-0xe8)={{{@in6=@remote, @in6=@dev, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@local}}, &(0x7f0000621000-0x4)=0xe8) stat(&(0x7f0000211000)='./file0\x00', &(0x7f0000ac2000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f000025c000)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000283000-0xe8)={{{@in6=@dev, @in=@loopback, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@loopback}}, &(0x7f00004bf000)=0xe8) stat(&(0x7f0000cad000)='./file0\x00', &(0x7f00003af000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r19 = openat$vcs(0xffffffffffffff9c, &(0x7f000040c000)='/dev/vcs\x00', 0x10000, 0x0) r20 = socket$key(0xf, 0x3, 0x2) r21 = socket$vsock_stream(0x28, 0x1, 0x0) socketpair$packet(0x11, 0x3, 0x300, &(0x7f00001f6000)={0x0}) r23 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000f7f000)='/selinux/enforce\x00', 0x2000, 0x0) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000cde000-0x8)={0x0}) r25 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000f03000)='/dev/sequencer\x00', 0x90000, 0x0) r26 = userfaultfd(0x80000) socketpair$inet(0x2, 0x807, 0x7fff, &(0x7f0000ecd000)={0x0}) socketpair$packet(0x11, 0x3, 0x300, &(0x7f00004f2000-0x8)={0x0, 0x0}) r29 = syz_fuseblk_mount(&(0x7f0000fce000-0x8)='./file0\x00', &(0x7f0000a33000-0x8)='./file0\x00', 0xa000, 0x0, 0xffffffffffffffff, 0x40, 0x1, 0x8) r30 = socket$can_raw(0x1d, 0x3, 0x1) socketpair$inet6(0xa, 0x5, 0x2, &(0x7f0000145000-0x8)={0x0, 0x0}) r32 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000580000-0xc)='/dev/rfkill\x00', 0x200, 0x0) r33 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000253000)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f000067a000)={{{@in=@empty, @in=@remote, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@rand_addr}}, &(0x7f0000357000-0x4)=0xe8) stat(&(0x7f0000b91000-0x8)='./file0\x00', &(0x7f0000761000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r37 = syz_open_dev$evdev(&(0x7f00003e2000-0x12)='/dev/input/event#\x00', 0x8, 0x100) r38 = syz_open_dev$sndpcmc(&(0x7f00002f7000)='/dev/snd/pcmC#D#c\x00', 0x6, 0x8040) r39 = syz_fuse_mount(&(0x7f00001d6000-0x8)='./file0\x00', 0xb000, 0xffffffffffffffff, 0xffffffffffffffff, 0x9, 0x4000) r40 = inotify_init() r41 = openat$hwrng(0xffffffffffffff9c, &(0x7f00004e6000)='/dev/hwrng\x00', 0x0, 0x0) r42 = eventfd2(0x800, 0x1) r43 = syz_open_dev$sndseq(&(0x7f00008f2000)='/dev/snd/seq\x00', 0x0, 0x8000) r44 = socket$inet_udp(0x2, 0x2, 0x0) r45 = epoll_create(0x8) socketpair$llc(0x1a, 0x3, 0x0, &(0x7f0000070000-0x8)={0x0}) socketpair(0x3, 0x2, 0x1f, &(0x7f0000968000)={0x0}) r48 = syz_open_dev$sndmidi(&(0x7f000032b000)='/dev/snd/midiC#D#\x00', 0x100000000, 0x400) socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000e89000)={0x0, 0x0}) socketpair$llc(0x1a, 0x3, 0x0, &(0x7f0000169000-0x8)={0x0, 0x0}) r51 = socket$bt_hci(0x1f, 0x3, 0x1) r52 = getpgid(0xffffffffffffffff) stat(&(0x7f00004d7000)='./file0\x00', &(0x7f0000806000)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x9, &(0x7f000056c000)=[0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff]) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000601000)={0x0, 0x0}) socketpair$ax25(0x3, 0x7, 0x0, &(0x7f00009fa000-0x8)={0x0}) r57 = openat(0xffffffffffffff9c, &(0x7f00007cc000)='./file0\x00', 0x240000, 0x21) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000e8e000)={0x0}) r59 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000648000)='/selinux/policy\x00', 0x0, 0x0) r60 = socket$nl_crypto(0x10, 0x3, 0x15) r61 = syz_open_dev$random(&(0x7f00005b7000)='/dev/random\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000496000)={0x0}, &(0x7f0000f14000)=0xc) r63 = getuid() stat(&(0x7f00001ee000-0x8)='./file0\x00', &(0x7f000021d000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r65 = getpid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000438000-0xe8)={{{@in=@remote, @in6=@mcast2, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@empty}}, &(0x7f0000212000)=0xe8) r67 = getgid() r68 = openat$audio(0xffffffffffffff9c, &(0x7f0000ddf000)='/dev/audio\x00', 0x280100, 0x0) r69 = syz_open_dev$dspn(&(0x7f0000633000)='/dev/dsp#\x00', 0x2, 0x0) r70 = socket$nl_xfrm(0x10, 0x3, 0x6) r71 = socket$l2tp(0x18, 0x1, 0x1) socketpair$inet_sctp(0x2, 0x1, 0x84, &(0x7f00006ea000-0x8)={0x0, 0x0}) r73 = socket$inet6_sctp(0xa, 0x5, 0x84) r74 = openat$vsock(0xffffffffffffff9c, &(0x7f0000fac000)='/dev/vhost-vsock\x00', 0x2, 0x0) r75 = socket$inet_udp(0x2, 0x2, 0x0) pipe2(&(0x7f00000b6000)={0x0}, 0x80800) r77 = getpgid(0x0) r78 = geteuid() lstat(&(0x7f0000010000-0x8)='./file0\x00', &(0x7f00002fa000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r80 = getpgrp(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f000005d000)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000cef000-0xc)={0x0, 0x0, 0x0}, &(0x7f0000558000)=0xc) r83 = socket$netlink(0x10, 0x3, 0x8) r84 = openat$audio(0xffffffffffffff9c, &(0x7f0000336000-0xb)='/dev/audio\x00', 0x40000, 0x0) r85 = memfd_create(&(0x7f00003bf000-0x1b)=':]nodevkeyringmd5sum}wlan1\x00', 0x3) r86 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000362000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r87 = syz_open_dev$vcsn(&(0x7f000098c000-0xa)='/dev/vcs#\x00', 0x9, 0x4000) r88 = accept4$nfc_llcp(0xffffffffffffff9c, &(0x7f00001a9000-0x58), &(0x7f00004ff000-0x4)=0x58, 0x800) socketpair$inet_icmp(0x2, 0x2, 0x1, &(0x7f000028b000)={0x0, 0x0}) r90 = syz_fuse_mount(&(0x7f000031c000)='./file0\x00', 0x6002, 0xffffffffffffffff, 0x0, 0x2, 0x20) r91 = syz_open_dev$sndtimer(&(0x7f000019b000-0xf)='/dev/snd/timer\x00', 0x0, 0x400) r92 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000fb6000-0x15)='/proc/self/net/pfkey\x00', 0x200000, 0x0) r93 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00009f2000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r94 = socket$rds(0x15, 0x5, 0x0) r95 = bpf$PROG_LOAD(0x5, &(0x7f000048a000-0x48)={0xf, 0x14, &(0x7f0000d8a000-0xa0)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x5}, @ldst={0x1, 0x2, 0x0, 0x7, 0x3, 0x0, 0xc}, @initr0={0x18, 0x0, 0x0, 0x0, 0xf624, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, @generic={0x10000, 0x4, 0x10001, 0x8}, @alu={0x0, 0xa1d, 0xf, 0x0, 0x3, 0x1, 0x1}, @call={0x85, 0x0, 0x0, 0x34}, @call={0x85, 0x0, 0x0, 0x7}, @exit={0x95}, @generic={0x9, 0x80000000, 0x2, 0x10001}, @call={0x85, 0x0, 0x0, 0x31}], &(0x7f00006cc000-0x4)='GPL\x00', 0x7, 0xae, &(0x7f0000e89000-0xae)=""/174, 0x41100, 0x1}, 0x48) r96 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000765000-0xc)={0x0, 0x6, 0x10}, 0xc) r97 = timerfd_create(0x7, 0x80800) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000c7e000-0xa)={0x0, 0x80000, 0xffffffffffffff9c}) r99 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000dd2000-0xe)='/selinux/user\x00', 0x2, 0x0) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f000049a000-0x8)={0x0}) r101 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000d8d000-0x10)='/dev/sequencer2\x00', 0x60000, 0x0) r102 = dup(0xffffffffffffff9c) r103 = syz_fuseblk_mount(&(0x7f00005e6000)='./file0\x00', &(0x7f000096f000-0x8)='./file0\x00', 0xf000, 0xffffffffffffffff, 0xffffffffffffffff, 0x81, 0x80000000, 0x800) r104 = bpf$PROG_LOAD(0x5, &(0x7f0000545000-0x48)={0xc, 0x11, &(0x7f0000c60000-0x88)=@framed={{0x18, 0x0, 0x0, 0x0, 0x28bd, 0x0, 0x0, 0x0, 0x10001}, [@call={0x85, 0x0, 0x0, 0x11}, @exit={0x95}, @call={0x85, 0x0, 0x0, 0x22}, @exit={0x95}, @exit={0x95}, @initr0={0x18, 0x0, 0x0, 0x0, 0x9}, @generic={0x1000, 0xffffffff, 0x100000001, 0x1f}], {0x95}}, &(0x7f0000c33000-0xa)='syzkaller\x00', 0x4, 0x88, &(0x7f0000223000-0x88)=""/136, 0x41f00, 0x1}, 0x48) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f000032b000-0x4)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00004ff000-0xe8)={{{@in6=@mcast1, @in6=@mcast2, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000684000-0x4)=0xe8) getresgid(&(0x7f00007e8000-0x4), &(0x7f00000a4000-0x4)=0x0, &(0x7f00002e4000)) r108 = gettid() fstat(0xffffffffffffff9c, &(0x7f00008a9000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000ad5000)=0x0, &(0x7f000039b000), &(0x7f0000f6a000-0x4)) r111 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000abd000)='/selinux/checkreqprot\x00', 0x125480, 0x0) r112 = socket$inet6_icmp(0xa, 0x2, 0x3a) r113 = getpid() r114 = getuid() getgroups(0x2, &(0x7f00000ff000)=[0x0, 0xffffffffffffffff]) r116 = getpgrp(0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00008d3000)={{{@in=@multicast1, @in6=@empty, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000bf9000-0x4)=0xe8) stat(&(0x7f0000697000)='./file0\x00', &(0x7f0000ba1000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r119 = openat$cuse(0xffffffffffffff9c, &(0x7f00006a5000-0xa)='/dev/cuse\x00', 0x2, 0x0) r120 = socket$llc(0x1a, 0x3, 0x0) socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000581000-0x8)={0x0, 0x0}) r122 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000fb6000)='/selinux/member\x00', 0x2, 0x0) r123 = syz_fuse_mount(&(0x7f00004f6000-0x8)='./file0\x00', 0x4000, 0xffffffffffffffff, 0xffffffffffffffff, 0x6e72a0d1, 0x2000) r124 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000bdd000)='/proc/self/net/pfkey\x00', 0x200000, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffff9c, 0xc00c642d, &(0x7f0000297000)={0x0, 0x80000, 0xffffffffffffffff}) r126 = socket$can_bcm(0x1d, 0x2, 0x2) r127 = gettid() r128 = geteuid() getresgid(&(0x7f000003d000), &(0x7f00009b0000), &(0x7f0000d03000)=0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f000091d000-0x8)={0x0, 0x0}) r131 = geteuid() getresgid(&(0x7f0000ffd000-0x4), &(0x7f000029b000-0x4), &(0x7f00008f8000)=0x0) r133 = syz_open_procfs(0x0, &(0x7f000093c000)='ns/uts\x00') ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000512000-0x18)={0xc3, 0x1c, 0x1, 0xffffffffffffff9c}) r135 = socket$bt_hci(0x1f, 0x3, 0x1) r136 = syz_open_dev$sndmidi(&(0x7f000099b000-0x12)='/dev/snd/midiC#D#\x00', 0x3, 0x2280) r137 = socket$vsock_stream(0x28, 0x1, 0x0) r138 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00007fb000-0x11)='/dev/vga_arbiter\x00', 0x101000, 0x0) r139 = inotify_init1(0x80000) r140 = openat$vcs(0xffffffffffffff9c, &(0x7f0000e17000-0x9)='/dev/vcs\x00', 0x881, 0x0) r141 = socket$bt_l2cap(0x1f, 0x2, 0x0) r142 = syz_open_dev$sndtimer(&(0x7f0000d48000-0xf)='/dev/snd/timer\x00', 0x0, 0x220101) r143 = socket$rds(0x15, 0x5, 0x0) r144 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) r145 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f000051e000)={0xffffffffffffffff}) r147 = getpgrp(0x0) getresuid(&(0x7f00005a4000-0x4), &(0x7f00008ac000), &(0x7f0000880000)=0x0) getresgid(&(0x7f0000215000), &(0x7f00008e8000), &(0x7f0000e1c000-0x4)=0x0) r150 = bpf$MAP_CREATE(0x0, &(0x7f0000951000)={0x2f973bc1141bcb4b, 0x7cf2, 0x1, 0x2, 0x0, 0x0, 0x401}, 0x2c) r151 = getpgrp(0x0) getresuid(&(0x7f0000d61000), &(0x7f0000fe4000), &(0x7f000021f000)=0x0) r153 = getegid() r154 = open(&(0x7f0000bc7000-0x8)='./file0\x00', 0x800, 0x150) r155 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000665000-0xb)='/dev/hwrng\x00', 0x420000, 0x0) r156 = socket$bt_sco(0x1f, 0x5, 0x2) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000f80000-0x8)={0x0}) r158 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00006a9000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r159 = syz_open_dev$vcsa(&(0x7f000015f000-0xb)='/dev/vcsa#\x00', 0x3, 0x44800) r160 = openat$vnet(0xffffffffffffff9c, &(0x7f0000378000)='/dev/vhost-net\x00', 0x2, 0x0) r161 = syz_open_procfs(0x0, &(0x7f00008e1000-0xb)='net/rfcomm\x00') r162 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) socketpair$inet6_sctp(0xa, 0x1, 0x84, &(0x7f0000e94000)={0x0}) r164 = openat$rtc(0xffffffffffffff9c, &(0x7f0000d33000)='/dev/rtc\x00', 0x100, 0x0) r165 = fcntl$getown(0xffffffffffffff9c, 0x9) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000692000)={{{@in=@multicast1, @in6=@loopback, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@broadcast}}, &(0x7f000053b000-0x4)=0xe8) r167 = getegid() r168 = accept4$inet(0xffffffffffffffff, &(0x7f0000235000-0x10)={0x0, 0xffffffffffffffff, @loopback}, &(0x7f0000448000)=0x10, 0x800) socketpair(0x2, 0x6, 0x9, &(0x7f0000010000)={0x0}) r170 = syz_open_dev$mouse(&(0x7f000006d000)='/dev/input/mouse#\x00', 0x8, 0x610401) r171 = socket$inet6_dccp(0xa, 0x6, 0x0) r172 = syz_open_dev$audion(&(0x7f00007e2000-0xc)='/dev/audio#\x00', 0x1, 0x2000) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000edc000)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000380000)={{{@in=@multicast2, @in6=@remote, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f0000fee000-0x4)=0xe8) lstat(&(0x7f0000a98000)='./file0\x00', &(0x7f00008c1000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r176 = openat$dsp(0xffffffffffffff9c, &(0x7f00009bf000)='/dev/dsp\x00', 0x80, 0x0) r177 = memfd_create(&(0x7f000090a000-0x6)='ramfs\x00', 0x2) r178 = mq_open(&(0x7f0000aad000-0x6)='ramfs\x00', 0x882, 0x4, &(0x7f0000a78000-0x20)={0x8, 0x9, 0x81, 0x6c, 0x8000, 0xd6, 0x8, 0x5}) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000654000)=0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000a4e000)={0x0, 0x0}, &(0x7f00008b5000-0x4)=0xc) getresgid(&(0x7f0000d62000-0x4), &(0x7f000049e000-0x4), &(0x7f0000711000)=0x0) sendmmsg$unix(r0, &(0x7f00001fe000-0x118)=[{&(0x7f0000e7d000)=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000454000)=[{&(0x7f00008ff000)="84e7ac92f8901b4a", 0x8}, {&(0x7f00002c8000)="dc7a8ef579f2bcd96f104b195b8c40ac64e3821d35dc5adb56dfba033a5fce81c552e36cd7b75644869afb0059b77734d6419dbb3b561c4110440e5dbb261930751628396783f99d57da60cfec5c00b51e6338277b853c044b2ae026e6f1020099728b2cbd942f54bd4b8ff95544fff39709132952858cd0c298242b858fbe53de39cc0c5f8b6518dd670b9c5e4ba20185824e7faa2a0f4f39bd2f4196c5d4e6c723eb970c92df65b94b27ba73005b", 0xaf}], 0x2, &(0x7f0000d1f000-0x54)=[@cred={0x18, 0x1, 0x2, r1, r2, r3}, @rights={0x14, 0x1, 0x1, [r4, r5]}, @cred={0x18, 0x1, 0x2, r6, r7, r8}, @rights={0x10, 0x1, 0x1, [r9]}], 0x54, 0x81}, {&(0x7f000077b000-0xa)=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000d8d000)=[{&(0x7f00005eb000-0xd)="28404124bd1627406f4ad1c77d", 0xd}, {&(0x7f00001c3000)="d6bcc0b9249fca15fb139fc166d1738f915ce3d5427b3930b9c815b997e979a6cc2796c3cdfbd1cc0ce1400bfb72b949a4e99766aed4f20d1caa5072b80d992c9322db254367e526b9bd13977dd93640fcc312baa9dd8144e3402312e35581f609bbf93cec", 0x65}, {&(0x7f0000069000)="ab6af5b40d4cff19b96908c7517ec6d24c8ada2413bcbf93a9370d2894ec1e300e97183106551b2320b5c5395ab9991aa4aca6cc7dacf7f217d09604be8d44609b8d12f5e882d34cbb83d2af477c26a89481246c296dd5423ed98a135c3b6957fa93f24def039e16c6146cc2edb962bfb85e9814e2e1c936fbc8175a838ed78b5e4b3b470387b7cc14fa3c5350dd87519939e7ca02af5170d672b3811cafb5499b3c897015684490c0fb18f3209068df7f7778bd15fa2a8d5d3c8cbab00f7257835110b42b89", 0xc6}, {&(0x7f0000109000)}, {&(0x7f0000a09000-0x1b)="a88ff510102304b884c2ae8a107055d2ccf8f412e5577448c21646", 0x1b}, {&(0x7f0000c1e000)="2bad2df38b8bbd67fea8d1184ef66975976f26438e2ee67fcbaa25f6c2f8d30af55accebb40bb617b4aac8d7001551f7b4ea734c7aeed540fce20f5b0f09c71b29f796c0a142de93b62019de166c278002f2246f0f0fcec19a2c3862203cf75c4fe6e218a570a9aea97040c5d31a5a82207d2b178615e3cbc576e7af6283cd3687807d75f1d12088b88596ebb597effb1b060633b2dd58aab2333e4425def774d01d9fa955879c3f019eb3a346394479fc113a99121a1f71abe85312333c556fd4d2ef993dba715133ce8f9b91ae4c99", 0xd0}, {&(0x7f00002cd000-0xc8)="dbc567afd8cb33e9d6e6385c0751ad775ba6e5f3ebf4efeba22a29d1cf3634ce3a2cf9f40c80518e7702e706095ae8a2172d6c62e05c6392380650a29f3dbf506e60ffe337d98be063b0015f1116f36b24f1b37a9d7731d80304ce7daea471d44c7164eba7b7e581518709044e16076e551319a8e209c81923a045f45f379383b3fd87713765fc1e397e0ad683e82d2b094bba93b2b56429cba6ec105c33e2325ed9b175faee069820a535a63339eaab304df1f4596306df701ae5678dd698981186e5c2123f3006", 0xc8}, {&(0x7f0000a69000)="fe26c9aeeeaf70c082a4c06b0a6ab89f72f5100a6fef491ada4bdaba68e5267e0fdc51f4a9850824bd692dcf47bcc4d68daf04cedd132188f25a490de5ade65c1862c3a4ddc23366a2bf4821227f5f8f09798c56e23844c97b4085db11f3d37f88a4a4ace07b10bc359b29b48b571b729f79621346608371c44212af7f0db799674cadabedba93474be264b5c1b58b9b01ceef76da9aa6e45a66f4ac93c38dbfc7758dd0331276b8283b531d80fe17336e7b", 0xb2}, {&(0x7f00005de000-0xf)="61a20c02f4cbf22252c21e401bfb2f", 0xf}, {&(0x7f0000e06000-0xaf)="167afcc7775b11881764b8a9775dfcd69c47dd47e7ede8758e5c3ed2ef1ce917591f1a80b4d981714ad403b5730fa78c43ddfe4d77db76a43d06dbf0559c2ddb4689ec08c20df48b491be8d3e1bf9b1cbaf14cd144e29fbfb4df2f0feef5a65cdae6113d0525bf1dba206db78640376356c83939c75fd08c8663aa0d3e89494428ebb41a0ef6ba6d561000778c80b7bdf23f1e09e49016cb5881ece80fb584ffd7222d6d92a3c41657c8ce23ef71f0", 0xaf}], 0xa, &(0x7f0000c6e000)=[@cred={0x18, 0x1, 0x2, r10, r11, r12}, @cred={0x18, 0x1, 0x2, r13, r14, r15}, @cred={0x18, 0x1, 0x2, r16, r17, r18}, @rights={0x34, 0x1, 0x1, [r19, r20, r21, r22, r23, r24, r25, r26, r27, r28]}, @rights={0x20, 0x1, 0x1, [r29, r30, r31, r32, r33]}, @cred={0x18, 0x1, 0x2, r34, r35, r36}, @rights={0x20, 0x1, 0x1, [r37, r38, r39, r40, r41]}], 0xd4, 0x8000}, {&(0x7f00007e4000-0xa)=@file={0x0, './file1\x00'}, 0xa, &(0x7f0000003000)=[], 0x0, 0x0, 0x0, 0x1}, {&(0x7f000084e000)=@abs={0x0, 0x0, 0x1}, 0x8, &(0x7f000078a000)=[{&(0x7f0000983000)="9ab242b7", 0x4}], 0x1, &(0x7f0000d19000-0xb0)=[@rights={0x34, 0x1, 0x1, [r42, r43, r44, r45, r46, r47, r48, r49, r50, r51]}, @rights={0xc, 0x1, 0x1, []}, @cred={0x18, 0x1, 0x2, r52, r53, r54}, @rights={0x28, 0x1, 0x1, [r55, r56, r57, r58, r59, r60, r61]}, @cred={0x18, 0x1, 0x2, r62, r63, r64}, @cred={0x18, 0x1, 0x2, r65, r66, r67}], 0xb0, 0x40840}, {&(0x7f00001a5000-0xa)=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000d4d000)=[], 0x0, &(0x7f000030b000-0xa0)=[@rights={0x20, 0x1, 0x1, [r68, r69, r70, r71, r72]}, @rights={0x1c, 0x1, 0x1, [r73, r74, r75, r76]}, @cred={0x18, 0x1, 0x2, r77, r78, r79}, @cred={0x18, 0x1, 0x2, r80, r81, r82}, @rights={0x18, 0x1, 0x1, [r83, r84, r85]}, @rights={0x1c, 0x1, 0x1, [r86, r87, r88, r89]}], 0xa0, 0x10}, {&(0x7f0000717000-0xa)=@file={0x0, './file0\x00'}, 0xa, &(0x7f0000b9e000-0x30)=[{&(0x7f0000c4d000)="284c89148cecb058e08aa2295725c07dc0555d1c17198f4b9f771d002f12ce194f1e5af19288cbc3f64fdeaa62ffc41bb97016ba48e2b2b032381367330499bbf556ad0f8c4db3579811d8a43bc1b51f299439250d42a25180f24d1ececc322d0252bbe405a6bcf1c390de16d9583f2a55f2318f57df5ef12385570ee18af1a2db915eddc9c4ab2bff23ee9dfeb685f73ea58c3a95182cd0f03967cd61ad1452813f53161c7174334a4c4d", 0xab}, {&(0x7f0000826000-0xb8)="a10657bcfbccfd99243da45afb5df154f06a7004e6e0a567a68a964578a208c596311af409ea6fb2f694e8e8d5cfbe6c4f53480f28e8aa328c990e25eb030638e4461b08f88975dcf66f08d089e730b698d25b17d30f220fe7b0c96d763c6a2e16502dd5902c4d082efa74337125714bf2f8f8fb8615d98589b120cd06006df020e31eb8d29d5446f5329d0356d6c090a3e9b85067ae5db90af1d3f8cd6b6021c471e20b39e8fa0ab9133d8ceddd1748eb9d4b45fff37519", 0xb8}, {&(0x7f0000dcb000)="731252bdb909348bfc4265631ae343565255eb5f76d58492eb6abc846e8aaeb146f4470df7d39d750a5916c25a3c369eecd67f242511aa80bedfb8d6d4b4a5e338ecdc8715b3ff3846d11ae437b6d971082c568c06ac76543b1cbf694b3cac6a5be6d04c85e87c5fb4828ba764972fee85c12eaee0239c41d179c77eee5dd532198d9d171676e497ad33750d24047f7be101cac9f32cac166d3648d7eaa42b09d9a4a0581c0a7dbcd8ea9f6b3f0995a544691d061709ea3fe15ba881371bee44ec3418da430592ba745ab02bb18e81a7840acb911ed0892fcd945fdcbd5112b3d53c357163d48051ba39c96502fde64c17896d4d856ff7ea41db955c3d94b1ad5ad79e48ba635f8e3e1490f944529bb449c331acae4b92004ff291430e7de208710cc60119bfb837431ea3d0eca28f476c3c4bf41d842150cda36aee6695feebbe166ab94932534dd13fd205f5a381d7113b3e986c1a59bb290961f8fa100f189c5e1f881c5e8bd4465ea216772dc79e0d36782f2a4fad278ab3a57a44634db5e6c367bae8753cc911c1b22f4c500aea849accf12e32e759cbf87fc2e6d5e89a3483082285eef9aaaf9273ec31e6011d5dc90e105d02ea22237f7436b0b8ab9d6bdb9a37fa20f359f2d8f0906a0ceaacb03c8760ea6ced3cec01f4be509d9287e06951e69a1659fe0bc30367ad473943696d0f908936e4a360a1e992d37939507b2dd99b23169b45f26fd5098fafba23f84dd0974440783914c7c6b1c64b5308a469a64f6580e9e64645242f466453a39815f57e52816e15f14d0f77c9ba0ef06931ad2dff566c1b5a86b7a87a54721534aab3b6ff4925c867ad83f48edbd2f4ea63f9f7a1a1a656fe8e6d7cdb3e66616e88be965ea0f1773f02e310a126de0d9354436f02c7c5b881a07600b67b023a8b65e78ccc93f5faa8ca9787e4f23443d66122e2a42e6a2e2ae5dcb678bf47f0c68b0f0fcefc4334c66efbbf29de515d032e1694f9d9619fa4af26d9cde0a7305f99897a5b9761c5d3ba57dfee403e03394e549ed7cf039a6f610e18c2cf197389ab324413462cc735549aee0cd85112e70ac62b9b06f3bc8d000d299c681e7eba9934f1a40d567ca09af10c257df3a7571127149cd6fbed93c4f2774048f3d71370fbc420eeafb67aa622e281591829e0ce875953d2d3284ebab21275b0072579d67f339cf641aef7efe2f43d2c01cdedd3f36d195ed864ddf8a7c747298f1bb81c10a84333a1f54890d27bf9be47d76d3489d75516d83495e3d2d0b3306e4b49de4860f42318925beb8fdd95b467c150f61f31bf1fe0c73a7ad08c2b65c9457f14f98efdfee994388cded7c688d8e34ee6132c6e5ad08993688473ecf07d5e937c5d40e4a701ec534a296b3c1b968df4c65371f09760738686e9a32ff92ac39e063f83d1be28ce92ef23f5eeab6a4df792cdb8330cf0dc59a841ccd50ef5aedcf61b232e8628163b0136bee14705895954d02e1198674855902b5b19102aa4e4df7112808912e7ee87824315d2d0d341645795db7aedbb7a7e0dcf2aba9c8296ef5e1090377633ca384d858baf0182535372a24a373b331dccf971a4f750fa1abd6a37ae9297ec2ba3a96e129a3234855e6c75282c1ae83a6dbf18df4d62dfed63b3dc59c32bc981a55b9b8ac120d77cf70b47b7603f731812930a3208ca9b6b04ac1e7ae4e84875bd6f5f67fd5ab4a8780c9b2fa354e823a508b9152ce9466b0c7c71cd5fd1108c77792699cbfd10b3d7ec6008a95f828cc94adfe63e5521f3db522005e692083d1e0ece95643c0025c1e8e4b13ced53b46ea59cb4359c30d807a29bb47741b74a54676aab266bf9dcf28a15fc9025cdc562da049e89786523e3cf2cc6725e3a02ac6f1a9b571364f2397e48e184238249fda045132e46597e74a96adc08412210156c1aa77bcd838c5c1afa1683f40334d761e9eea92dbb1b874517afa1b4dcce0ed91fef989fa80b42d1060da97f2ab01e1be9b6067245a481238c63d8e3948e5c4f4171f87642ad74bc06ae2ceb7a8334b7d04c91e79aadfb2ba83ef80f3763fb07d03633d6b76f5f71c67c5249c6401d85b688f71912d1b8204fced1999d78f52002785d04577bf5e4d187a59467f35e472d56071647effc38e084213bbb6e1ca7e0944dffa518120c113fe6adcd830eab39335fa9bc151f4fe5e29bd125df92456b258c19eb17eb3310f58500d420cfc8535b2885fe763a336fbcfe7c7918eecd161f34166c2b7754c0c426e5e4c1ec509f13c51bb26b32bc50070953b6716df28ef17d7c3dec4b2ddd76cde59bcb51e142289d29a979a77f49803f9a2f056a964330f433870fecb656b016e9096df96af22f1a3c84877d54529020916eb2336130bc87d9b3a9fb16ff0651945d139c2b79fc0d7a0d310c844d3e2560b6b2d1ba437f4d143aee1f9d75df7a2c2c035d6dacc8872ef174d9962058143f746ae98b9850bb2b9f713d2d497ce9b9d40a380e004fda3cf1bb2ed13e95b36f160c4efad2ef77de923efb43f041c39454ce0226d9e95ee96ba9c43187f6282e238bf26e13378e14523421ba7f893783f4cae84c5b980ed385f8935d0070c7968c4b99f5611e593938d5629a3c181b80094263ceb45574560a487e975aa6572f2303d0bbe60350c6417354166e8cf45c0724170aa7c48dae54458ee7e254b7852ff032bc8c689397069c04bc7cd9a60d5f92df6f35cca959566adf197cc90e51ecb6dd13054a427f2fbd06c636d6b3a3db6b5279745f03e058285366f3084873a47280b6d3f5c99106694c079bd03229948d14baa8edad082fc133364c169356fa3bdd7c5d44682f393446e0a4c9d73fef9385d3429ec300cf2094ca91225f7d47305a7980f9c61dea667835806b812df34ac41f4663d6128c8e6aa382e850faf84fd6d35d0dbf1558cb1b8aaeda3fef6e4010a9f70a51a0e50b5570895023d4fbe9ebeac5b89d664e7add64e5a5042e89eb92c74c6935a028340e431e5d54d7ef25ea436202551a6f1d548fd7405424b232ae0aee45ad0cdb60c33af9095d193b9a6a832f34de79c540789fdd67548ca5ffb88618b5ee920d41cf73797b561f254e60f68f6ae31584cdbfa0dda3aef213d9067c27cb66f5ea627a56cd3f2a6a15495ee16af2db40cda45530dcc1ede33ef654c2df711f730baee99587db6a612eff2457ea9c2034181c778ae663009dc4f3a5cfab7781ecb7b7889970c55b46f123f5b68fc97876aacb3794d0e3b6bd90e45cd4758d73d34ef7ebc573a6cc37e0c405079e93771101ac2cdf82fc147dfe55bc829be43bb18a32613be2c219b45958cca8fab235f01123399fec7209f7df34f8ec39a0f58f217d4c1cfa98151a3bd8e665b6c448c8df2378fe84e2f2a8a5f14bc42cc1ecc1c3334edc86ff6e78b0a5a0c1417d5a0041fc1a42c3308d51e424e6c51b3e076371589d7810a4fde1d83ff51aa571ef276870db0c8c95fb5f62881c154c04c1ed5d0265194635d2d2f6e394ed807791a7693e78e9e2c29c318e2c5305a5f8a02f865c8b378494461dd371b3e02b720825100f6b666f2ee9caf40e6f592494f6779ef735f453f5b4ed53a107ab19eef7b1aabd7dbe6f246837b1439c6a1593aad09efd312b9c18565b2f119a30c93e1f793d9bfe8696a5cf60c5f47eadf44b9ca7d235e378f616530eb8dbd11ac7041375e5d1120605ba010848de2b0e47bdb20410a6edcbc14cf051283aad78e5ffbde0f599b2cd877bc60865fff72dc88dd7d45649c7fae7d4ddeaf87bc4a8d1ecd7458cdebefdb6c6eeddb8c04e97cb921d400c976ca493e604893bd00eac7eb9a456de4fbd831e15d287cc6a064183da12185c76b3fa69e06cea844ccc7f17a21e300ab2923c599b5a8505a4ed83322e846c082c7871f240dcd8ccf9af833984716570fefb699fd821ec1c8bf8cb9619051667e083e4e1c54d0e185405fec307aa7a455e98139702e8c8c65a1e2e7680e3e11325134afe998e7d801024075cf0d37774f42d0eec8afc955283d379a2e8b22a28273086620007fd60e94c694a1580b4c34abfcadcf7b417025dab7c9149f1ca2c6e6a83cc6100f32c3d95bbd8bf345cd0483abeae78098135850e220658d30bd7e05f257354b3a6cc6a0796c0409ed981822949f7fb51db3fb5fe5f8d0d9d6177ee1aa1c0cf7b47358569484900832f63463659169ddde4bd33bc474c7348c6d42b6bb71b342f0d60b3cfbd06cca3f13bd57437dc5c8911dcd010f9400463e164598f193bc8130a2aa6652f008d2fc568236f3ca17f92c0fcb2becbc241e7e3be0e770c0d9dbaf92c11a69d3c85416e8642ec0f79dd25af973569510284f5077daa77de4869d4deab5b479ea607274c208c0ef50d9acb1daad415ca00fc205ad4002bb1a233a7cf070564feecaa0ec23a938ea0b44bcbfb0bcf4271fd408c1facf93f13bf91e407b80a09c56b89fb9b88a92ddaa73598b236c8a7aa4e828fd3590173d7d705d33892d0b5d86125d211a6d667f5ca43b4789b4a18fce25ce8710e64fb20604a0a0ab711cfc664a18383338af51f5cc1d8c3266193b006fc0594d65111f7a506ee061e6aaca24709533e6086f8f333e23c950d58e0984adea1fa3b03d05b0cb946818da079e2e61749efc0225645df2aa5cbca783d30c21ecd3b5cd5c70223a609ce910a5e3d846797c5327b919621e0248664325329784e9d9de4393c55f0e5c8aafc64b481f320b4ffba0fe6d179a2eeda8299de7acd2a74307998fe0036e972981659574f4e71629158d06aca8ac31fc35bffd1fb18f2c175a2bd777065025ae45011ce0579a7bbd27d440cd615a759aa62d6397f454e6a0fc09bf42b7436b318c25bd0049b22fa04c7870f5f61d39b26bc654a58c11350fb38d75dcaf5d2401561e8b363116211acbbce2fd71714620d68628e610f556caff19e0dc1805db40400bb1d6c6f3a59d5dc110fc06fae87248b2c8db2fb1b152b1ebfac6c47e789080015eea0d9e8b7227c644dc7575e9586368b0006ef8479c0dddbc416145a72da5033c18731454d3082922edd9f008ac6014e52abb0cc2d6cf09e33adca51ee853934f05af61b40d972597119b179f7a47a0d5ef48557021858492822998cac1980e7c8de07fcf0dc53e8d5a080c8aa6f4ad52419903655219fd0dc776744bc4bd5019d0d80596047b88ecdf14e8bb2f21aba63d08a6eaf387cf4225540ea850405aa75df876c9b8a9bce9102c640535decd826d001bb7cce05f238b29309a2a22b21633702cfd68a8ec6771215c1cd4ce5a459b0a49e81bda5fbe2ee69fb1c1b187127f9ea0af0f4591e78b4f6190febcda8666beeff0eb3d64fe8e6c543e719f54005eed7ce2cbc0286b477affc5f24521911d1fdc159c6877885ad1262684d98055164a77207ac4bd3fa20d8ec1e993ce4e4c88437d92381948ad4e48e07a930aef09ab4040a8df2e991678f06e6fcdd19cc3a3897167bdc42b57dd2f8fb8445f4ef440ccf46c33baf8f084d3e587792be188afdd5384cb21aeaf84789963b79a912a98028fb889d3166fd588ccb207e292a165c1ef64581f4e4bdd61735ae56ce3b56f13f6e6a4863c69cf72fc4089ee424420afb9d142399cfc7eb39d86ab643287542644dd59e6fbcc276b3cdfda2fc1c7c29c44578480637dd146fa51e5db3aad2586071ff01b2d1f796c2a67ff251f06c485419b18f4e4aeceba931d2479dac028ee803d53ae6af4aba6169a37f4098c60227c964945f50aa49f011c10d067c23330e6e1595", 0x1000}, {&(0x7f0000a05000)="70d1af266661b91422f84a58947b7d8df11f5559505403dd0cb6359154fa836bb392d5be60ebb5ca30294c9e56d84e180fe711ccbaa623f0b992e029090ddc687e311045fadfc88590249effc5a363bf19a9ab54454ad04a05badfe1f88af9d1509889cb55c375ae94ec26d0de314e471105546f", 0x74}, {&(0x7f0000cea000-0xf8)="689ef20e9637cebbb0bbb4c3c1aef357c7b371855f28a44845f066c32c3ffad8f0fdf83a509095a82340db5db8ab9785eca57ae7240632ffa3fe3f0a9dd58a0cfd0715f78569c662c0d8c08334410898edf4240712e11bc6ac29673178d9e3dfb5802150112c3f071daa6d6eaebe0bb708c8729842535c0495c5e3779b96d8b2582b0c71666b173cf66666b721c2b5cc141077a4b997df908842d720506caa087c17c20d8b948d78bec7bbc53f531190e3051e781a3d6a85a8d3dbac38b9e28632b0011605d4ae3d6100229db8687db6410b65d71c7045b5163762a9a252d031dbf799209d908158558e8f1cca81a96e874e69b5dc18007a", 0xf8}, {&(0x7f0000d60000)="803b87d6b8386d383543ef1f21a9bcb84818d4ab5470e08e325300a4abf9cf91f5b793764379d29e811cda0308f1c00177478a0ae7f081da27d121cd5384dde1a720221d0c783fb0d1537ecc295667bccbcf8df2ebd3ce9c9e75b88e14177574af72e151bac0ff41a62464904daa3b7376f8024f50e93c4a05a9be61d2e2b0120be0557784350ef5215aa692e25fa160dc51fa5f62ea86d611359aa910390f8133b4cdc6e26e3a7b3d5e82d9334468a5865c98cb62aff835c65fbf5c74bd532857e6cac9b468327c", 0xc8}], 0x6, &(0x7f000007a000)=[@rights={0x20, 0x1, 0x1, [r90, r91, r92, r93, r94]}, @rights={0x34, 0x1, 0x1, [r95, r96, r97, r98, r99, r100, r101, r102, r103, r104]}, @cred={0x18, 0x1, 0x2, r105, r106, r107}, @cred={0x18, 0x1, 0x2, r108, r109, r110}, @rights={0x14, 0x1, 0x1, [r111, r112]}, @cred={0x18, 0x1, 0x2, r113, r114, r115}, @cred={0x18, 0x1, 0x2, r116, r117, r118}], 0xc8, 0x400d4}, {&(0x7f00005c3000)=@file={0x0, './file0\x00'}, 0xa, &(0x7f0000faf000-0x18)=[{&(0x7f0000e2c000)="d10f261be53d5fe1cdc508f1356a7acdc5", 0x11}, {&(0x7f00009f4000-0xf4)="5eb2f7390b85a1b04d497d9b70bfe28e72cd4f7d7c6bfc398314cd1b2bb10acb9404699ec4cc7ec60537dcafb2e1a2420e6b367b2ed4ee311c91be64d776fab929b42c6646395de4527e7a832ed4c05f8d4d38a0111af24710d9b6cb70895395906800a32726efc5409d11e753bb8585bbbcd90622517eb79cc0c34c135b297dbe3038c6b1edf181724758fae9851a00a0bf2abb61b8433c4170b6ad7ca83a660331b6739bf3d331e03ae396fef7c9e14bd58c5a6d5a0381da61c8f5e9b3663698c562c3ae1c2892765d67f5ce28423f1b8ed444bafc84e764a503c705277f4edfde4b44e9991114346555d9bf2c4f66d4564334", 0xf4}, {&(0x7f0000e67000)="7b460cf1ccdb08f6eed095257a152c6aaed52bb33532d1c4d35ef42ce48f1919f335063024d1ab2fe1cadef9426f166f1f48bccfc6ff09b2a1d6d42d86945a4ed636bd475433c44b70727b29ceba74ffb742559a675bdb9c57e591d035cf48044cb07aa87b3a342194583656a27c74b33174ad52839972a0e3352a675bc7f9b30efec53ce2553b02bf411afb5eb98dad4b0176bf29af64a95f5702ed4ea206a41eead1c0285d8d2185bf72cc0f007f30a9021c070bd7442bf9fc02b2f60f4b0afe1edfafca26b21870cbfdb2cfc0dd10fdf1418fc077d056", 0xd8}], 0x3, &(0x7f0000aff000-0x18)=[@rights={0x18, 0x1, 0x1, [r119, r120, r121]}], 0x18, 0x40800}, {&(0x7f0000bef000-0x8)=@abs={0x0, 0x0, 0x1}, 0x8, &(0x7f0000b6b000)=[{&(0x7f000087e000)="3c01aa50a7d9f3ce07d5c438ec49e6c9a2d6b869c12fa69bb8b8081bad014d729d85e465457ded1ccec9175ecacaba9edc32a52b5efc51a285b41492107863b093", 0x41}, {&(0x7f00000b1000)="1f958ec50dd2d6626b33808319c59fbc705c37ee08849f10c4338f269142cf5c26b71e179edb3fa701a92e61ffd663c1e0677ef0c0717eed15082d7a4a4b112278707852649010a69160d1a02181284cbe9220b6abc6c297da641320d936fc1a8c709c9c3f44ce2022f27837ad5df251d9653585e38b1e931c7b", 0x7a}, {&(0x7f0000ec2000-0x36)="114c6a0c7fa8091da1aabc0c3d192dd3b64fc2772c63a5614385da5140253b1572b0fb6ac46e9c8ee4f97ae697f31dbfbe75f91c960fa069349d103a1c689334741e6a5caafd0d5e09c36dd3b35f12467601350e2263987da6466bb006", 0x5d}, {&(0x7f0000eee000)="97545f969a5e87d2ea3a3f05a93d83a21f5b935ebb9dd38b0a21726aed1d7d8eaa0262a59edec6c0b2370f192d55c75f8ae131ca8f50c29a9d0cfba5ed942ee31dea4f7e0906a2a595b08a8b2cecb728c93fb213d4883d88afd50c2009349a433b31e4f917e3c3a27a028e66bde0cc54efbb76a177c6301aa56d31a2f539cc55d83f1ff8ed7ce188d30baba96d0f090f3c2379f9887eba", 0x97}, {&(0x7f00000a9000)="8dbbba7088a2cc398f7a34f718cca3d3d0761a71290760208ef85f13e23717a477781f054ee965d30f95dbd071cf3e327abcd3aeef67999097f08932a2f13b9f6e401fcfaf7f6b67e76dd1182c66857504dfe12d01edca28958f3fa78b2cdceded8dd988c8456514bc4520366f72c3f2cb1862d1b2e05a064b5218c0fbabb96e40f47697b2e69fa017fda49eca968c7690ff56282905a9a7e6dbe070105a1002e8352a8b98772b189431277a035f3ba241a64d36ffcbeb9c", 0xb8}], 0x5, &(0x7f0000438000-0x9c)=[@rights={0x20, 0x1, 0x1, [r122, r123, r124, r125, r126]}, @cred={0x18, 0x1, 0x2, r127, r128, r129}, @cred={0x18, 0x1, 0x2, r130, r131, r132}, @rights={0x18, 0x1, 0x1, [r133, r134, r135]}, @rights={0x14, 0x1, 0x1, [r136, r137]}, @rights={0x20, 0x1, 0x1, [r138, r139, r140, r141, r142]}], 0x9c}, {&(0x7f0000f2e000-0x8)=@abs={0x1, 0x0, 0x2}, 0x8, &(0x7f0000963000)=[{&(0x7f0000379000-0x78)="bf7b411d93b138f14826706bde82ec82a903c3ab30bb5890ad319792e756daea18362d1045bf28f659eacd233923552e94bd18b3f1e79e8fa003df3f8f8f536f8671ba4fe7acc700a6c5055e6f81d190acfb109db83a78db25b9b07a3feec6ad790f04ed0709eb086fbc19ab89bfb21757daac2695366cb7", 0x78}, {&(0x7f0000a98000)="ec4dd0d0bf144ea52807a2011749f11f5c5d4847fb828991973f1c6d43b5af91ec035aa5cf6a072692fe9880cadef715b0b75f2fc1e5cc3707d15c4509648cfe1959d96f872d3a06a28202aa836a4673b7740e8bc21aab4100afa3fc54611a6c5f44be9f117e20d4892bdab6a47ba716f927f2ab2afdf0c5e565add8133874227bb921cc2bc24fbbcabb0ac4af24085b909c09bfd26946995bdfd82306e17c3893ee6adf2d4f44a7e77024de58119646927c2bbf83640f10aac4e70077552e1451cdd68f73e83a85f20b4252bec2f39d60b133165a692533560faa51f1503bd7fd7f8cf8a1eac47e5959b01d03fa59831968", 0xf2}, {&(0x7f0000ccc000)="7f59cf34ec5f8b762c288378e20154121102e85ac81af7c76270296ddc7c3af755340a495ff6968d1a0e78a191107a83c33f89c07c07c44bba15c23bf2d49a3618a7d236bc357fe564ff7b5a7688d5d88bc0c4546b6d40f422412e5e7d368a88081929655482d524d0eb89551fea4c51c9cf749445c9ad36794f8bf423594eac4b5d741ae83ce9ed2cfb6d152887fa6b308a3ae5dfc21f172f8daa217e57b2fa6bd6076d5ddebc5707663c7df669269fcda8c8f492b24664d309a5266136bc735ac658f46916", 0xc6}, {&(0x7f0000ee0000-0x25)="4457fd68ef6e7230bf5f7aee177af52881022c48135578b916c89084c61916202d7433ee1b", 0x25}, {&(0x7f00004d7000)="cfd3275aa78250a4d2a51d0e078b47afeb50346e329fd9b67d98ef75b2ba020f98afcb5abc419196f23bb0a0a2ec3907aa861bd2f79a282c64e6be55dbd04ebd66185eabbb74b22fc9b4fb9e654271f646b312678fd13fdfdba42220168f5067bf3f987c5655079d1d0c4443d1fe92ec8133e06f12fe1d92852fb010bc2b7d9d74f4812e33d150a173dee809ece2d7fb793f237da930c38d61743f4af6f4e5c733ff9ee35b9dd70d54327301e77fef444f1d3089661aa9ab92b89ceed9", 0xbd}, {&(0x7f0000699000)="0f7c75c73f101467a07d4cc548f4cdb2c317c84537e05790fd86a00f98e4bd1241f25fd06f55ed2dd5d32008d298ef10", 0x30}, {&(0x7f00000f5000-0xad)="c47b04dd10827dc6ed98df56b61fe0ffdd7988763efec13dfd39086616c486af9fe87a8c8d32e5e4594531e3b19af1233ec68e43b45db331573ead0098314bb479d1782ebce2f4aafbfb48e7cd050df59152983dce002dc19ef83e16dd38b3169cf3470e554f82466b50cacd7a14350819a65bfdf25503eedcdeeb671bf439575baf2e0e2d9d9a1989b3e4a309dcef7b5889da63bb591b22132b8f03f9d0c5e2ca25371e71c968e99c463355e5", 0xad}], 0x7, &(0x7f0000612000)=[@rights={0x1c, 0x1, 0x1, [r143, r144, r145, r146]}, @cred={0x18, 0x1, 0x2, r147, r148, r149}, @rights={0x10, 0x1, 0x1, [r150]}, @cred={0x18, 0x1, 0x2, r151, r152, r153}, @rights={0x1c, 0x1, 0x1, [r154, r155, r156, r157]}, @rights={0x28, 0x1, 0x1, [r158, r159, r160, r161, r162, r163, r164]}], 0xa0}, {&(0x7f0000949000-0xa)=@file={0x1, './file0\x00'}, 0xa, &(0x7f00009da000)=[{&(0x7f000080b000)="f1d0cba9ba6d2450692236266a49e823f6e98d08364ec5ab80cf78fffaccede46686507f8170cd6a4ce095ac9c341f9f8ea8441a10dfa80457ff41df185bd5b4976ea780b4541cbb5a72265e8d1dc57c047b8541362425d950740515fc10c9e0f51a81baf3e303fed86547dcb80207217c46541d3001ecb91ec8f8f4026a37736599981d0f18cb7ee8fa57ba6c23", 0x8e}, {&(0x7f00001f2000-0x19)="2499d8365c440f284062cf9f88fbc6f078639f36d2f13d2cb3", 0x19}], 0x2, &(0x7f00006e3000-0x98)=[@cred={0x18, 0x1, 0x2, r165, r166, r167}, @rights={0x18, 0x1, 0x1, [r168, r169, r170]}, @rights={0x14, 0x1, 0x1, [r171, r172]}, @cred={0x18, 0x1, 0x2, r173, r174, r175}, @rights={0x14, 0x1, 0x1, [r176, r177]}, @rights={0x10, 0x1, 0x1, [r178]}, @cred={0x18, 0x1, 0x2, r179, r180, r181}], 0x98, 0x20040000}], 0xa, 0x1) mknod$loop(&(0x7f00004c8000-0x10)='./file0/control\x00', 0xc000, 0xffffffffffffffff) 2018/02/04 21:33:29 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000894000)='/dev/sequencer2\x00', 0x10000, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000f3e000-0x4)={0x1}, 0x4) 2018/02/04 21:33:29 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0xffffffffffffffff) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f00006a1000)=0x25, 0x4) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000ea1000)='/dev/sequencer2\x00', 0x2000, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000cf7000)) recvfrom$inet6(r0, &(0x7f0000958000)=""/68, 0x44, 0x21, &(0x7f000056a000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/02/04 21:33:29 executing program 0: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = epoll_create(0xfffffffffffffffc) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x54000, 0x2) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, &(0x7f0000001000-0x50)={@mcast1={0xff, 0x1, [], 0x1}, @local={0xfe, 0x80, [], 0x0, 0xaa}, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x0, 0x4000, 0x0, 0x0, 0x6}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000003000-0xc)={0x1, r2}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000003000)={0x0, 0x3}, &(0x7f0000003000-0x4)=0x8) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000003000)={r4, 0xff, 0x30}, &(0x7f0000003000)=0xc) setsockopt$inet_mreq(r3, 0x0, 0x24, &(0x7f0000002000)={@multicast2=0xe0000002, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x8) socket$bt_sco(0x1f, 0x5, 0x2) 2018/02/04 21:33:29 executing program 7: add_key(&(0x7f0000085000-0xd)='dns_resolver\x00', &(0x7f0000790000-0x5)={0x73, 0x79, 0x7a}, &(0x7f0000f64000)="b9680f3581b4e512b670130900524c9ee485f509f8be9ec42964a9356144045fddbf8cca2802adc25b0ac655e8b9920c73e72576d3523f614fd4dc2300", 0x3d, 0x0) 2018/02/04 21:33:29 executing program 7: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000001000-0xbb)="482822834806777d21076623882809c34fe43861ec9020f984a07a61e9b69bda54eb22f652cf7c6661757c5e6057e4d2d8020f2192eb2830f3b3c6d3d70c83b70645f3fd4d46fb54125c52f3311d93642d782f088c5a50f061464f42b872a012356ecf4d8146fc724d0dc8109b9fa12486eadb52a6d8e183f82ae6577213143f0c5a4f6ce2aee0b664ba86674d3f9a629b67faf0d61cfd587425070cb92964097c085c88b1ead2cc075cfeae6f610e2bfc90889c3c952ab567b5aa", 0xbb, 0x4000, &(0x7f0000fe3000)={0x2, 0x3, @dev={0xac, 0x14, 0x0, 0x13}}, 0x10) mmap(&(0x7f0000000000/0x2a000)=nil, 0x2a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x80002, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000017000-0x410)=@filter={'filter\x00', 0xe, 0x4, 0x36c, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000), {{{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@uncond, 0x0, 0x94, 0x240, 0x0, {}, [@common=@ttl={0x24, 'ttl\x00'}]}, @REJECT={0x24, 'REJECT\x00'}}, {{@uncond, 0x0, 0x164, 0x188, 0x0, {}, [@common=@unspec=@recent0={0xf4, 'recent\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}]}, @REJECT={0x24, 'REJECT\x00'}}, {{@uncond, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00'}}]}}, 0x3c8) [ 82.205886] binder: release 10587:10609 transaction 108 out, still active [ 82.212893] binder: undelivered TRANSACTION_COMPLETE [ 82.218094] binder: send failed reply for transaction 108, target dead [ 82.234056] binder: 10612:10616 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 82.264641] binder: undelivered TRANSACTION_ERROR: 29189 [ 82.296505] binder: release 10612:10616 transaction 110 out, still active [ 82.303562] binder: undelivered TRANSACTION_COMPLETE [ 82.308716] binder: send failed reply for transaction 110, target dead 2018/02/04 21:33:30 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f000025a000-0xb)='/dev/mixer\x00', 0xa102, 0x0) accept4$packet(r0, &(0x7f0000461000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000640000-0x4)=0x14, 0x800) ioctl$KVM_SET_BOOT_CPU_ID(r0, 0xae78, &(0x7f00006bf000)) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00009a4000-0x28)={'vcan0\x00', r1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000dfc000)={&(0x7f0000d14000/0x1000)=nil, 0x1000}) socket$unix(0x1, 0x5, 0x0) sendto$inet6(r0, &(0x7f00003e2000)="ccf3435432bbb041df030f6263ae1860953e1e502e0f2bb0e4c7c76d8929277a653402f0bf272c8206c83794a60a178333174584e2242c81b20b0914ff147f64b7a81de6e17d810f13f0a345bb8c1ba5a11c0f938c291577ff093f55ce0f3591b177e8a67d", 0x65, 0x40000, 0x0, 0x0) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f00000d0000-0x18)={0x6c5, 0x20, 0x1}) 2018/02/04 21:33:30 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000b2000-0xc)={0x0}, &(0x7f000068f000)=0xc) r2 = syz_open_procfs(r1, &(0x7f000068b000)='io\x00') bind$alg(r0, &(0x7f0000466000)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-ssse3\x00'}, 0x58) r3 = accept4$alg(r0, 0x0, 0x0, 0x0) sendfile(r3, r2, &(0x7f000024b000-0x4), 0x5) 2018/02/04 21:33:30 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00003c5000-0x9)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000669000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$vnet(r3, &(0x7f0000399000)={0x1, {&(0x7f0000398000)=""/63, 0x3f, &(0x7f0000cca000-0x98)=""/152, 0x3, 0x3}}, 0x68) ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, &(0x7f0000b2a000-0xa8)={0x0, 0x0, []}) 2018/02/04 21:33:30 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000654000-0x12)='/dev/snd/midiC#D#\x00', 0x200, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000eac000-0x10)='/dev/sequencer2\x00', 0x2, 0x0) rt_sigprocmask(0x0, &(0x7f0000e5c000-0x2)={0x10000}, &(0x7f0000a4a000), 0x8) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000b0e000)) openat$sequencer(0xffffffffffffff9c, &(0x7f000026a000-0xf)='/dev/sequencer\x00', 0x4001, 0x0) 2018/02/04 21:33:30 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000001000-0x10)='/selinux/status\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000001000)={0xfffffffffffffffc, 0x112}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000c02000)='./file0\x00', 0x200, 0x10) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000ac6000), &(0x7f00006a9000-0x4)=0x4) r2 = openat(0xffffffffffffffff, &(0x7f000098b000)='./file0\x00', 0x10000, 0x10) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f000085d000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00007e5000)='/selinux/checkreqprot\x00', 0x4002, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000013000-0x10)="0a8a626ba6484a0572d857010943bc9c", 0x10) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f0000169000)) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000422000)=0x9) r3 = syz_open_dev$dspn(&(0x7f000027d000)='/dev/dsp#\x00', 0x2, 0x0) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r3, 0x84, 0xc, &(0x7f000060b000)=0x4, 0x4) 2018/02/04 21:33:30 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:30 executing program 7: mmap(&(0x7f0000000000/0x16000)=nil, 0x16000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0x10, 0x3, 0x0) r1 = syz_open_dev$usbmon(&(0x7f000000c000-0xd)='/dev/usbmon#\x00', 0x7ff, 0x800) mmap(&(0x7f0000016000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000016000)=""/150) sendmsg(r0, &(0x7f000000c000-0x38)={&(0x7f0000000000)=@nl=@proc={0x10}, 0xc, &(0x7f0000002000)=[{&(0x7f0000008000)="5500000018007fafb72d1cb2a4a280930206000000a843096c2623692500080021000a000000ca8a9848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)=[]}, 0x0) 2018/02/04 21:33:30 executing program 6: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000001000-0x11)='/dev/vga_arbiter\x00', 0x6000, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x11, 0x2, 0x0) fchdir(r0) getsockname$llc(r0, &(0x7f00006cf000-0x10)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f000072a000-0x4)=0x10) socketpair(0x8, 0x6, 0x2, &(0x7f00004c2000)={0x0, 0x0}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000e6d000)={@loopback={0x0, 0x1}, 0x4, 0x3, 0x0, 0x0, 0x75a, 0x200, 0x8}, 0x20) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000b94000-0x4)=0x2, 0x4) 2018/02/04 21:33:30 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 82.639846] binder: release 10660:10666 transaction 112 out, still active [ 82.646962] binder: unexpected work type, 4, not freed [ 82.652309] binder: undelivered TRANSACTION_COMPLETE [ 82.657493] binder: send failed reply for transaction 112, target dead 2018/02/04 21:33:30 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000498000)={&(0x7f0000d55000)={0x10}, 0xc, &(0x7f00008b8000-0x10)={&(0x7f00003c1000-0x24)={0x24, 0x0, 0x1, 0x800000001, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@nested={0x10, 0x2, [@typed={0x5, 0x1, @ipv4=@loopback=0x7f000001}]}]}, 0x24}, 0x1}, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000073000)={0x3, r0}) bind$llc(r1, &(0x7f000025c000-0x10)={0x1a, 0xff, 0x20, 0x6, 0xad93, 0x800, @dev={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xc}}, 0x10) 2018/02/04 21:33:30 executing program 6: mmap(&(0x7f0000000000/0x18000)=nil, 0x18000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000018000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000019000-0x8)='./file0\x00', 0x101000, 0x34) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000015000-0x4)=0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r1, 0x89f7, &(0x7f000000a000-0x50)={@common='sit0\x00', @ifru_names=@common="7663616e3000f700"}) 2018/02/04 21:33:30 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f00004aa000-0x28)={@common='bridge0\x00', @ifru_data=&(0x7f00008e8000-0x20)="060000000000000000039d0000000000007fff00a10000000449fa00e2007e23"}) r1 = syz_open_dev$admmidi(&(0x7f0000503000-0xe)='/dev/admmidi#\x00', 0x8, 0x100) ioctl$TIOCNOTTY(r1, 0x5422) openat$ptmx(0xffffffffffffff9c, &(0x7f000004f000)='/dev/ptmx\x00', 0x420000, 0x0) 2018/02/04 21:33:30 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000f25000-0x10)='/dev/sequencer2\x00', 0x20000, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000315000)={0x0, @loopback, @broadcast}, &(0x7f0000784000)=0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f000099d000), 0x14) r2 = syz_open_dev$adsp(&(0x7f00006f6000-0xb)='/dev/adsp#\x00', 0x3f, 0x800000000020000) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc00c64b5, &(0x7f0000b65000-0x8)={&(0x7f0000284000)=[0x0], 0x1}) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) getsockname$unix(r0, &(0x7f0000212000)=@abs, &(0x7f00008ca000)=0x8) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0106434, &(0x7f0000056000)={0x2, 0x0, 0x3, 0xff}) ioctl$DRM_IOCTL_SG_FREE(r2, 0x40086439, &(0x7f0000963000)={0x6, r3}) ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f000057f000)={0x3, r2}) getsockopt$packet_buf(r2, 0x107, 0x0, &(0x7f0000615000-0xd)=""/13, &(0x7f000067c000-0x4)=0xd) ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f00002ad000)={0x1, r2}) write$selinux_context(r0, &(0x7f0000be9000)='system_u:object_r:usbtty_device_t:s0\x00', 0x25) 2018/02/04 21:33:30 executing program 3: mmap(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x806, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x1000000000000001, 0x2e, &(0x7f0000001000)=@filter={'filter\x00', 0xe, 0x4, 0x280, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000), {{{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@ip={@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0x0, 0x0, @generic="24fe55d8ac7075e023e0824d7ad39d7e", @common='nr0\x00'}, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@ip={@rand_addr, @rand_addr, 0x0, 0x0, @common='bpq0\x00', @common='irlan0\x00'}, 0x0, 0x70, 0xb8, 0x0, {}, []}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz0\x00'}}}, {{@ip={@broadcast=0xffffffff, @multicast2=0xe0000002, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @syzn={0x73, 0x79, 0x7a}}, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}]}}, 0x2e0) setsockopt$inet_int(r0, 0x0, 0x5, &(0x7f000000e000-0x4)=0x3, 0x4) r1 = gettid() mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_rr_get_interval(r1, &(0x7f000000f000)) 2018/02/04 21:33:30 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000eb000-0x19)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00007d3000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000faf000)=0x14) sendmsg$can_raw(r0, &(0x7f0000156000)={&(0x7f0000f41000-0x5)={0x1d, r1}, 0x10, &(0x7f0000ad2000-0x8)={&(0x7f0000374000-0x48)=@canfd={{0x1, 0x10000, 0x81, 0x3f}, 0x35, 0x2, 0x0, 0x0, "bad948968a1c198dff13efe4cdbc6a7a06fbbca65d0b3f78b8cab599d990e1d563072f9103c61934e86078adf9ab95a046645aa020f2d75241000c347444b751"}, 0x48}, 0x1, 0x0, 0x0, 0x48000}, 0x20000000) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00002ca000-0x2), &(0x7f0000012000-0x4)=0x4) 2018/02/04 21:33:30 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000e37000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000e06000-0x8)='./file0\x00', 0x80, 0x8) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) open_by_handle_at(r0, &(0x7f000014c000-0x56)={0x56, 0x3f, "04b96fe2b59b7ab92135905cd320bb4136a33520f9dc722f584a1a6e5952f1d4460a3827eefe20f8b341e2a2d3dbb70649916ec5dd36441cc617cf419adda5c90b81ba1d9a7dc5029cfe25b33f7e"}, 0x400800) readv(r1, &(0x7f000007e000-0x50)=[{&(0x7f000020e000)=""/25, 0x19}, {&(0x7f0000d1f000-0x1000)=""/4096, 0x1000}, {&(0x7f0000dfd000-0xf2)=""/242, 0xf2}, {&(0x7f0000cf1000-0xae)=""/174, 0xae}, {&(0x7f000000b000)=""/168, 0xa8}, {&(0x7f000066b000-0xf2)=""/242, 0xf2}, {&(0x7f0000a1f000)=""/187, 0xbb}, {&(0x7f0000396000)=""/4096, 0x1000}, {&(0x7f000081b000-0x8f)=""/143, 0x8f}, {&(0x7f0000098000)=""/222, 0xde}], 0xa) [ 82.688492] binder: release 10685:10686 transaction 116 out, still active [ 82.695564] binder: unexpected work type, 4, not freed [ 82.700904] binder: undelivered TRANSACTION_COMPLETE [ 82.706075] binder: send failed reply for transaction 116, target dead 2018/02/04 21:33:30 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:30 executing program 3: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000002000-0x8)={0x0, 0x0}) fcntl$lock(r0, 0x6, &(0x7f0000002000)={0x1}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x8, 0x110, r0, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f0000002000-0x10)={{r2, r3/1000+10000}, {0x77359400}}) write(r1, &(0x7f0000004000-0xca)="cab145e7ee1fe4525d5396546eebfa968097a2746374d3ba8bcc6d0579536f8d98bdd3ade308209387355e9d96f6141512c3ee4dd1d9a7aa39cc814e9bd7965731ce68dbae6e6b840a7f9387f09cb5748d0002929b0939e371396fe225cd098a8974734cf78bcaa29e6826865398d71c241ea04c337ac2cee071fcae2b2c2911c8014e590d94ecfb8b3ace3cc570449e4b20cedb2c21579853098577043ff5f9bc32ef3d105f7e4bef25b8229d59375c44cb032f1c7471df6d06c1cdf15e3aa2e6acaa698713c4e5db76", 0xca) 2018/02/04 21:33:30 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000798000)={0x4000019980330}, &(0x7f0000467000-0x18)={0xfffffffffffffffc, 0xfffffffffff80002, 0x0, 0x0, 0x4000000000}) 2018/02/04 21:33:30 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) pipe2(&(0x7f000013a000-0x8)={0x0}, 0x800) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000fa4000)={0x100, 0x800, 0x2, 0x309, 0x8}) [ 82.818243] binder: release 10699:10706 transaction 120 out, still active [ 82.825291] binder: unexpected work type, 4, not freed [ 82.830710] binder: undelivered TRANSACTION_COMPLETE [ 82.831252] audit: type=1400 audit(1517780010.552:68): avc: denied { map } for pid=10709 comm="syz-executor3" path="pipe:[24317]" dev="pipefs" ino=24317 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=fifo_file permissive=1 2018/02/04 21:33:30 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000f11000-0x8)={0x0, 0x0}) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00001eb000)={0x0}, &(0x7f0000af4000-0x4)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000aa7000)={r2, @in6={{0xa, 0x1, 0x805, @empty, 0x7fff}}}, 0x8c) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000e30000)=@assoc_value={0x0}, &(0x7f0000afc000-0x4)=0x8) socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000487000)={0x0, 0x0}) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r5, 0x84, 0x79, &(0x7f00006c5000)=0x400, 0x4) r6 = mmap$binder(&(0x7f0000a8b000/0x4000)=nil, 0x4000, 0x0, 0x50, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00009c8000)={0x130, 0x0, &(0x7f0000c91000-0x130)=[@acquire={0x40046305}, @transaction={0x40406300, {0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x50, 0x38, &(0x7f000032a000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f0000a57000-0x1), 0x1, 0x4, 0x6}, @ptr={0x70742a85, 0x1, &(0x7f000066c000), 0x1, 0x2, 0x2f}], &(0x7f00008cc000-0x38)=[0x30, 0x0, 0x18, 0x78, 0x28, 0x48, 0x18]}}, @exit_looper={0x630d}, @dead_binder_done={0x40086310, 0x3}, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, &(0x7f0000df1000)=[], &(0x7f000056f000)=[0x78, 0x48, 0x30, 0x20]}, 0x8}}, @transaction={0x40406300, {0x1, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x18, 0x18, &(0x7f0000710000)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x2}], &(0x7f0000b47000)=[0x18, 0x20, 0x40]}}, @transaction={0x40406300, {0x1, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x50, 0x38, &(0x7f0000e66000)=[@fda={0x66646185, 0x0, 0x4, 0x13}, @flat={0x776a2a85, 0x100, r6}, @fd={0x66642a85, 0x0, r1, 0x0, 0x3}], &(0x7f0000f81000-0x38)=[0x48, 0x78, 0x30, 0x40, 0x58, 0x0, 0x0]}}], 0x70, 0x0, &(0x7f000094c000)="0934caabbd743ebb45df6c7acd8bfce6cd568d7da2190c9e210d085dda09a8a2334906024cc7dab9ecf514277a97f18a130ca9723fb491773ab3a668c9dcca42d23ac34e8d27d40440867ca3d7e4ffbb776855dc39c853515d7e8d215e279cddde934993937978c4cf730d83919f4bef"}) syz_open_dev$binder(&(0x7f0000091000)='/dev/binder#\x00', 0x0, 0x800) r7 = syz_open_dev$dmmidi(&(0x7f0000ec7000)='/dev/dmmidi#\x00', 0xd71, 0x44040) clock_nanosleep(0x2, 0x1, &(0x7f0000638000-0x8)={0x77359400}, &(0x7f00002f8000)) ioctl$VT_OPENQRY(r7, 0x5600, &(0x7f000074b000)) r8 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f000062c000-0x16)='/selinux/checkreqprot\x00', 0x800, 0x0) vmsplice(r0, &(0x7f00008f1000-0x8)=[{&(0x7f0000134000)="e07bce37235d0447578198618c2d247e3ee3c818df9ad33bfa4304b00824c9a7f2780c7c0b0ade540431a0", 0x2b}], 0x1, 0x6) sendmsg$nl_netfilter(r8, &(0x7f0000964000-0x1c)={&(0x7f0000318000-0xc)={0x10}, 0xc, &(0x7f0000749000-0x8)={&(0x7f0000aef000)={0x5a8, 0x9, 0x7, 0x100, 0x1, 0x3, {0x2, 0x0, 0x7}, [@generic="5ba32b1f5f1f3704aaf51a4ca203fcd25f3ef2a764b043d0438cdd3a7d7d9a5efc0a0094a014adc2aded67340303536df07e881d85391305d520ee9374ef8a268e684e0a151f734c83caef2e33e8f3d8f941cee8219fe13f3abb54745d637d149be64954d029947d4862eff97956ef7e635208ec5cc7f141f93d689f2b787978a5de63bd", @nested={0x1e4, 0x5a, [@generic="fdbd462d7f1c37f9a88eb63a84", @generic="48d3d6d2982f953e06c9a10e0705aa171c0671d471342b753e2aea03982544dedcefaaf785f1436a216cd37d", @generic="3d9e83ab607399a301a8e4cb39d63597529e338e639b61f6e7f356aeb4d9bd1cfea865377071b83eab536fd37e49c08851e3f183f8b3bcec6133f912ca6cbbae71b8771212cb3b6e925c4fb2e74e4c7d890f9ab8471afe4425f05825d60a478fec68e330f3a0", @generic="601747c5226d1198c608e3e1bbcbd8c904fcad6892f1c5019f6479d4b402adecdb13e265df0292febe920209530fa60c896e267ce07a131a5f68f8ccd8949441242bac25034f1fce21247a267ea0cf68b151e37ddc04b36c679159ad6f2e3c46c5782463d132eff0", @typed={0xd8, 0x40, @binary="4622b6cf35a5ade07a3a63de45081668e8c1f2a02c448009c5fc47381eb16a9f951060f88545b887c2c7c37e2e70f9fb528a32edba425a905f2f110c57841d938d279216e0c091b600793f8a3187ea282c9e8d8f0b2cf6d7bb61aa486aa92e72926205d96f1ef048f9460df75c7f7f3e430663a4f0bbb0547c07e4d182c2190ed5827f67e6d28961c25d722a647de472d0b3f6ca3be68058d8bd318099d5cab706838cd0cb5dfc503eecddebd0de93e17f3e0e4a5d42909834d33ab197d02d2e07e3fe645dfc84a96d0452764f154c"}]}, @typed={0x10, 0x3e, @u64=0x100000000}, @typed={0x8, 0x50}, @generic="76f2cb8ed9fbcfdf64c38ea188ca8f685296ba25c7eaba4673f3c9482ac8427aa52da9a0ca6a1bef01b1a3cfe026a8f710e13eb170037f4c6d658dee88315c", @typed={0x1c, 0x89, @str='@prockeyringwlan1\x00'}, @generic="ac9728b99a0dbfa2275054dae9b6922ae696b74554d295f22ed7b5a9967d00680be6d6e97354adc798d741e1c81a1675393cb12f6330fd0630aa4302279b1b23ed20098cb54dfcf0436dd51e9b753624c2b84565801331be30ecb19f2f7256f210166984f06d5313778ed56fc24f55af0c2a4d11e4e3a9009c2dafc7c170555cd3a36696004ab77c7b846c0eff16449fa7b22a42cf75ec56a98a4b7c55485e0a012356a36e36d8b54e3a9e6994a18168638481b8d2ec3ad268b8cd2d3e74a49467707b7c9cacf5485428b8e35aecc3998299d5d198efbe5b1f", @generic="3363e8c89645e5f30cd3cdfb5f000cd2947ea5cb0d35f69fd914d9f50d7d7af069f71117a4f61a8809087fd4a2955411a737d299409725afdfcbdd05c5de1f8a8097970d644975fc4e6a3a7eb32077e1ee1786c664521ff49addf342d7f8d0c62681a1d93dfdbbdfa05d2c4f906298fd44822b7b52fe2d6111d3e08917d583b5de2c2c379d024376ec6a3b5e5cbd7cbdcc254a1253bb5fd32e1fdfe6767d67448eb2984ff61a22aa906421ed0600d2a08271c4d263b774e8581a588cfffbec53e0887706fd19dc8ebfb3e7bc09a0548663d6a037c733a4ef7838edde38db0b6ac791f1bf544070529765cdb91076022a70cf0cd868a122134dcadbfc2b538d", @generic="96319ed51025e7e451b9b933b3dc6a9df054b6d89cd4069fb5f601028dcb7141155284c10a3471198bccc19c5775c0495bd4a6467fe518715b168fc75d3eccedaac66388c1edf159710aaf65a98aa56f9948b1342a9ba5467b1bbd64917b603b84eb5453db5051b4e7be5061d16e2acef75badff8ea0fca3ced2b2289243feb35cd8127bb8c86ed07608d96cb06d6c715712cd55489748825c6a351266133bcc8e55f929a4d328dbe677beb85e305fa528d28ca74986db8d6a52974a02f93b9d95b2f26c442a35540a9bf9d41a87c917ac3abe427f5ca2f17117a9bb3f84f9"]}, 0x5a8}, 0x1, 0x0, 0x0, 0x80}, 0x40840) getsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00008bc000)={r4}, &(0x7f0000eb4000-0x4)=0x10) r9 = syz_open_dev$audion(&(0x7f0000420000-0xc)='/dev/audio#\x00', 0xa39, 0x80000) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r8, 0x84, 0x13, &(0x7f000096c000)={r2, 0x2}, &(0x7f00002ac000)=0x8) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r9, 0x84, 0xc, &(0x7f00002fc000)=0x6462, 0x80) [ 82.835872] binder: send failed reply for transaction 120, target dead [ 82.874443] audit: type=1400 audit(1517780010.591:70): avc: denied { net_admin } for pid=4203 comm="syz-executor2" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 2018/02/04 21:33:30 executing program 7: mmap(&(0x7f0000000000/0x4a000)=nil, 0x4a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000018000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, "f0810e", 0x0, "c6ff00"}}}}}}}, &(0x7f0000008000)={0x0, 0x0, []}) 2018/02/04 21:33:30 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x0, 0x0, &(0x7f0000a4e000)=[], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:30 executing program 4: mmap(&(0x7f0000000000/0xe000)=nil, 0xe000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000001000)=@req3={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x1c) move_pages(0x0, 0x40000000000000da, &(0x7f0000001000-0x20)=[&(0x7f000000b000/0x3000)=nil], 0x0, &(0x7f000000b000)=[], 0x0) mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f000000f000-0xc)={0x6, 0xffffffffffffff9c, 0x1}) mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000001000)='./file0\x00', 0x108) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000000a000)={0x2, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000a7e000-0x1)}, 0xa00000400, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f00008df000-0x8)='./file0\x00', &(0x7f0000344000-0x8)='./file0\x00', &(0x7f000080a000)='nfs\x00', 0x0, &(0x7f000000a000)) ioctl$KVM_GET_VCPU_EVENTS(r0, 0x8040ae9f, &(0x7f000000e000)) 2018/02/04 21:33:30 executing program 2: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000ab5000-0xa)='/dev/cuse\x00', 0x40080, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_S390_UCAS_MAP(r0, 0x4018ae50, &(0x7f0000000000)={0x10000, 0xffffffffffffffae, 0x80000}) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000000)=0x200, 0x4) r1 = syz_open_dev$sg(&(0x7f0000001000-0x9)='/dev/sg#\x00', 0x5, 0x100) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000002000-0x8)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0x8) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000003000-0x8)={0x0}) ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f0000001000-0x8)={r2, 0x1}) ioctl$sock_netrom_TIOCINQ(r0, 0x541b, &(0x7f0000003000-0x4)) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000001000)={0x2, [0x1ff, 0x8]}, 0x8) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000003000)=[@in6={0xa, 0x2, 0x80000000, @remote={0xfe, 0x80, [], 0x0, 0xbb}}, @in6={0xa, 0x1, 0x4, @empty, 0x7}, @in={0x2, 0x2, @rand_addr=0x1}, @in6={0xa, 0x2, 0xfff, @mcast2={0xff, 0x2, [], 0x1}, 0x1}, @in6={0xa, 0x2, 0x101, @dev={0xfe, 0x80, [], 0x0, 0x14}, 0xfffffffffffffffc}, @in6={0xa, 0x3, 0x3, @mcast2={0xff, 0x2, [], 0x1}, 0x8}], 0x9c) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000005000-0x4)=0xff, 0x4) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000006000-0x40)=[{r1, 0x42}, {0xffffffffffffff9c, 0x300}, {r1, 0x9500}, {r1, 0x8000}, {r0, 0x6401}, {r0, 0x1}, {r1, 0x82}, {r0, 0x4030}], 0x8, &(0x7f0000006000-0x8), &(0x7f0000005000)={0x6}, 0x8) socket$nfc_raw(0x27, 0x1, 0x0) r3 = geteuid() mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) stat(&(0x7f0000006000-0x8)='./file0\x00', &(0x7f0000006000)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r3, r4) munlockall() mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000004000)={0x0, 0xb4, &(0x7f0000007000)=[@in={0x2, 0x1, @rand_addr=0x7}, @in6={0xa, 0x0, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x3a}, @in6={0xa, 0x1, 0x80, @mcast1={0xff, 0x1, [], 0x1}, 0x5}, @in={0x2, 0x2, @broadcast=0xffffffff}, @in={0x2, 0x0, @multicast2=0xe0000002}, @in={0x2, 0x3, @broadcast=0xffffffff}, @in6={0xa, 0x3, 0x762, @loopback={0x0, 0x1}, 0x8000}, @in={0x2, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}}, @in={0x2, 0x0, @multicast2=0xe0000002}]}, &(0x7f0000008000-0x4)=0xc) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000007000)={r5, 0x9, 0x20}, 0xc) 2018/02/04 21:33:30 executing program 6: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair(0xd, 0x0, 0x7, &(0x7f0000000000)={0x0, 0x0}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x7) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket(0xa9a93143ad466f50, 0x2, 0x3) write(r1, &(0x7f0000064000)="1f0000004a00070600001b0a000008ff0a3f80164c00000204000003441951", 0x1f) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) readv(r1, &(0x7f0000784000-0x20)=[{&(0x7f0000301000-0xb)=""/11, 0xb}], 0x1) 2018/02/04 21:33:30 executing program 3: r0 = syz_open_dev$amidi(&(0x7f0000eec000-0xc)='/dev/amidi#\x00', 0xffffffff7fffffff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000f49000)=0x2, 0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) recvmsg$netrom(r1, &(0x7f0000b2b000)={&(0x7f0000d25000-0x10)=@ax25={0x3, {"837bf46e6dc7a8"}}, 0x10, &(0x7f0000bc4000)=[], 0x0, &(0x7f00002bd000-0x2340)=[]}, 0x0) close(r1) r2 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000a01000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000523000)={0x7, [0x1, 0x4, 0x7f, 0x80000001, 0x5, 0x20, 0x2]}, &(0x7f0000146000-0x4)=0x12) ioctl$int_in(r3, 0x5452, &(0x7f0000009000-0x8)=0x3f) recvmsg$netrom(r1, &(0x7f00002dd000-0x38)={&(0x7f0000cf1000)=@ax25={0x3, {"2f3971fbb37657"}}, 0x2e3, &(0x7f000059a000)=[], 0x0, &(0x7f0000926000)=[]}, 0x0) recvfrom(r4, &(0x7f0000ef3000), 0x0, 0x0, &(0x7f000002d000-0x10)=@alg={0x26, 'hash\x00', 0x0, 0x0, "6c7a0700000c19e30000000000001302000000000000e2ffffffffffffff0000000000000000000000000000000000000000200000000000000000000e000800"}, 0x58) fcntl$setown(r3, 0x8, r2) fcntl$setsig(r3, 0xa, 0x12) dup2(r3, r4) tkill(r2, 0x13) 2018/02/04 21:33:30 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = add_key(&(0x7f0000d39000-0x5)='ceph\x00', &(0x7f000085b000-0x5)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$update(0x2, r1, &(0x7f0000c19000)="646e77b4440bf7f0e75f8868544358f207f4893ef1ed8d3726b0c7459c8d196223543954974d56783019abcd0c4d131354275500636f5334284ba219f034e5409acd6f1586b3dc7e618c057360940da103b2ed42fc974137a98ff2cf73b8f7505cdaf3765c250c2c82edcea33d831e4eedec8f8dbe6e15c109b35a6e5c213a689c6b349581cfb6c12bc8469ee0e6859943922bba6280439c1c154f97b9ae3058f3637ad0bebb2e9bf635d3a4c384acb83d3d931bf570e6cd002856cee2773cf81c", 0xc1) syz_emit_ethernet(0x3a, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [], {@x25={0x805, {0x1, 0x8000, 0xfb, "e699f8f55fc9b7370afd9519bf79457f9b7bb54831cf0332d832d24ec72529398e04a4519c365b5ee2"}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) fcntl$getownex(r0, 0x10, &(0x7f0000d39000-0x8)={0x0, 0x0}) prlimit64(r2, 0x0, &(0x7f0000b46000)={0x57fe, 0x4}, &(0x7f0000dbb000)) 2018/02/04 21:33:30 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getpgrp(0xffffffffffffffff) r0 = getpgid(0x0) r1 = syz_open_procfs(r0, &(0x7f0000be5000)='pagemap\x00') lseek(r1, 0xfffffffffffffffe, 0x0) sendfile(r1, r1, &(0x7f000010f000), 0x0) [ 82.898867] audit: type=1400 audit(1517780010.591:69): avc: denied { net_admin } for pid=4214 comm="syz-executor6" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 82.949361] audit: type=1400 audit(1517780010.670:71): avc: denied { sys_admin } for pid=10720 comm="syz-executor4" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 82.973880] audit: type=1400 audit(1517780010.679:72): avc: denied { dac_override } for pid=10734 comm="syz-executor7" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 2018/02/04 21:33:30 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f000080e000)={0x2, 0xe, 0x0, 0x0, 0x10, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @rand_addr}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, {0x1ffffef0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @in=@dev={0xac, 0x14}}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}]}, 0x80}, 0x1}, 0x0) mmap(&(0x7f0000000000/0x3a6000)=nil, 0x3a6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x7e, &(0x7f000000d000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @local={0xac, 0x14, 0x0, 0xaa}, {[]}}, @icmp=@dest_unreach={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x6c, 0x0, @rand_addr, @dev={0xac, 0x14}, {[@timestamp={0x44, 0x40, 0x0, 0x0, 0x0, [{[]}, {[@broadcast=0xffffffff]}, {[]}, {[]}, {[@multicast1=0xe0000001]}, {[@multicast1=0xe0000001]}, {[]}, {[@broadcast=0xffffffff]}, {[]}, {[@loopback=0x7f000001]}]}]}}}}}}}, 0x0) 2018/02/04 21:33:30 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x0, 0x0, &(0x7f0000a4e000)=[], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:30 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x0, 0x0, &(0x7f0000a4e000)=[], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:30 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000cf5000-0xa)='/dev/cuse\x00', 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x2000) syz_open_dev$sg(&(0x7f0000c0f000)='/dev/sg#\x00', 0x10001, 0x2) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f0000cd1000)={0xd5a, 0x8, 0x1f}) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f000019c000)={{0x2, 0x3, @loopback=0x7f000001}, {0x306, @link_local={0x1, 0x80, 0xc2}}, 0x8, {0x2, 0x1, @remote={0xac, 0x14, 0x0, 0xbb}}, @syzn={0x73, 0x79, 0x7a, 0x0}}) [ 82.998532] audit: type=1400 audit(1517780010.711:73): avc: denied { dac_read_search } for pid=10724 comm="syz-executor0" capability=2 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 83.019463] binder: release 10719:10726 transaction 124 out, still active [ 83.030407] binder: unexpected work type, 4, not freed [ 83.035731] binder: undelivered TRANSACTION_COMPLETE [ 83.040925] binder: send failed reply for transaction 124, target dead 2018/02/04 21:33:30 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000f41000-0x8)={0x0, 0x0}) close(r1) ioctl$int_in(r0, 0x5473, &(0x7f0000ea8000)=0x1) vmsplice(r0, &(0x7f0000a92000)=[{&(0x7f000048c000-0x8d)='g', 0x1}], 0x1, 0x0) [ 83.079787] binder: release 10751:10753 transaction 128 out, still active [ 83.086881] binder: unexpected work type, 4, not freed [ 83.092192] binder: undelivered TRANSACTION_COMPLETE [ 83.097363] binder: send failed reply for transaction 128, target dead 2018/02/04 21:33:30 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f000085a000)='/dev/hwrng\x00', 0x800, 0x0) accept4$inet6(r0, &(0x7f0000bd5000)={0x0, 0xffffffffffffffff, 0x0, @dev}, &(0x7f00007a5000-0x4)=0x1c, 0x80800) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f00004a0000)) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000026000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00008bd000-0x4)=0x9, 0x4) getsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f00009fe000-0x28)=""/40, &(0x7f00000ab000)=0x28) 2018/02/04 21:33:30 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00006ee000)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00000a9000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) readv(r0, &(0x7f000010b000-0x50)=[{&(0x7f00007f4000-0x1a)=""/26, 0x1a}], 0x1) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000f92000-0x4)=0x0) waitid(0x3, r2, &(0x7f000057d000), 0x4, &(0x7f000071a000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/04 21:33:30 executing program 7: symlink(&(0x7f000073d000)='./file0\x00', &(0x7f000008e000-0x8)='./file0\x00') mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f000079f000)='/dev/vga_arbiter\x00', 0x2100, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f000026a000-0x10)={0x6, [0xad34, 0x1, 0x4, 0x1f, 0x1234f83f, 0x5]}, &(0x7f0000e12000-0x4)=0x10) getpeername$ipx(r0, &(0x7f000071a000), &(0x7f00000f3000)=0x10) syz_emit_ethernet(0x102e, &(0x7f0000da4000-0x102e)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, [], {@mpls_uc={0x8847, {[{0x0, 0x0, 0xd3b, 0x393}, {0x7, 0x1, 0x1000, 0x1}, {0x101, 0x6c7, 0x2, 0x9}, {0x7ff, 0x553, 0xb1, 0x80}, {0x6, 0x10001, 0x0, 0x100000000000000}, {0x0, 0x0, 0x5, 0x80}, {0x4, 0x4, 0x9, 0x3}, {0x4, 0x2, 0x1000, 0x3}], @generic="d8267608bc54d0de800cc558595d85c47fda24d8fcc0e3f59bd3a932b4c5e10561f6bf32111e272eb45b0ed4950260d1b8a24c540034878cd1353a0ecc3adf7859757e2146e6960756ad0562a10901a500988a1dc7fa8e706652d87dcd318a7e62ba2d5b47376749609f76cd07b3cf86559916005458b6ae1ce6ac0659b598edf1f47e0334a90a27d17e148bc6e93131cfe693d00a45bab229df33056d85f474f225c70176d89b365d46308d6cbbb20be931b075099f51d737f84a58cf2f2ddcce4e19bf27d0fb26cde44c05289ccd4c5498a9e13db85a6b9f90875978b7c9ce70674e3894559a702d62f26a72ff7829898b9f540e0fd941be3798b78c7532881e83c3fedc49e9420d2377ca5def9b0f301392ee7dfc963150715964d0ab1955405df4524c4a50ee1b971114193a05bd2a7a0ea2619bf5576190e6b25533dfa3844023b78994be1730f4e34df441abe36739280fa3412e41e01fe66962c50e79df23fa70acd2736cc8ca8936fd5e1623dd3de779aa73dda1c6490d473b25a59efb9d1693819a36ee9be4b891d475bc193af5a7006cc2d0afa0d9ce2e2b249b8702790d7a290dddbf0960b0f343de1f9e06afcadae2d55de807526c6064c829f4afd671c81f5d6ccca09070498c0299ba0d92e7602ee6a789653dacdec23464a725fb3ee51fe784b1eebb2b414690aa402610cffbd73a2a446425a4f8b5c83ea8e080af79c18b3b56a90f7babbee958005009ace4338b976a93c1f2f9e1d61173eb1e1943e3edac9f2eb14d14cc2c8520afa215c74b9af8a764bc3513f543e2a0d34924af6940b7e9607ed6041df10e40ce2edcb5dc06506a2b1d1e08defbbe830add42e564731fae4ea5783fc7e78a8d5304fbf73190c70f3f72fc3dfcdf64771a9c6ff897d1a291fdd41da2499bf75e4048f216c708260723d5f284cbb4ee168eb816eee702ca275da53c6f372cc99c208d97d575b87e4411e1dd7e25ce5c8259340a11124a1fbe887d207313344e7e8dc6d6c521d60b88b34c97caff24f08aae8b961c0a390d78077ac972c8f466348db8cb482bda9aae9122c198c63a059d66ed1146d47371878a94b311b368d328da91f5b8181363724ef3684bdbecc6274f6ac8d3b42eb2654fe0c61b96ae22650c950057fb3d584c2fb60bc5cb96fbf688fddaa91de50a250a5627a8126e6c6b2b729d33be43817520f935627a4f7a2cc3922db8fec6495d8da2e77bf87a0bef979ccbbfe2fba46f20a80948ebe03dcbeb48564841817ee3a751871677019c8ef1293fd1948c280422e48672d5283f7c9e64ff7cab852056fc0723e7c67697554fb7c8ba2f1544ab46430f9f3546a6a9bf1afe44a7e924460e9b18dbdc3bf13abf40adb585efece50795c55b98b9d2491ca45a585f57c4a76d6bde6c40bc3e2b80568c03dfdae9ad51d6a8f497637c69ad9b33f4550899a40e41160576e6d90b4c30c8f41b315c78daf6f517d9dd5c83ff4b59151685e00303bf3df44e74a6d3ba37cbf7b95bb817a2fbbe8950fb5548604b7a203f80ef47085af7515676d7220657f9b2e447296f4aaf4fdd7151174decdbec5fbefa992b859ca5f44cd250ca35707660449631dd1f809cc95209edf70eb0dfafac8e9ad3216dbcd6757101ec6d000fa1e23a29e3a0dc647d595aa270d816d8a9114b758982f8e8a464e3690eaa7a19db83fbf04b731a0f01e384faa133919c2d2d4fc49250be83d686bfd4f9adba112fd46ff863b80bd814ba41b20cd72f3944862881e9b924370ff7901713910fbb2261865fe87c5ff0a9202fd2cde497457306a90146538e46e02161ff9cf64570a9acd34dab85ecc03bd3d36932405742da3f3aefe4f6fa6a084c285bea4ad5117beb220d93509b8a3c193eff555f5153d530c7d4c0926c6e867db62fe3012c93a6fad92e806ac9f3be8b5b133d0f179dcd2655cfb304fec10245457af1dee2930573216de81eeee780e112f99f35fe432b8ff6fb80bde59c3277756ffa8c0f08daec05dac9892c33876d716789ea47aa2c87ed5f343ac78577ebc5c5cee3764997ec93c19682b85b62f3df102da0d73317a1cc597eed5b96077bef74913efe517f28d2bee43b5a076eb7c38abf42040353b153529fb53f21501557d0a4351601cdd1af2ca4cd40970d38360cb677908b66a881dc5bef9f47b620b8852284ac5174894a54488a622d7b27c80abeb7f4891792d01a5b469dc79c77c50e2873ed0cc8ca2b20f679bb5503c11f71788ea52e71d2afc97aff2e07caf857697faceb5432b0197425963a6105e9f91fdd7e3420e9af947d3cc180ce6aa56467606ed70cb9ff82cda9aaf9169adfa2c9793d38f7aa8a532570a85ce235f588e6b4d600f6fc86470d9e7b7b6fec2eccbecf45072f475bdb4de324807d89fd44936de1e3fa8e74b05caae489a4f6c90213b2a9d0d6089186be473228ada73543a9469d173877aed3aa78fe8a24e91169e682421dadfe0dc2a6e052f7307ddfb9b0f8bf51a6e58ddb37f37c1abc7aaab7c8a9ba0ebf12194638af9cb6e4fbf1a144b631906c0e6198cd5076ffa12a3b1b5ab8b421da7ec34edda5070e38b33bfbc2b879c8245e868a34d3661fb181de29d1e558ad3293f14c15d91ab1ca4c93d83203874ac78ff7319746daf0d827f9cb254d16f15f5bdcb160c8b3dd1b8267e9951623eeddcdbdfc40032881bca23d0e97a7b8b1b24cf4ee66c4a4150162c23b8d134f4eb3e2cc98e7760b3298fc74f5dd450529d527c35a089f0bea02eca35eafbffbd9ae2a21895bb7ac173f09e51182a2857eb120e4436460a8a58cea3c43f3f2943dd54929fe6edd351aa88eba2fe3df45e042c76da953675d9abd9b5e806372914af89a03e88c2f0c857e9eee46429a3f697e2dd2ed1071bb0191a8407086ab1f04a5aca6dbddbb67f719d8da01cfe58e65a80edbba16bbac0c061c19b0ac98b705a00251823319ff0e7cf077c6ba04bd7c1cd6b2d92aea128770c7d9aece06fb597a03421df0e31ab1bf02839f8faa9413b07010d48d86e621a7f9e07eeda9fa6766e8a630faeb2ae059424b71a74c0bac06709ed85887a1f01e33674b370a94c47a7c7714e5e07ff918c28134b41cb97dc086929613e7a412fc9153de7589305a5c854038809fda6cf0ece6c33c2ef41cc35dbf9fc61d387b82e46d4c71f17a9138b0a2b2ed0f59be406b8c05bc312a8be7609c4f6f173918509e16a1e3b9df3bddc90f7b48cfe3cd87eb681c50a97ac192537551cbb1b0890f7ce282b4237d39f8f2de2e98f4fa60f85baa53232f7cf50c373265220fe3159f4e1c84476cfcc6dc56e185321545d0f518860032efb66503aec5f7628610308b5ca928be79556362aab1e9cca704cf021b7fa1578814bb6c94497bcc8c9affadb0a4c756c03a00221109de250385874ce3143a36a1cbd5e62a3784d601f96394953d0d2a21152f0a8cfbd3abbea65371fd5d38318fb7c7586bc88dee00914a46ac9bb4373c66800cb7b829dceed77d3af65c782c8b7b8fb53837a100347cf5ee57d57cd95f1cd2ea815affa2ef9ff41dc0f205f42aa22cdd2c9e097691245a2103a719190b7fde6eb3f983c57b49d214c493f4e6e8e3b462a124181b53b9e6ba2a4a18db4c8228ebb3ddd10878c9f093f48d652539a22e5adc36438e4199864a359e9e46b76c523f3636a142582a8ca35a7dff648c4d3f8e4a0034ed90b0026c5499ea72c43aaeff079752276f0b8fce7aa3ecc2fee3d4913498c25a88a99678428b054d778dba68136f27363484b3d788b173ace425e30efdcb1f99d10f8ca46693c1d3eda76cd737ac6b9dd51075530c5bf711e89e3206bc6625bdbe46171b4bac2b3f2ce932ca9a88b97108b1504dc94b2a5ecb4f16f11d8c45b0c20f7e761b744a2226f3e1785b68328c2b15d63839c97dc9e50c22428959b28644dfbe27850b291089ee1ca8554084e9f58b3d1da3375b35d289406400490c6a6a8e466368a2087e17423f3aa3d9a5b7f5bfa9d2a0ee8746d0694685ab52a4ee41f34bd40141ff569fcbdadffd8e2452e800daf2d63a5ad0704353b2db85a5b87c707a2abafb61b943c82a099ec64903d15d38edd570ea93ed85cc0275596203d7f91b0bb1fc57104038dcc7706330b655e8a2f12396af34c96d99f19a7891371a492402f40df9e0a9ab023af083fe35dea205a52b66c5b08952ab1b9d2e0ff1ad069cd2fd351a71674b00dcb8a633cdc28d48329aec03b453e856c6141655460c075f01f291a1ea99cc7127fafbb148364a5c628a56abeceefbda0bb0df3f33858eaa6b7547f49edf1517af3d5c04712d9751bb85bd3cb9c750478871e32f847b40d1e9b9576f989b5395f81c2a26fa42e7c83cc0e1ce94f9a7f8777144dada34ebae01a71dc7e663a254c7e0abf5938e35110bc6063529f9cba9077e0605b5774221dd9af053664f4eb107ac5f4a20024e853fbeafe24a9df72bcc2db6e19dbdb7176238ed4c361615717fe04662dbccc78c1099162191b26f92b8feb3f27250dc32d78fc1dc66a11baccf273cbbea61a6ed7e80f471862ee83a4c3b24708ee5e00f593e15d98aea3852b3b2ef557ffd3dd51775e9f718553bdd34747a00bb7659068bbea03a7b410d5069353b4c8acac0dfe8b3653d86107cdb6ff31a948358c3efc3f54b2998945bd312b81b7c1444fbe2b7c76d58dc3c111bd415631ac2b744b29c67b0fc69a2fa1ae1112a553736cc8d9b34e3b63be7b144b38461dae90ac15de4b00b03f588db1f53e0a3d105f00a23e8ca25e6adf285e5dd20923239734c5d9717f016be181674fe4802f0fb41b460c514f62526ef90b3b251b8cab4ae48b2ede2c62ef98ddc32cea5d36ed75d6689b851bf341ca05d9b1cd28435a3cf179c8d51986dc15c8d4e8f472205da722acf0911ea914daaf4ce8854cdf4375bdcd1a87ae1adb44e58f1d913842841ec1dcee4ca28a9c60fb73ac70c15f22d7818488614cdf9385131034d97a53155a3184a29216dd503e8daffebe1c77267d4eec2d3f6ac46e63212b7cbf2f14f73255d681a29bbfcb3eb3f767140c80c2a1be1cddfece1dfbf283cedd37a4830dd5000774d896b645052f8c12ff76670613f96cd7f2cd6ce500759d93eae36aa11346723e83a5bf7f2f163e7cf321fd756939a75992fbfc4c6c20934223a25035fd1c407e25454a9de0f5f9ee5e277866c3b139d191d838ec1798588cfdc77b30c9c778473ceb15b28a08554a31380aea2c20b6831d519a697bff4247bc7c718c3d9e123629387c2668c0595cc964cd87c1d940769f96551e19c5cfb7ae79fedf786e01c8f585c2c4bac7a251f8ff421e5f8048006d2175fc0db81371b0e6ef0bff50428e29d365eaca7e3ea01008a178132d5efdaeafed3761f95aa27289cb2d40ec26d43c8683374cf6c5ff2ef6380355334b7a7300345e7eb3df3296096470967f0f843c8e4fa34fb0571624d7a03a736568b35eec3e6a65ea362f66a44f13b211f7e81e56a5ddfcde2c8cc5943b902d4232a183463f48b4dc5759febaf341c5176523d06889b01d7dddd4a8655e7baa483606f9351be4cd82941af1037afbc38c9aed2fdd3be7573bd380d31b660bdcdfa5b357ed2a7e403c0d83547e4859eace6f43356bcc6981da4d1440df9018b0f36783a53aa45db7c0004ddce864819317d591c5f1f8b41724f0e4c33b1549c3f38cefe568655b928df49caf3fecc7e4c82bcd2c60633ff1d769e09a04311c0d791927a7b0af7bb39f5733123066489ac01de01c57c4c7e6a"}}}}, &(0x7f0000b98000)={0x1, 0x2, [0x76a, 0x630]}) bind$unix(r0, &(0x7f00009cc000-0xa)=@file={0x1, './file0\x00'}, 0xa) bind$inet6(r1, &(0x7f000047f000-0x1c)={0xa, 0x0, 0x4, @empty}, 0xfedf) r2 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) ioctl$KVM_IRQ_LINE_STATUS(r0, 0xc008ae67, &(0x7f00001e3000)={0x4, 0x1d71dc79}) connect$inet(r2, &(0x7f0000e5c000)={0x2, 0x3, @loopback=0x7f000002}, 0x10) getsockopt$inet_int(r2, 0x10d, 0xe, &(0x7f0000039000), &(0x7f00003f6000)=0x362) 2018/02/04 21:33:30 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fcb000-0x8)='./file0\x00', 0x0) r0 = accept4$inet6(0xffffffffffffff9c, 0x0, &(0x7f000044f000-0x4), 0x800) getpeername(r0, &(0x7f0000339000)=@pptp={0x0, 0x0, {0x0, @empty}}, &(0x7f0000bc8000-0x3)=0x20) recvfrom(r0, &(0x7f00000e6000-0xd0)=""/208, 0xd0, 0x100, &(0x7f0000bbe000)=@can={0x1d}, 0x10) capset(&(0x7f0000595000-0x8)={0x19980330}, &(0x7f0000244000)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f00009fa000-0x8)={0x0, 0x1000}, &(0x7f0000868000-0x4)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000157000-0x6)={r1, 0xfffffffffffffff8}, 0x6) r2 = getpgrp(0xffffffffffffffff) getpgrp(r2) chdir(&(0x7f0000357000)='./file0\x00') 2018/02/04 21:33:30 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) r1 = syz_open_dev$audion(&(0x7f0000a55000-0xc)='/dev/audio#\x00', 0x1400000, 0x30040) setsockopt$ipx_IPX_TYPE(r1, 0x100, 0x1, &(0x7f00004e4000)=0xfffffffffffffffb, 0x4) connect$inet6(r0, &(0x7f000069c000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x0, 0xbb}}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x3d, &(0x7f0000a07000-0x1000)=""/4096, &(0x7f00000f0000)=0x1000) 2018/02/04 21:33:30 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setrlimit(0x7, &(0x7f0000bed000-0x10)) socketpair$inet_icmp(0x2, 0x2, 0x1, &(0x7f000048c000-0x6)={0x0, 0x0}) flistxattr(r0, &(0x7f0000777000-0x65)=""/101, 0x65) perf_event_open(&(0x7f000025c000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 2018/02/04 21:33:30 executing program 2: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f000005c000)={0xfffffffffffff801, 0x0, 0xb70, 0x1, 0x1ff, 0x4, 0x7, 0x9}, &(0x7f0000244000)={0x75e0, 0x1, 0x3f, 0x7, 0x7b65, 0x7, 0x4e00, 0x8}, &(0x7f0000327000)={0x9, 0x0, 0x9, 0x80, 0x3f, 0x227, 0x69e}, &(0x7f00001e2000), &(0x7f0000e4f000-0x8)={&(0x7f0000000000)={0x1}, 0x8}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x4a8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f00005ba000)='/dev/adsp#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x40405514, &(0x7f0000a3f000)={0x4eb8, 0x5, 0x80000001, 0x200, "05c6962a87023e6ec1fc29f83a401919f14b48079ae9f6e6416274e93300663354bea625e55baaa4705325c8", 0x800}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000487000-0xa)='/dev/ptmx\x00', 0x10000, 0x0) 2018/02/04 21:33:30 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 83.132433] binder: release 10755:10763 transaction 132 out, still active [ 83.139459] binder: unexpected work type, 4, not freed [ 83.144778] binder: undelivered TRANSACTION_COMPLETE [ 83.149939] binder: send failed reply for transaction 132, target dead 2018/02/04 21:33:30 executing program 3: sched_yield() mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000001000-0xf)='/dev/sequencer\x00', 0x20080, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdirat(r0, &(0x7f0000000000)='./file0\x00', 0x180) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f0000000000)={0xbe16, 0x9, 0xc0000, 0x1}) fsetxattr(r0, &(0x7f0000000000)=@random={'security.', '@\x00'}, &(0x7f0000000000)='/dev/sequencer\x00', 0xf, 0x1) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000001000)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000000)=0x10) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000002000-0x10)={0x8, 0x200, 0xffff, 0xa, r1}, 0x10) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000003000-0x8)={0x2, r0}) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000000)={@nfc={0x27, 0x9769, 0x80, 0x3}, {&(0x7f0000003000)=""/86, 0x56}, &(0x7f0000002000), 0x1}, 0x2c) r2 = open(&(0x7f0000002000)='./file0\x00', 0xc0000, 0x8) r3 = eventfd(0x5) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0106434, &(0x7f0000004000)={0x7ee00000000000, 0x0, 0x10001, 0x9}) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40086436, &(0x7f0000004000)={r4, 0x4}) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000002000)={0x3, r0}) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000003000-0x4)) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000006000-0x24)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000006000-0x4)=0x24) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc00c64b5, &(0x7f0000006000)={&(0x7f0000006000)=[0x0, 0x0, 0x0, 0x0], 0x4}) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000007000)) 2018/02/04 21:33:30 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:30 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 83.207160] binder: 10771:10779 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 83.228909] binder: release 10771:10779 transaction 136 out, still active [ 83.236007] binder: unexpected work type, 4, not freed [ 83.241335] binder: undelivered TRANSACTION_COMPLETE [ 83.246491] binder: send failed reply for transaction 136, target dead 2018/02/04 21:33:30 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) r1 = open(&(0x7f0000420000)='./file0\x00', 0x440000, 0x0) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000c07000)=0x2) sendmsg$key(r0, &(0x7f0000197000-0x1c)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000328000-0x98)={0x2, 0x400000000000005, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_sa={0x2, 0x1}]}, 0x20}, 0x1}, 0x0) 2018/02/04 21:33:31 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000d9f000-0x8)='./file0\x00', 0x80, 0x6) getsockname$inet(r0, &(0x7f0000f10000-0x10)={0x0, 0xffffffffffffffff, @dev}, &(0x7f00000c5000-0x4)=0x10) syz_emit_ethernet(0xcf, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c71d3e"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) setsockopt$inet_tcp_int(r0, 0x6, 0x16, &(0x7f0000681000)=0x3, 0x4) 2018/02/04 21:33:31 executing program 2: mmap(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x0, 0x2000000008972, 0xffffffffffffffff, 0x0) munlockall() madvise(&(0x7f0000987000/0x4000)=nil, 0x4000, 0x1020000000a) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000001000-0xc)='/dev/rfkill\x00', 0x80002, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, &(0x7f0000ccc000+0x4ea)={0x88d, 0x7, 0x7, 0xfffffffffffffff7, "56091141f8d5350037bba3d109070d16edb62b580e9e48570699627740ec126e862ed06eacf7ce6ea4b1403a", 0x8460}) clone(0x0, &(0x7f0000a63000), &(0x7f0000b85000-0x4), &(0x7f00009a3000), &(0x7f00000a3000-0x65)) 2018/02/04 21:33:31 executing program 7: mmap(&(0x7f0000000000/0xf8a000)=nil, 0xf8a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1000000010, 0x802, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000e22000-0x28)={@common='ip6gretap0\x00', 0x0}) flock(r0, 0x1) sendmsg$nl_route(r0, &(0x7f000022b000)={&(0x7f0000f83000)={0x10}, 0xc, &(0x7f0000f76000-0x10)={&(0x7f0000f88000-0x167c)=@newlink={0x34, 0x10, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r1}, [@IFLA_VFINFO_LIST={0x14, 0x16, [{0x10, 0x1, [@nested={0xc, 0x9, [@generic="7b3bb14b32"]}]}]}]}, 0x34}, 0x1}, 0x0) mmap(&(0x7f0000f8a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000f8a000)={{{@in=@empty, @in=@broadcast, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f000091a000)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000b0b000)={{{@in=@multicast2=0xe0000002, @in=@broadcast=0xffffffff, 0x3, 0x1000, 0x3, 0x0, 0xa, 0x80, 0x20, 0x2c, r1, r2}, {0x3f, 0xdf, 0x5, 0x9, 0x2, 0xfb3, 0x9, 0x1}, {0xd55e, 0x3f, 0x0, 0x80000000}, 0x2, 0xc, 0x2, 0x0, 0x1, 0x1}, {{@in6=@mcast2={0xff, 0x2, [], 0x1}, 0x2, 0x3b}, 0xa, @in=@loopback=0x7f000001, 0xffffffffffffffff, 0x1, 0x3, 0x3ff, 0x6, 0x30, 0x8}}, 0xe8) connect$l2tp(r0, &(0x7f00007f2000-0x2e)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x1, @dev={0xac, 0x14, 0x0, 0x15}}, 0x3, 0x4, 0x3, 0x2}}, 0x2e) fcntl$setstatus(r0, 0x4, 0x6c00) 2018/02/04 21:33:31 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000536000)='/dev/vga_arbiter\x00', 0x80, 0x0) r0 = syz_open_dev$midi(&(0x7f0000916000)='/dev/midi#\x00', 0xfffffffffffffa27, 0x2000) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f00000bc000)) r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = getpgid(0x0) setsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0xa, &(0x7f00004d3000-0x4)=0x3, 0x4) kcmp(0x0, r2, 0x1, r1, r1) pipe2(&(0x7f0000fa0000)={0x0, 0x0}, 0x0) r4 = memfd_create(&(0x7f00005c6000-0xd)='/dev/net/tun\x00', 0x0) r5 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x802) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r5, 0x404c534a, &(0x7f0000031000-0x4c)={0x0, 0x0, 0x207}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f000005e000-0x1c)={0x2, 0x0, 0x7, 0x0, 0x2d66, 0x4, 0x5, 0x7ff, 0x8000, 0x8, 0x9, 0x7, 0x0, 0x80000000, 0x2, 0x3, 0xe071, 0x1, 0xec}) dup2(r5, r4) write$sndseq(r4, &(0x7f0000001000-0x1b0)=[{0x5, 0x0, 0x0, 0x0, @time={0x0, 0x989680}, {}, {}, @result}], 0x30) 2018/02/04 21:33:31 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00009ae000-0x2c)={0x2, 0x4, 0x84, 0xf}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000fe6000-0x18)={r0, &(0x7f0000fe6000), &(0x7f0000816000)}, 0x18) [ 83.273757] binder: 10794:10795 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 83.286600] binder: BINDER_SET_CONTEXT_MGR already set [ 83.306094] binder: 10797:10800 ioctl 40046207 0 returned -16 2018/02/04 21:33:31 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000002000-0x18)) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000544000-0xb)='/dev/hwrng\x00', 0x88000, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f000021b000)={0x3, 0xffffffffffffffff, 0x1}) dup3(r0, r1, 0x80000) perf_event_open(&(0x7f0000000000)={0x6, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0xa, 0x1, 0x0) ioctl(r1, 0x897e, &(0x7f0000000000)) [ 83.330948] binder: 10797:10800 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 83.343732] binder: release 10794:10795 transaction 140 out, still active [ 83.350744] binder: unexpected work type, 4, not freed [ 83.356074] binder: undelivered TRANSACTION_COMPLETE [ 83.361255] binder: send failed reply for transaction 140, target dead [ 83.367957] binder: send failed reply for transaction 143 to 10797:10800 2018/02/04 21:33:31 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:31 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00002c6000)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$adsp(&(0x7f00007f4000-0xb)='/dev/adsp#\x00', 0x2, 0x100) setsockopt$RDS_GET_MR(r1, 0x114, 0x2, &(0x7f000069e000)={{&(0x7f0000a77000)=""/39, 0x27}, &(0x7f0000fc0000), 0x40}, 0x20) perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = getpgid(0x0) fcntl$setown(r0, 0x8, r3) r4 = eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000ba6000)={r4, 0x0, 0x0, r4}) r5 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r5, 0x10e, 0x8, &(0x7f0000cdc000)=0x400, 0x4) write$eventfd(r4, &(0x7f0000762000-0x8), 0xffffffffffffff93) 2018/02/04 21:33:31 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x2a, &(0x7f0000d67000-0xca)={@link_local={0x1, 0x80, 0xc2}, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @dev={0xac, 0x14, 0x0}, {[]}}, @udp={0x3, 0xffffffffffffffff, 0x8}}}}}, &(0x7f0000490000-0xc)={0x0, 0x1, [0x0]}) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000373000-0x1e)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000521000-0x10)={0x0, 0x0, 0xfffffffffffffca4}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000760000)={r1, 0x80000, r0}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000863000-0x96)={{{@in=@remote, @in6=@loopback, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000b70000-0x4)=0xe8) recvfrom$packet(r0, &(0x7f0000c9f000-0xca)=""/202, 0xca, 0x141, &(0x7f0000b59000)={0x11, 0x40000f5, r2, 0x1, 0x2000000005, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}}, 0x14) rmdir(&(0x7f00001f6000)='./file0\x00') ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f000046d000)) 2018/02/04 21:33:31 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) accept4$inet(r0, 0x0, &(0x7f00008a0000-0x4), 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:31 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000618000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc2c45513, &(0x7f000045c000-0x4c0)={{0x4, 0x0, 0x0, 0x0, "37cd43b5739f451238fed3a92c238f793f40ea2a4fa7270c540142d7504a1e72625e850165973e198f9172b0"}, 0x0, [0x8, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x3f, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x4, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0xbca6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7f47f508, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x312c464a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], {0x0, 0x989680}}) pipe(&(0x7f0000b92000)={0x0}) ioctl$TIOCGPTPEER(r1, 0x5441, 0x401) 2018/02/04 21:33:31 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000735000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) ioctl$PIO_FONTX(r1, 0x4b6c, &(0x7f0000fa3000)="081c9f859902ef244885e0") connect$inet(r0, &(0x7f0000987000)={0x2, 0x3, @empty}, 0x10) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f0000615000)=0x6, 0x4) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000da4000)={0x1, 0x9}, 0x8) sendto$inet(r0, &(0x7f0000f9f000)='D', 0x1, 0x8000, &(0x7f00002a5000)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) 2018/02/04 21:33:31 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:31 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc004240a, &(0x7f0000405000-0x2c)={0x9, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(r1, 0x29, 0x40200000000001, &(0x7f0000357000)=0x1000000000002, 0x4) [ 83.409557] binder: undelivered TRANSACTION_COMPLETE [ 83.414823] binder: undelivered TRANSACTION_ERROR: 29189 [ 83.439503] binder: 10828:10829 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 83.445848] audit: type=1400 audit(1517780011.167:74): avc: denied { net_raw } for pid=10830 comm="syz-executor2" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 83.465078] binder: BINDER_SET_CONTEXT_MGR already set [ 83.471565] audit: type=1400 audit(1517780011.170:75): avc: denied { net_broadcast } for pid=10825 comm="syz-executor4" capability=11 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 2018/02/04 21:33:31 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000f90000)='/dev/usbmon#\x00', 0x3, 0x80000) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) socketpair$packet(0x11, 0x3, 0x300, &(0x7f000063f000-0x8)) 2018/02/04 21:33:31 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x8d) socket$nfc_llcp(0x27, 0x1, 0x1) recvfrom$inet6(r0, &(0x7f0000fbf000-0x93)=""/185, 0xfffffffffffffeba, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f00008a8000)={0xa, 0x3, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x7, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000915000)={0x0, 0x7f, "cc9ddef4ec47ea5786729825103d572905b39d0ad6713db022f3c7543cca9fca43b46a6fa7ce8635a2898e53e5f977d7f3ed4b6da29d0468880a7b7fe48e1aa7ef31c20da541b92ede57b634e0c359bbb8616914a926ad0041ec99b8f161722f8c628dbbaf819767d2214fea71cb47dae6abcd885e86254b8125a7011d5e42"}, &(0x7f0000433000-0x4)=0x87) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000eea000)={r2, 0x35}, &(0x7f00007ff000)=0x8) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f0000868000-0x1c)=@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c, &(0x7f0000fc8000)=[]}, 0x8000) kexec_load(0xffffffffffffffa3, 0x5, &(0x7f0000314000-0x50)=[{&(0x7f00007dd000-0x2a)="d9cedac618bc4e6a1d58bc88ab42215b9642ce323838cd9b9c8e1638717d62e43a45aef4edf690fe0623", 0x2a, 0x3, 0x6}, {&(0x7f00000be000)="fcaf06b18454f0fae9c7645ff11c9b85f034d331d49064756b2b40de644f334ade5a25fef9c6b7b2fe0df43f664b76314d1e5ff6ffb22f0276b2c1aac8331803c36ac408a566a9aba70c1ceb7744e4d719d36d6079e5c7c79ac3e3fca6c3679672543ffded058a16bc2c73aaeeec55e68016c3061d6780b2971f70a8cb2cc749a57317f969a66e31d991576544f3e37aa5bfc446fe8ae73a9990f778f679796cc8b608d7ed7c805e4f0e4077e9e04c9077b74c03b2958f22b3a9e9bbe4b4d3adb8a7b79daf6f133259d3566848c0cb3135135ba24ad5e64f0cc7d70531469273d36035661d54a930b42196fab19d07bd920820a978840224f3c7277fa28e0095910e5b06dd65a814b0f899e087a9f081df824f963420f58f471ab8ea3ee9f81824aea9f05a292013235371c346d442cc244c7a67fba21a610e2b735327e9d9280cdd41a66a46ac0741a1152a9205598c237bf9e7f49cd1b4b4c4aca2847a3309209eb3a89a2dbe00606009f57ed485034ae3d080039f85333bb40bd53d185c789047cd30bab9c54bc3211a4dc2b8110f9c318e85ee1fff3010c34f2f823dbce913dfc09f6383588eb1e831d52b4f3a0ac9f15133e2b2cc75baecaf4b137832f5eac473f44e06951ffa6cbe864677c9007243241bf63b1e2932ffc071b841d5455be287d0aabf6d072168c15c3ba652bb9c6e437f331ef0b9b8e4b2650452aec1a00e027bd3a3fb66a94876cc6ce23bc349625e3f834efc5767a7e1186c89759617817c5402a54bce5d21e0d0a78d531670e03654327b84b756f185aafc146fdf5a3a84ece55e8655a7bd1f604ab8e8df4b4e749f28595ef47cf103a22a0e8d563b292c7e3be497ba7c19249ebe1fff233ef3d08739fea32a2ba03e6e44b11e635d70e2ca46ba5284402ff47121b44aa996ef3dcce3e9bb3bfd85cbe380dabcd57a603934eb98caa73c2daec7736614d6bc813f39852b4af25195e4d79992e5ac5e08ef3e396dc989a12e979e38685fb30caecb915cceb82c3f6a1489b20dc16f748a3d8ec2646cf8ba8a6505649cbb7b052029855b91fa079718e0b7d6b4121a72a44630fbb37d3fc8f95b9b4550e32678ed11b41162c6ae0f93045a81408ff36a00ff0daf9681562abd0f2ad937bbaaaa7323c629e9f557953426121639012777a64754a8dcac39d8ecec374803d102e77be4fd70e8827a1ccf3dc2ee4a4d79eda7545104d16d0eec15d18a4b1b906dd88abf609f3073ded434036387b73724d1e7e42ab15912c67e9d648542877d43b0d8d7dd6c611c60afb4821c5afadc5687d896a8128ff1fddc13b05ee8d966df5073472ed1bc4d7f6ce9cf3241a77034747029da67432baa525b8a63ab1e9630902f88f2ddbfa0043dac03d5b694e1effbd9de854a211a7c4e59b7d641c41d5da0030f2cadc1947dbc0abae7422185cf5ac5bf8c09b320abefc8ed0c0610bfdc0cc3d828e3c828382c77456e147846cdebece160bba782c01ace194ad24a4001378f1cf648cebfb356eb2fc86baf7d168d3143ce8697f016c0569162b868f59d95ba267a729895651d8b51f08af7c47111e9f6b7a16b4e2cc3939caaa42a0d96db4be7d89f0128d5b6ce2e3e14c0b2a8ee55dfc206eafed100b505abf1dbcea805083c16a5351168b804486099b266d87e34c5bc3cf3b6c41ecf14ccd442da28a4fb78be0171846eeedfb5db6c7630a1097df182126977ca9890878e5141caae2844f863d80b6e574b91c9cf14ca82f3a072f9cfad2f43e134321d2589003e78df38a6c16f065d18021a3c37b0fe9a98beda38fac47869d1ab6ad22e4e57f742509aff44b853a57141d3a0879eecbd1ee4fb021296ac51c966c3157dd7732c527bb67d3e2f74d4c12b2f57cc5894bab58b751dde5ab5c7793ebbf09464272b8236b6b79e5f809e882fa10e6716ca836742dceb222ef0d85e5f782797416d1d3d5e229e0819671a5ebfc7ee1dea331e7797db59976e20585393c6f80875d06b5c1b121b09acfc42930527c71be4f202454f4c5ce4f2526eea55a53b90636bb54e53623135a4be6dd3935b91031722bcc7d0f94d7d8f6f807083c06a01f7fce3082cc9de91b286484cff9cf40f4589659c950c6ea9bdebd1ecf5af160c57920d32cc78506530ca90f295b64e771f6657c55075e0b95161033a2bb278251117ddeb0c050809b711f7d5ba7b9c14d5be8c6bb37a746687e3fef8cdcc374ca5351c4d4d6deedfd137b08f756a98cc12b963272c5a3cc85f49f0221ae305999176f25ab89aa1caa0ef338384f9a233b5e9f68548f543c0527f2c8d501dad1477d6a68f2b1b05ceea562804d6a4e73b10883b082a408259af9b28352cd912c1682b355507b4d1a2652ed4ae3fc38e63b8f3e6f88e5fe1a2a09c1302ea96898084d99098ff75c7cf7d88b88c75a795c68728dcc6374a19d3a1f3eb30662f05362d24b99713b8d1ec7eb845373eb2fe7fc2a9a5d25e0b8be47bb15748020447e5ea13326ba5d12314dfce548af03d10afbebd6b8b6791358c58e68eafc2aa8323bafa8ffbc1c934e22ad5cff219e18de49c41b8e668fe881a732fdc8f664209ee559f6cb5b0abdd4d72f53b4989969b4b162729bcbf463c9c0f1418e4c2938f22cc51314360d21caccebd61f23c571bb6972b0fb034f095664209c1deed5627f18bad2c47204739fb14f7f16d61f1a44c0134f48b8b2d2d9b7b3c208fc7eb22bfaf3cdab7bfa77eb2cd835c546484a56b5522e0c0cb24922b572ca813693057f38ae3751daf46fe40223f2442a3f8fea04a0741d274eb97f5c056e617059c3ed733a4653be9d652333abc51abf8554df06a4c9c50726c4f400dd60bd9fd37bb744f2e06c0e5791438e1bd445d70ca1f2bd8ec5982b702b616674eb9a92f2bcd731b740cbfee99c7da4bc6ba220a53ad9b4676c15ff50e46c352aa4553b384e284e1804ae4af468f3ba1bb7bdb2c5b514f78bb3c02c21f559b3844e130f89fa2f3de245af5350fac6d66a007ae9b100aaf88241682b8418c6d0dd2f78ca5b47d2ccd75161bb63dfa4d783adf7b598a6afcb01819dfc194aec1df12f0be39983d4a811d8141f87a0dffd22bcb96f960b8357813640711fb6fdefbbea677376a1d36e2487c985b6cef331b8bb02c0c0c630ddd8168bd13f20750c04ecd755f500d7576f1976cee79ba824ce95abcbcecd84e5f6fad907c6c2f02ce63f27e840b16b51b9fa2a304440fb56ee2844a9c8c9b73673627941fc61cb5d4f4bf2ef4f94aa405688559f77ed1349e1fda2e50c5f1559cf83a4309076c69cd36f62051108adbbfff0ed518c7fbc57c97e28405b203a52d8653a8f03b2b0aecf8037edf73403c63ab26e1d4e63335698cced26e094f61b149afc1876a9c0453f54fc9591f34c5a9171fd84bec23b643ddc5116e32991a6e865b7e193f586d7c54ca46be6279c09c1dceca8b9fe220b71a5b7955d5e45371aada418835161d13eb108d2989838586a956c4da2da83e9c5db1e3ce5220b561f1f8b189f0d2323ddc699d8333fdefbb09c889054ded1b48b2bc2f66049c0eaa6b7d229a1c1535be6c7822a8dfac878b3a266c37fb1efd862bb756022a766cd7fb5f6dc8977067e216f5ee7af37f2556dd53d6db1d073ef5f9376227f29a95ab473bf9448f74928a8537e0cb8f9c25f90233231a5c3aa6261fe1ef769f00f4275c5081426707099b8770dfbbc12652d33447392204730cc731557448ff9f1829bc2ddee38bfc9a832336fdfd3b7c6ad5bd089e5a4e44e7ca0e175a1d07ba7b3c6b7715e692b076618930789551b67b9bb96b0bc5a87af928f82ff6a110b2f27bd81f90e9e13b1a64994b5419f7c8c377cc9f0f5134a27dbd1b9aac9e34390ba99d2c0e05669ab51093ea56974c7fee2a780cafef833d4a6c1d58c228ed2fad07d4e98a1db30fcd2e3870f5c7a44e1e2b2cac769da71be7618a0372826014249bef413767a7da19bb2da2eec0206059b45494bad9b8cb8bf2924201fade015da7bf9b67c9e26dc88dc26f97b33468108742b42973fe11c07be442f4cca4defc94a792b08f495f090a189e66fa8c541b93caff55c5511c75eb20d20d6c56348e88fbc866003eba480186604a6d92a3a481ae15255db5c09bba5e5286c3ef9018620f0112a5c6b8121dc12e696aa8e27a7a4b408fdce2572c0d430d362a99f6e402ee625b47f0b367f22c760e69e24c159da2baf4761c16a4a7336bb95d6958790d278d277aed39f6730de5f3cbd3fae223c97577fb281dde93d5a458883166ed7486f725ef47f0ba9e37631625a1aecccad69e742a00d4c6e789b2c6cbacf7c0c8066d35abb4c42ed371182cfc06e69acdf1b31c6510e576766c107141e1d5c24aad061dabacea08675b30c635f8cebc667048a0b5b7fdb57a49f1d69b4f42127b04654e458834d02df407ebd4782c6a36ba13caabad47e534c16fa09071f82c17f237c8ed35b8ff8ce00f4d01ec7c8a6bdcd1a384077daf4239e9873c07284febbda85ab4d1484a21f23e1d165f158a1b96321b6fe06dde31ffb0a4086b9c0ad6cbcd82f7e3ebf3b47e23c9f751ecca1849288460bbfd7a9848a0be0e09fb75d2ca809e7f73b79ac8dd3069f5dad42e3716c5e876bed403048b6703fa864e364e9bde5c09ac9f7e67c44d3aa93fac01a7df92bcce6a4119b2ce2d0427d79329a5ea668856651a385f33deccbd936f6f8c6815be694e31824a6d1eb76135118f37f9ffb88200c6f50960c2a8bdc0cfff3b565df5a1e8f75725bf1e58b365a6d69150fa6653c4842beeeb3fb97aea6e6e3e287a02f56070955a30678a4ce89dc75978f27b7185c60213d7b030c0f1caac80abad1180b8c1aa91cfe2092c0249244906449b86f1cf0a71b1d09cbba418af919fe61b59c592c32f63e70bc2f45caa31ad46c265ceea77f7cf65aa315d862fd4d62093d31459d613878b8f202cdf75c5e1af28c31a04ff01f8920d51b1ad7c24e7f0dd543f0f72f81a64f35985f3363d38286bae2ed0f2c533f5d2abdd00c9828e2bba3e61d9acc274fa78d49f24aff0093bdaad81d1334528dd97e673ed31cc5fdedda46c0ac26bcaed3c35160d7d971a8f90aca244a58f2f61e98a5b183558ad71fbe19fde59cbaeb84bd924ae4486327c4c3d92a3968e89d643fa613171ac30c42466278b6cb5a1b10a6571aa3674ac5d25b6ba8f4307725d649032836bb80d94578b57fb3d6f2348f11196b4145a87c958bd6bc12806c1951802fabfb09491a7fa5284a74a5363876cecfeb794b3f7ee2ca48d96bfb8364ebb84ee5e92654577f26facb41f396670f61c2a899e220c9e0dc98c13e5b722d58c7c9db64b529785333040ca4638eb7fcf1579009939cc42a4af9c8a306437387a536e100ecd7053974c1c0d02f175d8fe3d47e8d6944f11229e2a548e2be63ef2cac06a3cf8188d9b95abfc6a7be5e7eba0e1e9bffb4cfe5e515c06d29f9c34e217094444935c02054e80a64930f7325b70d99266d136097ba8801e451d19e8628a8626552418ee4bb67eab5564bc8dfe1b8e8bd65b13b81a8a8060eaa0946d6e9ed5e1369e8a6bc774e83cdab1252abe99a2c1ba65b8c61757514d059e32cb06b2e195ef6bb77d6a41b5c2e7e8241a487da8d150008ef8fabed7af9635921c01565a6cf6bc2df9e48d1523f0f020c09aa321b5b80b57c1e97836afc7f6ea9631e7e6d60a49cf1d1fc68a37a5b49a2c018fc5c1005296330b25004b3cf809883b742e29923920e89b6a4160b9934c43fa6faf1842bc1432b8", 0x1000, 0xbfa}, {&(0x7f0000e53000)="37f7006815b7765e1ea935301ea84151b69aabfe620ef3399d4e5e73a7ec2a529d60cfffec03908d680a40817cbcc8b1341f726b7d25cadd3970a215f4fcf147dc812de1b91891bd02af35175e5ff29ccd87b2f17e4154747108bf57363af05d879442ccb58dd1a384ab5378502e1a1769b98dcc09120fb51ab1d71967d6b4a8b735aa18b3577ea52b60261b21e703bbfde44b5170bf6815aaae197d81c5b35e224a436537e69d820e0091e1a21a53af9e1d592a634e8450cc268d6dc5a0af4c4073741fea3fdba7c79bfb31921327db8a87b33d6749b22ffc4e765692f990858fcd4a9f9f", 0xe5, 0x200, 0x2}, {&(0x7f0000bc9000)="f0e207c8e8ce427e883307a2651a56ce6a424d3c34e56299", 0x18, 0x9, 0x2}, {&(0x7f0000d6a000-0xfc)="d5f588c8a4dc729180e1e3e9e2dd09b39ee797dbe990d9ee27903337257de3fb78190ef2d05414cd412164e15524072521473764051f8f71301059c7f80a5b7d6cec2e30ecfa8847c9f12ed6662df5565bc8bba4349842ba8e67e269e96fe8acc9f0e6d5533369971002bec43c6e7f8ead18a85071525c29d57bc8319cb9092b52b64a341033b939a839b00dfebd83a3368575903adf3ede8335e3faa4553b585537306b0de2c898dbf70a4f8d0d1df28ee1f2268cb7079e8e791251b6468e895d8a66e80f7d69904d6f9b6282922fd7cd9f76e58af44f5d3f638032bc81cccfa5217f0a830bdba24cf0f139b17daae99e864ed5491c7fd914e14cb8", 0xfc, 0x400, 0x1}], 0x3f0001) sendto$inet6(r1, &(0x7f0000b0d000-0x92), 0xffed, 0x0, &(0x7f000001b000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00007e7000-0xb)='/dev/hwrng\x00', 0x0, 0x0) ioctl$sock_bt_hci(r3, 0x400448e3, &(0x7f0000384000)="fbdc1aece548528b1b6df5b559c2dfe9bed71cf9c905993a00da1d84cea7774ea0deb259c0905c299a2b0ac450f45b9da00a9c8e52a9594dbca74b53ff90d7b8149c8a93142dc48b7d64598caf15ffa5ed1b50f8157a29ad737508759821d15bfa8535740c29289ae249cc019b10872f90ce09a111bae27cf95b292b76638554aea4ed3fadc2b4d150e4") getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f00000e2000-0x4), &(0x7f0000fed000-0x4)=0x4) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f000042c000)={r2, @in6={{0xa, 0x0, 0xffffffffffffffff, @dev={0xfe, 0x80, [], 0x0, 0x17}, 0x400}}}, 0x8c) 2018/02/04 21:33:31 executing program 3: mmap(&(0x7f0000000000/0xf1000)=nil, 0xf1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000008000-0x10)={0x1, &(0x7f0000005000-0x18)=[{0x6, 0x0, 0x0, 0x50000}]}) mmap(&(0x7f00000f1000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) io_setup(0xffffffffffffffd9, &(0x7f0000057000-0x4)=0x0) io_destroy(r0) [ 83.513207] binder: 10832:10844 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 83.555481] binder: 10832:10839 ioctl 40046207 0 returned -16 [ 83.559805] binder: release 10828:10829 transaction 147 out, still active [ 83.568519] binder: unexpected work type, 4, not freed [ 83.573838] binder: undelivered TRANSACTION_COMPLETE [ 83.579074] binder: send failed reply for transaction 147, target dead [ 83.585784] binder: send failed reply for transaction 150 to 10832:10844 [ 83.614440] binder: undelivered TRANSACTION_COMPLETE [ 83.619753] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:31 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00001c1000-0x11)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000c9c000-0x34)={{0x0, 0x3, 0x7, 0x1, 0x9}}) r1 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) r2 = signalfd(r1, &(0x7f0000d54000-0x8), 0x136) fcntl$setsig(r2, 0xa, 0x27) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = memfd_create(&(0x7f0000002000+0x901)='dev ', 0x0) ftruncate(r3, 0xffff) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f0000363000)={0x0, {{0x2, 0x1, @rand_addr=0xcafe}}, {{0x2, 0x3, @remote={0xac, 0x14, 0x0, 0xbb}}}}, 0x118) write(r3, &(0x7f00007fc000-0x3)='H', 0x1) sendfile(r3, r3, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r3, 0x0) execve(&(0x7f0000001000-0x8)='./file0\x00', &(0x7f0000000000)=[], &(0x7f0000002000-0x20)=[&(0x7f0000001000-0x4)='dev ']) vmsplice(r2, &(0x7f0000dd9000)=[{&(0x7f0000887000-0xe7)}], 0x1, 0x0) 2018/02/04 21:33:31 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:31 executing program 1 (fault-call:6 fault-nth:0): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:31 executing program 2: mmap(&(0x7f0000000000/0xf87000)=nil, 0xf87000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1000000010, 0x802, 0x0) mmap(&(0x7f0000f87000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getpeername$packet(r0, &(0x7f0000f88000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f000075c000)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000e22000-0x28)={@common='ip6gretap0\x00', 0x0}) mmap(&(0x7f0000f88000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$nl_route(r0, &(0x7f000022b000)={&(0x7f0000f89000-0xc)={0x10}, 0xc, &(0x7f0000f76000-0x10)={&(0x7f0000b22000)=@newlink={0x28, 0x10, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r1}, [@IFLA_VFINFO_LIST={0x8, 0x16, [{0x3d6, 0x1, []}]}]}, 0x28}, 0x1}, 0x0) 2018/02/04 21:33:31 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000463000-0xb)='/dev/hwrng\x00', 0x501402, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000bd7000-0x78)={0x0, 0x70, "c10392fe8e5d66efa7b524673c2e142e9dd70615a8bbb935a6ec70f499516f75f710bff075b9840e2b612db61647c98b9fbfdc494f52bc8a824f8e4a02aa16108b0a9d2061fdd7bb9f0d8ea70db42ad91638e0f763212be693ca39edba316c03e3cc80a981dc970c70dfb2af11b53583"}, &(0x7f000080a000-0x4)=0x78) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000ef1000)={r1, 0x96}, &(0x7f00005df000)=0x8) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:31 executing program 4: futex(&(0x7f0000dce000-0x4), 0x800000000007, 0x0, &(0x7f0000d61000)={0x0, 0x989680}, &(0x7f0000001000-0x4), 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000001000-0x1e)='/selinux/commit_pending_bools\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000-0x10)={0x0, 0x8, 0x2}, &(0x7f0000001000-0x4)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00007a4000-0x8)={r1, 0x10001}, &(0x7f0000d98000-0x4)=0x8) r2 = syz_open_dev$sndmidi(&(0x7f0000c01000)='/dev/snd/midiC#D#\x00', 0x8, 0x113e02) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$GIO_CMAP(r2, 0x4b70, &(0x7f0000001000-0x30)) 2018/02/04 21:33:31 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000687000)=0x5c802861, 0x4) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000904000-0x8)=@hopopts={0x0, 0x0, [], []}, 0x8) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000ffc000)=0x1, 0x4) io_setup(0x8, &(0x7f000037b000)=0x0) io_getevents(r1, 0x829, 0x3, &(0x7f0000719000-0x60)=[{}, {}, {}], &(0x7f0000380000-0x7)={0x77359400}) bind$inet6(r0, &(0x7f0000402000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r0, &(0x7f00007a9000-0x1), 0x0, 0xfffffefffffffffe, &(0x7f0000f63000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/02/04 21:33:31 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvfrom(r0, &(0x7f0000b70000)=""/142, 0x8e, 0x2000, &(0x7f0000567000)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x1, @multicast2=0xe0000002}, 0x4, 0x4, 0x3, 0x2}}, 0x26) bind$inet6(r0, &(0x7f0000cda000)={0xa, 0x2, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0xb}, 0x1c) connect$inet6(r0, &(0x7f00005bf000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000695000-0x2)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "06f526", 0x8, 0x11, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, {[], @udp={0xffffffffffffffff, 0x2, 0x8}}}}}}, &(0x7f0000775000)={0x0, 0x1, [0x0]}) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000e3d000)={@mcast2}, &(0x7f0000554000-0x4)=0x14) 2018/02/04 21:33:31 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000878000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000cca000)='/dev/snd/seq\x00', 0x0, 0x90000) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000f38000)={{0x9}}) dup2(r1, r1) [ 83.694917] binder: 10872:10875 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 83.706358] binder: BINDER_SET_CONTEXT_MGR already set [ 83.729077] binder: 10874:10879 ioctl 40046207 0 returned -16 [ 83.733454] binder: release 10872:10875 transaction 154 out, still active 2018/02/04 21:33:31 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:31 executing program 3: socket$netlink(0x10, 0x3, 0x6) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00006dd000)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000001000-0xe1)=""/225, &(0x7f0000000000)=0xe1) mmap(&(0x7f0000000000/0x2c000)=nil, 0x2c000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendmsg(r1, &(0x7f0000018000)={&(0x7f0000014000-0x1c)=@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c, &(0x7f0000013000)=[], 0x0, &(0x7f000001c000-0x418)=[{0x10, 0x29, 0x3e}], 0x10}, 0x0) 2018/02/04 21:33:31 executing program 4: mmap(&(0x7f0000000000/0xaeb000)=nil, 0xaeb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000aeb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000895000)='keyring\x00', &(0x7f0000ad8000)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffa) mmap(&(0x7f0000aec000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000aec000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000aed000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000aee000-0x10)='/dev/sequencer2\x00', 0x10200, 0x0) ioctl$KVM_TRANSLATE(r1, 0xc018ae85, &(0x7f0000abd000-0x18)={0xf000, 0x3000, 0x5, 0x8, 0x1}) r2 = add_key$keyring(&(0x7f0000aec000)='keyring\x00', &(0x7f0000aec000)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$instantiate(0xc, r0, &(0x7f0000ae0000-0x7d)="b66345e0e2e974dcef54450400c3ccf21245bc31eb524b1c6e41effa7e6f0767be6f9fd1546190cac1f2208578a089794ee01c261a5458982b71e56789254962943880b87e9d1dbd6b2be6bb9a9bb46ef6d91fa8389fd000ca8b9dd7fb6360970ca4c4efd796486db6855813506aab3770788ae888e597660ff861d1d6", 0x7d, r2) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000aeb000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$KVM_GET_FPU(r3, 0x81a0ae8c, &(0x7f0000996000)) syz_emit_ethernet(0x4a, &(0x7f0000403000)={@random="830f70e810de", @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x0, 0x0, 0x29, 0x0, @rand_addr, @multicast1=0xe0000001, {[]}}, @udp={0xffffffffffffffff, 0xffffffffffffffff, 0x28, 0x0, "2cfc37e64002467a02143f2ba4d6712f74e44a59d3aeb03ca5baa2fcb8a678e5"}}}}}, &(0x7f0000adb000-0xc)={0x0, 0x1, [0x0]}) 2018/02/04 21:33:31 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = getpid() sched_getparam(r0, &(0x7f0000e6b000-0x4)) r1 = getpid() socket$alg(0x26, 0x5, 0x0) gettid() prctl$setptracer(0x59616d61, r1) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:31 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x88) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f000048d000)=0xa907, 0xffffff00) openat$autofs(0xffffffffffffff9c, &(0x7f000083d000)='/dev/autofs\x00', 0x400, 0x0) recvfrom$inet6(r0, &(0x7f0000ecb000-0xb9)=""/185, 0xffffffffffffff10, 0x0, 0x0, 0x3b1) r1 = socket$inet6(0xa, 0x8000000000000801, 0x1) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005db000-0x1c)=@in6={0xa, 0x3, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)=[]}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000b0d000-0x92), 0xffed, 0x0, &(0x7f000001b000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) [ 83.737690] binder: 10874:10890 transaction failed 29189/-22, size 24-8 line 2842 [ 83.742067] binder: unexpected work type, 4, not freed [ 83.755036] binder: undelivered TRANSACTION_COMPLETE [ 83.759946] binder: 10874:10879 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 83.760208] binder: send failed reply for transaction 154, target dead 2018/02/04 21:33:31 executing program 0: prctl$void(0x37) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000001000-0xc)='/dev/amidi#\x00', 0x6, 0xc0) write$selinux_load(r0, &(0x7f0000f10000)={0xf97cff8c, 0x8, 'SE Linux', "f6b2d2aaaa6f5cd5089640c837682612c4d12b5feeb07d2deb1ed628a48f9901a4aef5c9331a701e1f57c88b541d32f047c351f53904b8d4e0b4f4a3d7"}, 0x4d) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000001000-0x4), &(0x7f0000001000)=0x4) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x9, 0x6, [0x2, 0x7, 0x6, 0x5, 0x3, 0x8e]}, &(0x7f0000001000-0x4)=0x14) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000001000-0x14)={r1, 0x7f, 0x6, [0x1, 0x3f, 0x4, 0x5, 0x3, 0xfffffffffffffffe]}, &(0x7f0000001000)=0x14) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_VERSION(r0, 0xc0246400, &(0x7f0000000000)={0xa84, 0x2, 0x6, 0x79, &(0x7f0000002000)=""/121, 0x1000, &(0x7f0000000000)=""/4096, 0xa0, &(0x7f0000003000-0xa0)=""/160}) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a45321, &(0x7f0000000000)={{0x1, 0x7f}, 'port0\x00', 0x1, 0x80008, 0x4000, 0x1000, 0x1, 0x2, 0x10000, 0x0, 0x2, 0x3815}) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000004000-0x4)=0x1) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000005000-0x88)=[@in6={0xa, 0x0, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0x6}, @in={0x2, 0x1, @rand_addr=0x7fffffff}, @in={0x2, 0x0, @broadcast=0xffffffff}, @in6={0xa, 0x2, 0x881e, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x4}, @in={0x2, 0x3, @loopback=0x7f000001}, @in={0x2, 0x2, @broadcast=0xffffffff}, @in={0x2, 0x2, @rand_addr=0x3}], 0x88) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001000)='/selinux/mls\x00', 0x0, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000005000)={@generic="3f7d0e5048db9d011f165ef282a9e9ea", @ifru_flags=0x4c00}) ioctl$sock_SIOCDELDLCI(r3, 0x8981, &(0x7f0000004000)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x194}) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCREVOKE(r3, 0x40044591, &(0x7f0000006000)=0xeb1d) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000001000)={r2, @in6={{0xa, 0x3, 0x20000000, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x54ad579f}}, 0x43bc, 0x7, 0xffffffff, 0x9, 0x88}, 0xa0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0106434, &(0x7f0000007000)={0x9, 0x0, 0x2, 0x7}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40086439, &(0x7f0000007000-0x8)={0x9, r4}) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000009000-0x28)={'vcan0\x00', 0x0}) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000009000-0xc)={@multicast2=0xe0000002, @multicast2=0xe0000002, r5}, 0xc) 2018/02/04 21:33:31 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) vmsplice(r0, &(0x7f000009f000-0x10)=[{&(0x7f0000786000-0xc8)="8924054919b532a58a978f70fccac0001f56f5873fb846903bdedd21c886e30944ec1afd1222db88ea1dfa7a4210d6fca9e259e09a26f1c28dbc5bdf0bbe78d538aa6c582058d750126ccb1d5f21eccae8c1c2911ec0c38e06e9e0162795c64489278c4f08b38d62200c27ea2dbb678ecf92f21b53da357aadbf8ae8bd5a39ae68329ab3f05ac250098375847749cb2ea39652bb2823385043da289955ceaa6d82925f6703143ffbfc62613087713b873f339dbd0bf6c096aca6facd9eacea31199612f9a8bbc218", 0xc8}, {&(0x7f000046c000-0x40)="2a1e3e20df5016f2e8348367fd36b18043f36fa56d7056b932816a39cad27fe8060bf0efc4c069a7efd8f109e03437336b8cafa1f67c7045b3d9e040a716a41a", 0x40}], 0x2, 0xc) 2018/02/04 21:33:31 executing program 7: r0 = socket$inet(0x2, 0x80005, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000ade000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000000)=""/161, &(0x7f0000001000-0x4)=0xa1) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x2d, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x2e4, 0xffffffff, 0x94, 0x94, 0x94, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000), {{{[], 0x0, 0xdd, 0x94}, {0x24, '\x00', 0x0, 0x13c}}, [{{@uncond, 0x0, 0x70, 0xa8, 0x0, {}, []}, @common=@unspec=@SET3={0x34, 'SET\x00', 0x3, {{0x4, 0x3, 0x10001}, {0xfffffffeffffffff, 0xfffffffffffffffc, 0x5}, {0x80, 0x6, 0xff}, 0x0, 0x81}}}, {{@uncond, 0x0, 0xec, 0x110, 0x0, {}, [@common=@unspec=@udplite={0x2c, 'udplite\x00', 0x0, {0x3, 0x2, 0x3, 0x3, 0x1}}, @common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0x9, 0x1, 0x0, 0x1}}]}, @REJECT={0x24, 'REJECT\x00'}}, {{@uncond, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00'}}]}}, 0x594) 2018/02/04 21:33:31 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1000000010, 0x802, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000f7f000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) getsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f0000825000)=0x5, &(0x7f00008a2000)=0x4) ioctl$sock_SIOCDELDLCI(0xffffffffffffffff, 0x8981, &(0x7f00005be000)={@common='gre0\x00'}) sendmsg$nl_route(r0, &(0x7f0000f7c000)={&(0x7f0000f7b000)={0x10}, 0xc, &(0x7f00008ca000-0x10)={&(0x7f0000aa8000)=@newlink={0xee, 0x10, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r1, 0x1020a, 0x2840}, [@IFLA_IF_NETNSID={0x0, 0x2e}]}, 0x2c}, 0x1}, 0x0) [ 83.805183] binder: undelivered TRANSACTION_ERROR: 29189 [ 83.831238] binder_alloc: 10900: binder_alloc_buf, no vma [ 83.836996] binder: 10900:10907 transaction failed 29189/-3, size 24-8 line 2957 2018/02/04 21:33:31 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r0, 0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00004de000)=[@in6={0xa, 0x3, 0x0, @empty, 0x10000}, @in={0x2, 0x1, @loopback=0x7f000001}, @in={0x2, 0x3, @loopback=0x7f000001}, @in={0x2, 0x3, @multicast2=0xe0000002}], 0x4c) sendto(r0, &(0x7f0000b84000-0x1e), 0x0, 0x4810, &(0x7f0000bca000)=@pptp={0x18, 0x2, {0x0, @empty}}, 0x20) [ 83.855782] binder: 10900:10918 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 83.869772] binder: BINDER_SET_CONTEXT_MGR already set [ 83.876667] binder: 10909:10919 ioctl 40046207 0 returned -16 [ 83.885651] binder: undelivered TRANSACTION_ERROR: 29189 [ 83.899609] binder: 10909:10919 transaction failed 29189/-22, size 24-8 line 2842 [ 83.921437] binder_alloc: binder_alloc_mmap_handler: 10909 20000000-20002000 already mapped failed -16 [ 83.940148] binder_alloc: 10909: binder_alloc_buf, no vma [ 83.945789] binder: 10909:10919 transaction failed 29189/-3, size 24-8 line 2957 2018/02/04 21:33:31 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000b4a000)='/dev/sequencer2\x00', 0x401, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000dc7000)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f00008fc000)=0x14) bpf$OBJ_GET_MAP(0x7, &(0x7f000063f000-0x10)={&(0x7f0000f07000)='./file0\x00', 0x0, 0x10}, 0x10) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000afa000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f00001ce000)={0x7}, 0x4) 2018/02/04 21:33:31 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:31 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00009bc000)='net/netlink\x00') perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000658000-0x18)=[{&(0x7f0000f67000)=""/223, 0xdf}], 0x1, 0x0) connect$unix(r0, &(0x7f0000e92000)=@abs={0x0, 0x0, 0x2}, 0x8) 2018/02/04 21:33:31 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f000064a000-0xa)='oom_score\x00') mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write$selinux_validatetrans(r0, &(0x7f0000001000)={"73797374656d5f753a6f626a65637406000000797366735f743a7330", 0x20, 'system_u:object_r:tape_device_t:s0', 0x20, 0x35, 0x33, 0x20, '/sbin/dhclient\x00'}, 0x52) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write(r0, &(0x7f0000003000-0xfb)="5af28ada9da429be8e4c4f30ad11c1cabf039137aa01f8e0fffd2647ae8042d6a6891a7c0f30a32b2df8c932ca12c331b3f7aea9a6eb0765b3ef2bf94ce047780282608c531f1aac85f60254f1d95d9e72e9640ce13d57a5455051b854be055cb7cebef9b0517444695cb01971466945d5cab83ddefedb67e952e9505007adb5e25bfaab72ab720dcfb38f363691bc7617a5c377718ab43846bdb459f0c11651e0f269361d9b54084ba20059c113ef4ef2805c8a6f817b340dd58f69ca5f2e0cd8dd3b341f623d6c77d18dfcc679b921a493cf4a89fc2817afe7bb4fc5599b6fcab3a03387b466c13072ddf383553c085497d9462ff382a24348b1", 0xfb) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000001000-0x2)='$\x00', 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) writev(r0, &(0x7f0000002000)=[{&(0x7f0000004000-0x77)="20791056cfbb808e9d9a7da19434aed58ebdd1484e69955344fc6e3e16422df04a3d64f9b94d649133f5eeebe9b743b34cab02d7cbd0c03f60fede601160d60590db97bae145d2bd386af022e90f8c75120d68c383b41add27a60fdcef8f502165f4c47383e988e8bdb11fe2092cc2b1157c4643432667", 0x77}, {&(0x7f0000004000-0x4b)="4b212726998aea22ccd1b418cdd6e8bbd1f21cb539e6a68754378f72b0a73a549e920decbd3b745a01acc6ba003f44a1da04328f72a70bc27a3a2f89b0a470825cfaa62816f06de17ef7e9", 0x4b}, {&(0x7f0000003000)="c950c374c3c099d5f94e9c38c66e70a29e", 0x11}], 0x3) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x10, r1, 0x0) ioctl$DRM_IOCTL_DROP_MASTER(r1, 0x641f) 2018/02/04 21:33:31 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000400) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000eda000)={@multicast1, @local, 0x0}, &(0x7f00006c8000-0x4)=0xc) bpf$PROG_LOAD(0x5, &(0x7f00009eb000-0x48)={0xf, 0xc, &(0x7f000016f000)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x37bb}, @call={0x85, 0x0, 0x0, 0x36}, @generic={0x0, 0xfffffffffffffffa, 0x3f, 0xb72}, @exit={0x95}, @exit={0x95}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x13fa}], &(0x7f0000ed2000)='GPL\x00', 0x0, 0x1000, &(0x7f0000d77000-0x1000)=""/4096, 0x41100, 0x59dcbe36f059ad53, [], r0}, 0x48) r1 = getpgid(0xffffffffffffffff) ptrace$setregs(0xd, r1, 0x401, &(0x7f0000682000-0x1000)="a5bacc4779a069bc5bf64be2fbcbc051e5557fc7bc2316fcb892edecf47218ddecf156be66faf65e12848cc42bbea275d41a2f0d03ef98863819094615abc563fd19cd6be6482343c011368c9b33e836730136bac5fe520a60cecbba1410490b06721886e4ff10a4484d9927c2dd90250a7804cf7a5167422b9f28a9ad3341dbb8f945b6e804108eba1bcfd462cb05f8ae971e252a3acf1b2cb81cd3a7759d2602cd01106bc8d20eaa476018f6e3d8b3c03722e5de1043614c58e97e0c3a81de768da918884d0e647e41b1220d3dc73492793e31372b08901718b8bfda40bbd83ca228f8cf005fa8dc6c241d95e95e9efc814dae460cff1499e1b7694b8fac4ae6168b3491eb7f0cf6bf385264cb45f62aa8157d6961985e61307a755acf7f3fb37f480014ee1df96a9ad3b0d9aa36c510191ef073ae1b64133ba84bf015cf1199c5d23280e330fe067a36c375934d0281e828c15e68bdb4631e5521dc3b5eb61e13037d6f2096e8a7d5251f9313f1264ae06abc642b1076721fe20b1936716a5fb55dcf4ee646b89c4bb601d8b3c7cb62d220e0178dc56d1db6f385b5db84f95de12dd5718aa9f54ecd77021fd4de57f07f9a079b0cfdc2eb478e821fe061c22b302cc6bf04e27d0959b7bb6d1cf42572a5c88fdccda7aab887ac5d24f3c0117616102da1ef04ffafe36f8c375cb79d6b53e1817348f8eff14298c626095d2040fa540f40a29dbf3791ef9219e5ef18daca5608fbdd7b3df86c3ce55283a9bfbc8b164a93a2a8782d6d6e033eb5b88eabe089fec4b3e0e1d9ca5ce9db5f5e97e4176f38235891e1a79ea4e0774b129a4608499e7862313594d6bba70fc311f3bc4e30a261c82518abae0050ed9d8d430b9edbc0a0861c4e7a94c11a92acf0dd17a19fd0b65a8922faffe30dcabbab45858ec360bee66d7ed2a692ccac9d16c5e42f3d06293bd0867f54428eb99e11f8fb949bf2d3c39509c31a888b1269dfe5ca08067e07abb14610846e5160b0066b3b2fffa71826460e1c320365efaff8ac1fb85bb094ec5b61c5875b0e2929ec6ea8943c3a68710a31b8cbb71601d483b96a6d644c494556a337515b8faafebd1d5863df331f8304ea17210ffccc9ac365a584e3df560941f97fa98f4a221ab73b38fbbc4e769c33bf91e52d4844f98ef430d3d959fe235cbc4dfde8f1d239fd5a1831c6b544226c2ac25f08f0702495f9b0d13cda89f86e27f5cd291f7255b93c9bd2cb9a04f926874925245b206ddc40c3539ef0aebd7f86e94d449bc4c97101f73691127fd1be9d5da34ad32399cd440b57c14344eee573f808690860fa9f98ae0df09c6fe7ef34a5d5761fca17542f0bfe120b1269ac3cdee8391c9e048f29c534c46aa917212365f2908787d11b652198fe4d8e5edfe359d334db18b67a5a7e4099733d595a7918b90d10eaae224a50d56aadc5116659fe2fced6ebe02b73380474ff59470841eac6d47a6f0bc0e84e84299f3802000e44cfdc7d18c0c0360b6e13c0acfdb4f9802b07b33de32c2d5148295e3d7a9ce2a3007264a4fb97f94812544da1f7134dffe6c40efb305a3e546d410658e2e2a4bcb2f121d55f3d6fc407da38b70435679432b37ca31b1476c7b21c5f3cac7253f5b7286211d8fb87214c5162a38e9e5951453720fb23605519666eb56b10b3663c0284c11f3634134c54f539a576247a4ab3b079cb71ed5be7deaf516495ff9be3a62663bc585b5fcde7beb2912fb827d09f02ccc88fe2a7ca64047bc532391c2249005a433217a0f4e4f9bd34fbdcb189eba0e1782f7c5e89bc46c3ae0ee0dace5b48c6affba61ddfebc83d715b1a297387bbe140cac5f57c3e837baa0a8d18c65917342b7677fc184d2b41c67e101d404735cb2c106ddfef661ea7ac075f7a81dc3a31dd2a51d4c28e8391d048ab54ae5a17733828b40166ad5f9e93f79a4b9f5a756f0db84db2a134a1608a5cccfac5cbaebebc99c5e2f3a8e63142f9fdb410237cd6965a574d72840092fc6f6c033922ff6d5c9fcd2c5bfba65086ff4bec5739370959f97d7987df1cb3d8d73b75c645f2f4e6b42fe4e5892f7f31149d194773d322ce85ae892eb378b34b8a1d48c0080147d198981eb26cd76c7011b5a175153bc7953a90d9dd5c77844d84d097c06c1d23f4107722f7b5283dab1a6ed5baf2f300db17c82a6c7959b6aa9e4385af447a12dd032bb21cf1f6daa71e97f812ada45ae5cff48b2941a82c92cc2ef30a57e19f0646db9894179ab9a0a5626af175224e82a76aeb1f88da5c01078177338eed24df0074a2aa2c3b49a337a2aa837c310254639cec06dbacb9e69b39851174d5e57bcda19c36cbd3d9638b6a10caa149c77e7ccfd0500768922ef6f37ee018d7b9b9c288a9959ce33e0d98520f04ab86a468f399153faf4847479a4d4bd31c473239b437d2e7c8e67496ba7bf728b866c8542324f4ecbfc2e784677b324bfbef763ee2fc763b4b12b560bede1300e96a131fcd20b96b04cf7bfb0f6a06e7ac3536eaf690aa404c12e29400eb0c9a442e3c592823c377edeecdb3cf94b9896a6bbf72c973af091bcbbd4caa39262bd6a8366a3962f999daa487095f46689814796deac776bfef2ebd6e5fcce9513c0ab224d21de7cf7d8ed5cfb57c57eb5591569a7dfe06f4a8664b886be1e14fd37b549c20861e538d7269ada4bd6115323f5d71cc1959192b8a5757c473b300de29a9015bf3cabae9620d995874a8ab58ff6d76d8eb5cbe376faf159a8e70745a1b49b4e30b974a37192db487b8ec006a1b1fbfcc1cf500c29f4edc3fe1e5eda6488b54eb8766d907882970d062b540c2d67623611906189cd3f004e0821c8b56c8d186d1962f6efb3cdd0f25ccc21735ff56c7b2edf97bb51155557b47fcc13f1fb68f2f686f17895cffeabacf76b1518d3915f0890d084da66d20e251e9dc2c5c8d3a442052a26282cf174869f2f92e2d1d79cf0357156571471499bf01bb7ed3dc0ea77ba1541b66b30af22f64a9bd592ea6344940df85a5cc80e9235111dd489132b24529726d011df626af6791934d8e329f4b383a44844d10cb3cb673c2d6994341c0a5835ad4b6ea24f367be57bfc8af47378b5ed2841cad3ebade99207a4df01d43d77c4711ccb01c1b05a303474029b458ad42767363d1eb2963707c9b1d73236909fcdb6f5834787966f7627b2d07228c239da4da618dfb3b737fe20c9ef5a030e9571f05651ffad400fca42d828a49593fc50ade7aeba777dcc6c3bca3beba4c03392bfd589cf0c892cfdd8751f043663b56e06fd095a436c79e69b8558d39147efac80f8ef1875d8435d71cd3cc1c40968eed75372fd5267cf2e299403d46efbcc21a34ec432403c6e868b409c6043725e1a02d49480bdd3cfeedec9688cf580cb7cc737380507dddda7c490703fb26f5338d39be69a05fd692673c83f86b0145d115e80c577011a54f883b43830ab87f94b2184215b60d44a3c80ae39acd2e0608eda753d12995a5332a7714cbee233780e293993892fe6ad81f58e361afd2ab3ab5df20078e4c3e95afda0de98d7c82348633c71da72c7945200b7c89faec460d00b274ba01a4e6cb7e508376e1fcef20c7ce1a00ad6a495b18ede16695e1a377df389301a3947746e1e37c70dbb04cc6d879da987ed6b6381869dc3d78aa4042de0ae0a1f859778a75dfdbb6a73f2c1acdb9136e74a3e9dafda8a3a5624caf91cacb845cfc983eb2f23961f32a406b72d46f8a678a21c506071f44392f744fae3da0170318818f8e8b27018612dc61595e3a9455d2395a09370a834c244ec857b55d5107d3935905bf85b653fbc317aa425dfda51772cd2423644aebffac0c9bfb652235451ab601fdf7b018e30d0e8baeb9283cf57ba7837cbca9c7111895a581ff89c0e7f98ffe26ad8b82ade70cefbe03f0eb4445c0016c491d4eaa3200dd083c1deb100fead104e9bbc4c0864b19911c5fb374df3d0746cc40a0b9b8793632947f371bb30e4ca3591696be422319ea42097e2b0605f4e2ff579fd9e4ac283531ad5211e5cd18b44671ffc99c47e41d4097dbdc6cd9599613d47ce790974c1f32d80d4275a08d077f33ecfea211ba7045b62cd3d85f026f95f71c3f2d7a966f2c0b7a301cf0a28d5910889f6aca2f1e0e36bc39df20f846e0b43a9b90d62a68ec2c1cb3566f31260bd6a08dbaddb5cded8c272d50863c9e00c2fd42b88631df2ea022a9dd5b35d82d2b4f22248dadc944ad2e138119a4ed937f8071f0c5dbff213a78bad25624cd83c0a5ed064b23df40692920bd8cf73baaa6f684f2b922d8ca5b61fdea94493cafcd28072ac7b2f54b52d4f854b3b3dbe88489f3c78e39c0e4ee89491a12687e5b972fc4f1395bc9cccc1235868c2da587bac568697dd9f90a4a98cb699cb4cef0e9e41c5b19335cfd4f557e8b2aee2430cf6ceb10aa489791fa987fc33757a9198ab679d7b15f1a3a3386778cd0b97be9e5c8cda219f0f3034759c04b1f41e5ec06d3cc8cf452104ac48950e654090c6a968932e0ada93afeb02f16b06996d822975b7ac8aaa4e37c5ba0c09d306cdacab139ec3c4ca780514a89bf6c03787500f3ed3dad2a5aa06a962a436ee363551c665bc371d2cb4de148c5b0a20fa4cbef1a915dd34a241594770cb214dc8e2e51d0e4f4b55e018030473cbc79c24b7cf1fda2ba9b9dfb7fd57072d3ca0eb7ae879bccd413c6c217188097eeaf56b1aa8c00689701533cf3e821e305f09e8e242822a8475a96ba5b528db40bc585b2da300a67ad75593bdceaf68edd8c6a08feeb3e94171c38227079e85f64695d2ed8e0f590f237293b64f6446f77bdcb7d23eaba446ef20de4f39a714e3986d874129280a30af1bb0333fc827260c63f01403c8bdfb879b52a84bd9dd66e1eff084f7d6960257ac5cae9d1d98c9bef0affaaad9e7fec1114cad7bc899e16612a38eb0db7afdbfef7bced367e1e611e6e720e6d1c331bb7449a87ace5c646341171bc65a406c58ea1f1d9849e81a5d09a56858029b52134fdb31141b02a622145039a05f15d9fd16b2bef0d57758d42b6614b3fee3f5a40cd7d2a1ff819502e00e6e5d9d6bdf062c09007c5469319085344452a0c72585cdc535e2d60dbb65b146b12e5ce0faf937d75fbc57cad7297bdc05c80278e5966983106374cf47871d5a7b8cb1446bfdfce2d6dc24de1b4171c38175c69e8578170ea20537f8d898a2549d9bb197e35a84ed7b0c0aca7d5c6b37efbcc58e80d88cab50e7d954edcfd7a0df12921a83bd1ac1127d3131c61990c24391fe95471d0c25c5be4695950d347b419346317569e702f040a43012ae71aa622d1d58551f5efeac034903f69805f535e1440e9c00f0a54e54c3635ad9b3d1ddb53eed7e67337dbef89b3b4320e6673781cdca47eccd8e12f6ce270c7938d20cd4b3ede9aeb79eb7d399616e190ba2b623f2c2ced859b6de7c1493b87349156034b359a2fc32d0e714f8bf63629ac1f335fbb6a45a381f2e7d53912ef92ea43bce3c9c2c50d94fea54302382735e339b25a22e12af762170776aa1fbf8729832f5398e85985a1e646ee5a3c900ac8c6c517c500eaaabe63d24237847e27194a72fb6361d8cc63a92a3d74b86c5a788dae0534055e66c3a69f050c72da460579f930bd38c473f41c8b0f337785bec7e5042fafdb8c9a0c2752a053e1161b516b9ed478d20a648264c976597d87035b2d38a274e0760df822e743a6f105a9829f8feaf3f96275398e128222a554ada48d9b44b41451ab3d21") r2 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x20000000005, 0x9}, 0x1c) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000f36000)={r2, &(0x7f00009d4000), &(0x7f0000db4000)=""/4096}, 0x18) 2018/02/04 21:33:31 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000408000-0x3a)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x100000006, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @remote={0xac, 0x14, 0x0, 0xbb}, {[]}}, @igmp={0x0, 0x0, 0x0, @multicast1=0xe0000001}}}}}, &(0x7f0000754000)={0x0, 0x1, [0x0]}) r0 = gettid() r1 = syz_open_dev$sndpcmc(&(0x7f0000be4000)='/dev/snd/pcmC#D#c\x00', 0x3, 0x80) perf_event_open(&(0x7f0000384000)={0x0, 0x78, 0x0, 0x10001, 0x7, 0xbf03, 0x0, 0x2, 0xab230, 0x2, 0x9, 0x8, 0x5, 0x10001, 0x1f, 0xfffffffffffeffff, 0x1, 0xffffffff, 0xffffffffffffffc1, 0x0, 0xe1, 0x7fffffff, 0xa12, 0xffff, 0xfffffffffffffff8, 0x1, 0x100, 0x2, 0x3, 0x7ff, 0x2, 0x1, 0x8, 0x100, 0x9, 0xffffffffffffffff, 0x2, 0xf55, 0x0, 0x40, 0x6, @perf_config_ext={0x3f, 0xffffffff}, 0x0, 0x4e8, 0x0, 0x7, 0x0, 0x9, 0x90000000}, r0, 0x8, r1, 0x0) 2018/02/04 21:33:31 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000c76000-0xa)='/dev/dsp#\x00', 0x101, 0x400) r2 = mmap$binder(&(0x7f0000dea000/0x2000)=nil, 0x2000, 0x0, 0x12, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00002ea000-0x4)=0x0) r4 = getpgrp(r3) ioprio_get$pid(0x5, r4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) mq_notify(r0, &(0x7f0000fa5000)={0x0, 0x40, 0x2, @thr={&(0x7f000072f000)="6838b7e011265db93c6f6a1a477422d62b335c19e7b404ef2167f6bd4f2b5af21ccfcba6c206490bc5681d8413e56ec299d5e2782883d9b4812d0815ca1295953ac66e656861f256cfe0da9718e4ae010196b5de9ef966bb5ecaa9a71a5ce6b050a1484f50ebe291304b50522b3f5091d73718b1ce6ef7e4e9efb9078406785d1a71af9d257ff0c404fdd9536111820d5551c8aa42564b724a59024df7", &(0x7f00008f8000)="e0c540a3f96686c6032683e4f69460e5d9d048a646ff94d4ca4e110c5e3247a023f55925956d99956273d5dd8b7b7f8e1de2bafc60c2fe536595c91f0f1ad4e6548f28433cb0ebe233669cc356bc0afb616812620bf4e3b3230870b4691e05fe4911213dc0a8f981d65fb096ea726750f979722fe6204842584a306e0ae81bb45be968f067925242741da87ce7c281ec61bec116e07f857327a76dd140"}}) 2018/02/04 21:33:31 executing program 2: mmap(&(0x7f0000000000/0xd28000)=nil, 0xd28000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000003, 0x2) setsockopt$inet_int(r0, 0x0, 0xd2, &(0x7f000003b000-0x4), 0x3c) [ 83.945795] binder: 10909:10931 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 83.963964] binder: undelivered TRANSACTION_ERROR: 29189 [ 83.969480] binder: undelivered TRANSACTION_ERROR: 29189 [ 83.987646] binder: 10935:10943 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 83.999435] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/04 21:33:31 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00009ff000)='/dev/snd/midiC#D#\x00', 0x6, 0x200000000) r1 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000738000)={0x3, r1}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f000032d000-0x9)='/dev/kvm\x00', 0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, &(0x7f0000858000-0x3)={0x2, "26b8"}, 0x3) r3 = perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = eventfd2(0x0, 0x0) r6 = eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f00005f7000)={r5, 0x0, 0x0, r6}) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000c96000-0x1f)={r3, 0x0, 0x2, r5}) [ 84.005469] binder: 10942:10948 ioctl 40046207 0 returned -16 2018/02/04 21:33:31 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:31 executing program 3: r0 = socket$inet6_sctp(0xa, 0x9, 0x84) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f00002e5000-0x4)) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000785000)={@syzn={0x73, 0x79, 0x7a}, @ifru_addrs={0x2, 0xffffffffffffffff, @multicast2=0xe0000002}}) r1 = socket(0x4, 0x6, 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvfrom$llc(r1, &(0x7f0000001000-0x39)=""/57, 0x39, 0x100, &(0x7f0000001000-0x10)={0x1a, 0x10, 0x100000001, 0x5c, 0xb424, 0x200, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}}, 0x10) 2018/02/04 21:33:31 executing program 4: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00001a9000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x1, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0x3f}}, 0x1, 0x1, [{{0xa, 0x1, 0x1ff, @dev={0xfe, 0x80, [], 0x0, 0x13}, 0x3}}]}, 0x110) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f0000000000)={{0xa, 0x0, 0x9, @mcast2={0xff, 0x2, [], 0x1}, 0x8001}, {0xa, 0x0, 0x80000001, @loopback={0x0, 0x1}, 0xfffffffffffffffd}, 0x46, [0x3, 0x8, 0xfffffffffffffffe, 0x1a, 0x80000000, 0x3ff, 0x1, 0x3f]}, 0x5c) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0x66, &(0x7f0000001000)=0x9a4, 0x4) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000002000)='/dev/sequencer\x00', 0x20040, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000004000-0x4)=0xfffffffffffffffa, 0x4) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000004000)={0xfff, 0x4, 0x1, 0xffffffffffff74a7, 0x8}) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000003000)=0x8000) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) write$selinux_create(r1, &(0x7f0000000000)=@access={'system_u:object_r:watchdog_device_t:s0', 0x20, 'unconfined', 0x20, 0x36, 0x32}, 0x35) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rt_sigaction(0x2a, &(0x7f0000005000)={0x0, {0x8}, 0x8000000, 0x70b}, &(0x7f0000004000), 0x8, &(0x7f0000001000)) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000007000-0x88)={0x1, {{0xa, 0x1, 0x7fffffff, @empty, 0x200}}}, 0x88) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair(0x4, 0x6, 0xffffffffffff7fff, &(0x7f0000007000)={0x0, 0x0}) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) listxattr(&(0x7f0000009000-0x8)='./file0\x00', &(0x7f0000007000-0x41)=""/65, 0x41) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000001000+0xa53)=[{0x0, 0x4}, {0x2, 0x243}, {0x2, 0x20e7}, {0x0, 0xd92}, {0xf, 0x2}, {0x8, 0xd8}, {0x8, 0xffffffffffff0000}], 0x7) syncfs(r3) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r2) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000008000)={0x2, 0x1, @multicast1=0xe0000001}, 0x10) mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000009000)) 2018/02/04 21:33:31 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000bce000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000115000)={0x79}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000afa000)={0x65d, 0x0, [{0x0, 0x0, 0x0, 0x0, @sint}]}) ioctl$KVM_SET_IRQCHIP(r0, 0x8208ae63, &(0x7f0000cb5000+0x3a7)=@ioapic={0xf000, 0x100000000, 0x7, 0x7, 0x0, [{0x1, 0x8, 0x2, [], 0x7}, {0xc35, 0x800, 0x1}, {0x101, 0x0, 0x4, [], 0x40}, {0x2, 0x7, 0x6, [], 0x3}, {0x0, 0xffffffffffffffff, 0x401, [], 0x80000000}, {0x5, 0x9686, 0xffff, [], 0x7fff}, {0x7fff, 0x8, 0x30, [], 0x2}, {0x2, 0x9, 0x3, [], 0x8001}, {0x7ff, 0x5e14, 0x0, [], 0x5}, {0xffff, 0x8, 0x4, [], 0x101}, {0x80000000, 0x7, 0x0, [], 0x6}, {0xffffffffffffffc0, 0x62, 0x8, [], 0x2}, {0xaf7b, 0x6, 0x2, [], 0x6}, {0x0, 0x81, 0x7}, {0x9, 0x6, 0x1d, [], 0x7}, {0x800, 0x3, 0x0, [], 0x5}, {0xffffffff, 0x4, 0xf2a, [], 0x80000000}, {0x7, 0x7f, 0x200, [], 0x7}, {0x3ff, 0x400, 0x80000000, [], 0x3}, {0x0, 0x100, 0x8, [], 0x1000}, {0x5, 0x401, 0x9}, {0x6, 0x5, 0x767f, [], 0xbfe6}, {0xfffffffffffffffa, 0xfffffffffffffff9, 0x0, [], 0x7fffffff}, {0x8c, 0x40, 0x8, [], 0x2}]}) 2018/02/04 21:33:31 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00003de000)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0xaf01, &(0x7f00001e3000)) r1 = syz_open_dev$audion(&(0x7f00004f6000-0xc)='/dev/audio#\x00', 0x400, 0x10000) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f000053d000-0x84)=[@in={0x2, 0x1, @multicast1=0xe0000001}, @in={0x2, 0x3, @local={0xac, 0x14, 0x0, 0xaa}}, @in={0x2, 0x2, @multicast1=0xe0000001}, @in6={0xa, 0x2, 0x1, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x2}, @in6={0xa, 0x0, 0x7, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x9}, @in6={0xa, 0x1, 0x2, @mcast2={0xff, 0x2, [], 0x1}, 0xfffffffffffffffb}], 0x84) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000c74000-0x4)=0xffffffffffffffff) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0086426, &(0x7f0000f24000-0x8)={0x6, &(0x7f0000981000-0x30)=[{}, {0x0}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f0000adb000-0x8)={r2, 0x1}) [ 84.033567] binder_alloc: 10935: binder_alloc_buf, no vma [ 84.039259] binder: 10942:10948 transaction failed 29189/-3, size 24-8 line 2957 [ 84.066330] binder: 10942:10958 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:31 executing program 5: socket$can_bcm(0x1d, 0x2, 0x2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000001000)={0x0}) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001000-0x408)=@raw={'raw\x00', 0x9, 0x4, 0x3ac, 0xcc, 0xffffffff, 0xffffffff, 0x194, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x4, &(0x7f0000001000-0x40), {{{[], 0x0, 0xa8, 0xcc}, {0x24, '\x00', 0x0, 0x2ac}}, [{{@uncond, 0x0, 0xa4, 0xc8, 0x0, {}, []}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xec, 0x118, 0x0, {}, [@unspec=@rpfilter={0x24, 'rpfilter\x00', 0x0, {0x2}}, @common=@mh={0x24, 'mh\x00', 0x0, {0x1, 0xffff}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x80, 0x5, 0x1}}}, {{@ipv6={@mcast2={0xff, 0x2, [], 0x1}, @empty, [0xffffffff, 0xff, 0xffffffff, 0xff000000], [0x0, 0xffffffff, 0xff000000, 0xffffffff], @generic="f4a6b240cf7937262baaecf7905b391c", @syzn={0x73, 0x79, 0x7a, 0x0}, {0xff}, {0xff}, 0xff, 0x3a8, 0x6, 0x1}, 0x0, 0xc8, 0x100, 0x0, {}, [@common=@hl={0x24, 'hl\x00', 0x0, {0x1, 0x40}}, @unspec=@void]}, @common=@unspec=@SET3={0x34, 'SET\x00', 0x3, {{0x3, 0x10000}, {0x6, 0x100, 0x3ff}, {0xf9c3, 0x400, 0x1f}, 0x401, 0x6}}}]}}, 0x408) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000001000-0xc)='/dev/ashmem\x00', 0xd8002, 0x0) lseek(r1, 0x0, 0x3) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0x14}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @mcast1={0xff, 0x1, [], 0x1}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000466000-0x8)={0x0, 0x0, []}) 2018/02/04 21:33:31 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f000010a000-0xc)='/dev/rfkill\x00', 0x200, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000f4d000-0x4)) mkdir(&(0x7f00005b2000)='./file0\x00', 0x0) mount(&(0x7f0000213000-0x8)='./file0\x00', &(0x7f000078f000-0x8)='./file0\x00', &(0x7f0000983000-0x7)='mqueue\x00', 0x0, &(0x7f0000654000-0x1)) r1 = creat(&(0x7f0000016000-0xc)='./file0/bus\x00', 0x0) mq_notify(r1, &(0x7f0000478000-0x60)={0x0, 0x0, 0x0, @thr={&(0x7f0000bc8000), &(0x7f0000cf3000)}}) mq_notify(r1, &(0x7f0000fec000)={0x0, 0x0, 0x0, @thr={&(0x7f0000a1b000-0x9c), &(0x7f0000833000)}}) [ 84.086715] binder: 10961:10967 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 84.136266] binder_alloc: binder_alloc_mmap_handler: 10942 20000000-20002000 already mapped failed -16 [ 84.158242] binder: BINDER_SET_CONTEXT_MGR already set [ 84.171260] binder: 10942:10970 transaction failed 29189/-22, size 24-8 line 2842 [ 84.175356] binder: 10942:10948 ioctl 40046207 0 returned -16 [ 84.203738] binder: 10942:10958 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 84.243817] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:31 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:31 executing program 5: r0 = socket$unix(0x1, 0x3, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x10000, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000002000-0x6)={0x0, 0x5}, &(0x7f0000000000)=0x6) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000001000-0x98)={r2, @in6={{0xa, 0x1, 0x3, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x7f}}, 0x1, 0x9}, &(0x7f0000001000-0x4)=0x98) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f000051a000)=[{&(0x7f000060c000)=""/8, 0x8}, {&(0x7f0000001000-0xd)=""/13, 0xd}, {&(0x7f0000000000)=""/51, 0x33}, {&(0x7f0000000000)=""/147, 0x93}], 0x4, 0x0) r3 = dup(0xffffffffffffffff) getsockopt$netrom_NETROM_N2(r3, 0x103, 0x3, &(0x7f0000ab8000)=0x8b, &(0x7f0000250000)=0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x0, 0xd}}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:31 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00002d3000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000e70000)='/dev/loop-control\x00', 0x80040, 0x0) fcntl$lock(r0, 0x7, &(0x7f00001aa000)) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000e36000)='/selinux/enforce\x00', 0x22000, 0x0) recvmsg$kcm(r2, &(0x7f0000c4d000+0xe66)={0x0, 0x3c4, &(0x7f0000153000-0x10)=[{&(0x7f0000c65000)=""/149, 0x95}, {&(0x7f00006ab000)=""/71, 0xfffffffffffffef5}], 0x2, &(0x7f000000c000)=""/230, 0xe6, 0x7fffffff}, 0x40) ioctl$sock_netdev_private(r0, 0x89fe, &(0x7f0000b00000)="6571aee10b41477d2d9519aaec0c43069656dda5fc5481a52422163f6b8f37377dd1659458b25fe04038ea56069606aec6586840dcf3874582df13cf9e4c358300c2803ba497a42c519c332c770ba9b91cf701326a50") r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f000060e000-0x10)='/selinux/policy\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000565000/0x18000)=nil, &(0x7f00000c7000-0xc)=[@text64={0x40, &(0x7f0000750000-0x5c)="b9fb080000b8893d0000ba000000000f30f34d0f6f2506000000f30f0866ba410066ed0f229fc744240000000000c744240200000100c7442406000000000f011424c441bdd194f3fdd65c6e64400f20a766ba4300b00dee4f0f2242", 0x5c}], 0x1, 0xc, &(0x7f0000eb0000-0x20)=[@dstype3={0x7, 0x2}, @flags={0x3, 0x10000}], 0x2) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f00001c0000-0xa)={0x3, [0x5, 0x9, 0x9]}, &(0x7f0000a14000-0x4)=0xa) r4 = fcntl$getown(r1, 0x9) fcntl$lock(r0, 0x400000000000007, &(0x7f000064c000-0x10)={0x2, 0x0, 0x4, 0x0, r4}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000bc8000-0x1e)='/selinux/commit_pending_bools\x00', 0x1, 0x0) 2018/02/04 21:33:31 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000fc5000)={0x0, 0x0}) ioctl$KVM_REINJECT_CONTROL(r0, 0xae71, &(0x7f0000766000-0x20)={0x10000}) r1 = perf_event_open(&(0x7f0000536000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00006ee000)='/dev/kvm\x00', 0x0, 0x0) sendmsg(r1, &(0x7f0000ae5000-0x1c)={&(0x7f00001ad000)=@un=@file={0x1, './file0\x00'}, 0xa, &(0x7f00000c9000)=[{&(0x7f000021b000)="ef646ed889cae31e092bc098725e65ad85c810e888c0576c1b1a3d692274e43d986765e5d5ca071d380a277d", 0x2c}, {&(0x7f0000192000-0xf8)="7ea8e0b70dcdeb42dcd7c966b6240c2053f002d2edb01948f490e8e7d5a938b766f6b84c5d2a054a600501b2bbef2047c6dbb2ddc0a2fd1e6fae1713c093245796ed98508c8f3f242fa8497bb5ea0c372098e9b029ef3a0f31eef4e009b679591e681618533caa36888411c4facc793eb7950fee6030cec20cd8f13103c548a5d92ccf2eb04a94946dcbdc8bcaf11660a1aa36d1d3cb1f94cc9f500ea48bdd7be71d55588915ae7fb9443b6dbbc2c624a46f7f3579d1af598a7e17a024aa8ca93c49b05f42d8726e03369425d7ab6699d03a0f8e895c50f1826058d9489a140e2bc0163cb90a6e48d2812aa21843201cdc023e53881b1432", 0xf8}, {&(0x7f0000cf8000)="e858df18e5475822a5c26628a46986fb4a3e8fc18ed5b91f7fb05afbce6cc341a74ac864240274264438e0a98e35b7d088e939fe741281799dfc24eea651629c156e4b4529906a4093891889223eb2812453e57eb4c6cfd7ca23f5e356b1a9fad9a730e144a1f33de3943c76f29311b406835b406d327f5446a99ed7c8c0f92e24cec2c3e705f4b131d829df5e7efb9878866f0f42e4ced704fcf353c4ddc3a07a8a944b2ef3aedeb1432a9518a8ca4490db5f9056ca65cb3722e2b03d05501e93f09a36", 0xc4}, {&(0x7f000050a000-0xd3)="46c61dcf6e5364f6a3819f770a85a1a2525171c599fd8608e331d56d4b83ac6b1822022fab876269936c4bd54a3917d259f734e6da60f8261685fb37c8c5b3d075756a04afb267045fc6df6da6a0bcac4735ae67cb1e6193f4def5808095e70dc7aac6ab5203ef300cb9a1eeeee5932f70f9791ced9b645550fa2186356aed94b7398d101b36a0357cd3311af39788799eb195a9e35acb7aa2fbc535c193bb19a6fbbf490dd6b51a2d9733b432510c86d724255ec73d4a6b6d79148dca5c859fa7afa08a83af1976eaaa75a0a7a7f2cfa08640", 0xd3}, {&(0x7f0000044000-0xe)="730760ce730dfb34a43ccf79c8cf", 0xe}, {&(0x7f0000781000)="e2e9ede3311e75215f449eae4375a9a9061002bfa6f47537d2c95c4a86a92485501cbce01fb84fd2339c0acfcf50ce27551936101d2efc908b14e6a98d67a64017a24137b77311d43765de51b1c1a45e5fe7968b9d33a1a1", 0x58}, {&(0x7f0000bf6000)="0530b19a740c5bf48c0b28593f1140a9773fb07f132bb07dc9d43f7685fb642fee840adde5d89027039ff4ed17fd5ccdcfdda7f953db01f2241c3430bb80325338750f507e2037a18d56bcdf1ff81494b87872163d4be0c656fe30dea40909648a9befe1136c73a2ca2b0c4e7e00e291bc35285896456781b35a1598c534a46bee270f43fa", 0x85}, {&(0x7f000023c000)="ec20c588c230d3050be83b7ce72aa97fa5a03772d48c28ce30a53e30f117fbee7874a177097d6820ef96c57d295924b286d566c7faefb0a828fe4db9a0976fb56e66f6981f0e6dae193682f4e6c07d364a6bab2279df12349cff59152a63e20cc030069e7bf5bb5b551fc8e56bcccf1cdb19c7403de1078b0a2a9609793cdb38f2bf3117b701aa257eac6ebbd379c3fa5e8d4fe292e02082c45122657d214363d1c57e682c399d3907b648fdfb9257ae275756ab6aa8a21a16becbadd235d8ff7c2d56d2062d8b003ac320f395a2a53c0923e37ebff4025f192fc284808f2e211d927199e8ffe40b31d6efda163a4d1d2f", 0xf1}, {&(0x7f0000f3e000)="7fab1abc87073fe09da0f67aed152ec6f22391fdd8b1bb52a571278c55425bf34ac79d9361da2e7dd48cda711bda6e9ac2e962ebbee52cb06009c52e8ecf0f3c319a72fb1c9da24eb7ebefd141d3410e7c7b04ad9df4694121f36588dde14394ae15550b05227b26b39d496a5aba96813fe0a8a9fa8dba66325bd49008a1c2faf0143e", 0x83}, {&(0x7f00000a4000)="41f17b20b77684b38ab0921a2c56b06eb1130bbb1c7c9e60252f769a694eda8bc9962dfb971fb2e2ae48d7de883383ab1ed4eee6ab27f694e0dd51a9f880b56fa32be58c35a75c2c4c0179fd54574b05d77a9da44a21570c5e3c9bafd07ce821adce95483424283633b2df2c5a730249636d98a38dd5c8d683efe817af7f0219d9410a46f9db578a6127a46e9789f964fdd2d0b2fa1f69663c0274101d105348a8625146846ad7146cbddedbde41a0847c046a7f7b243ef836b2cb75573287f6dc6d58432f7161cb725af20841841f55a9cd83b405e63f2f368bbffe2f6189bf320d132a109f11179abafd9188ed4d24a6593d81dd2f47be4f7085e6daeca4b655abd07607121f2a1ae0aa04bb36053b3cc8c7e2e8b265355bb3aee0d4cded1f23207901543c8a0c0f3f65f88f4f0e58c21401d91d11ffc4174a4830f4b29665b7de05f485261cb2ef36fd198f644d858b7f44adcc738863b8572c1007ce93263ec93acebc02230131dce8096ba3f5ab1c0c5ce52bc70449b8f8040192d79446ad3532160cb90f65108aa63115ab1159c8019960f16484faa477e5701c6abed16379ff2784014cf46776c59403b3b2f985b18535c5435ed97485eca15f5fd1cfa69996dc18642323036889ba4f6e6cd4140b69d7cee9f5e1768d16790f8065bdf6a04771ca34ad3152c88898b0ebb42f315a9a686d6c925cde374d5e6bb76a22b081cb595b4bca09a8b25b44cc069c05c01ad95e46164e50c58cdcc7a15d85bd272b9a08b629c1e2b060614cd43d0e0e1288a856e397d13921654b6b1b0b76c2f50c7e5c93b3923fa5bff342bdae19c9c18c6f0e9647210dc62d7409c5a6ed8e76079ffc23502613144b715966b83c44394985574a5a634930a7775157462fbe424908f305dea9b29190d68d351683b21a9b1bde3e024ef04361339eb1ca1ab484ae8dce084e91d1fc1e753ac76770964c001d4a49db0daa3102269511ecd560c71bfaba59ee7a928c53b2471462a8343c3f3d24b2e13aa712ec7f3839518846161e5263b3267356081bfbad0309e4628fc7524290339be933c6d8a6a804345c9182a11ed24480ff19bd122ca00c3be6261b00467d994401bc7327b37753fd7972185e09d0a7e2c0aab8951d4bc1b32f8aabe09feff559f76e705f90ad5efc411c26b3b9f6f5ae6bf31ef6d358682f1c1b338d5b8cda71e2af2ba6cd2f62656e7591037620b5723bed71313040cbe22a573de988ae898682c6c22b452653d86064b34bd993d467728896a006a1669ef2d24322250504a3c1fdd9c0ca3fcc7b3b911f90a0055bb53d26417bc202fe4fa533c95b5a4191b14928282e7d085a8eae6086cfd94c6cdd3f87190c92390697f16d240026815e37338a9055451fa9a855696f5549ddc2474b31b81d94e34aab5048b07f44c8372018ceed8b1817c1db48dc8eeed644dd280260f95bdc595bfdb90e17b86762311df485065e728b71dbe280bdf819aaa1bc4869452d7621e4281184dcef2df2c588584dc132a59eb07ea9cfd21dabd39c26abbff708107b628e2e9bb68e202689518da3417d618ac38ae09de68ce8a757e41a940a6f72d4cb6825894ff0498d6e0637c8c938d38ec5880a55f146a0b26f6c36e3270e00823562ebe90d0a2f71640e89d8d302bb11172894fe50a0b6d997434881f01c7e7959953dc8002d27e826687c6b9b4a4169f08dc6add3c67fab68a4c5959a819535459fc7f8e6dd1934b0b60ee7fe6b63d869c5da3b751806042b10c9c3611d8a5ba35cc2f1854e944c2bb28bad6557cf5efdff30fed57e879259081d364328537f88582749fad838b252885905878e6cc82ebbc5d409d11155ddc4a948374e73d434a61821bde1aafae548cf34e87d67c8a92b3f30d63fa253661c9074496e35ae82120e702114addf6f855a72979db114afbe20b03dd56164a7886b4ab66d1e6ec6a9b1fb9e2d0a81eb58a08dbcbde7c6d145db3de858c0f06f2fb1f05ee7839542f513b5369135950b66daa742b8bc5e7f767e119dc700241fd001a7cea75b24413343c78cac2c904b7af27327be4be1dfc80bcfcb774ddd5a6256ed9dcc8b0c4b1ae503975c740831eb6b88c1dfa8e90da6047b44c071ee9c223ea587050cc9775b971e5d9b1d0ba8ec0da3842c5d56d7deede2822553ef0169d9cc282859ceaea333f95a30c01843a3314565c031ad0d36b9ad18d425a58f9110731119c7735f2029e9d52f53708d104e3a9d7d6e1c7d8a10887707bf6c42317a87527d61b173f973efaf1a07da747eea7eff6186f789cbef9d5ff8588b0772e553ce73f70c1269cd3769a43793829c0d72a928f99049a92a6ff3b7d8ac3e33c1e5ba33dfcbeee3c9b72d154b8579c87c722204853414ecc4e6d2e165d1bcb626d2b053341eedad1234a0bdee8975ad73422530311eae21d12a5474538474650ffde39a92174904525abf1405bce3922b2026715b51955670d649370ee47568ce9297c162dd4bf88f12857331d5fc25fb12a7431724f10b5ae8be1474b54ef06dfec002a6b6ec14a7ee0fa90d7a587ed575176991495b745007bfd9db28bd0938cbc7faf6764dd52f9f8a3108d55b9e790edf75f131383a5b9e02db347e8056d4b05727d81178407b95d60b53eb1fcededfde21db5fb1a3f8496d37ad61e391b52ea652e10f4fb014e97697aaaa1460786ce13b3b26c8d83dd7097bfa15572ce445c01cfd2d3662cbe8509eb2bdf40d68aa6321fb88f62d13a0f7d069b2a10a3cc6e157b20847225de6fb80c0d4571629be6f6268e4dd0d5e500a02229512e0f829b0439ff8c8601d6f575ef63fdc15f2cbbbca60635d24423ab3800574eb95828907aa069d46a90ba6687ecc194a4f0f114a5420e254ca0a2dd9859851a5fecdcab90267585735d3e695eba4c02f416495bc0ce4857ef7e372665d8668dcae6b7341a276dd644078e76334e20d142892f9ab6fe4031d5151745ffb20a5f899430113ec3f688cd058b9391fe6dd6b8ef958dcb57eaff06622febb2afb5554f89a070838ef8a03e59d52792e50f00415d71aeed700ef45085e2cbd9b3c393c24d38986a9af9b46f2c213075ceb8725a66682c22e387bb847ea42ef0f0af5ef6f95ba27c5d36f82691cc2bbffaadd318c883c28684e3cd336c0bcde530cc8463d69f831676e7b4dab44c8f54195a5311f52a152a9d4e8a1f2cf11272f0a35729efaadfe9a964f4727dc7050fe057f3d6807a48d8cde1b8a0a8fde88cd5088d07122c0647f720d9067feaaebc70f0dfe1941f2fbea20167a295f275be86f19253f3f48304e242d8ad052a3876b196afa07ce91e49df30c33d417c11f71185775e2bb29bb0d4d2ffcad63d6e890d11dcaf3abea442a103174e6b917cdaed435ced88dba5b826b6ac4975432a7c9a453d32a6db2719a824bfe54ec5d2c55570dfa3ce09e15e44e4dc575a7e95ec67198d8b633b3ff77dae7d5a190c4ef3bdb6cddfa56beaa9a3fb1bb34ddc04e43fa29c3cd4f74dc032585137bb38afa68608e6fe6ba2e8f09779dede71f365488fe2129beaa4b336d8d37538b824e43ef57edd1166513be50d70a4a6cda20afd9edff43db495ecffa238d7c5ac8d340b9b0a7897a2ee9fc4094253de7f08a5f49a1a79ef92f9122cd63501aefb708ad0d5d22eef742f1369ae3e9769899b68551284c2e180afa1390b28152cd0b05238de005ff7d91d53beb3b39b53f7b8040eb8a63a785f4067ddbf0a1f907da3d5c80e2771b97bd64edac83686647cd4e03726e0477326e4ac63f08ea62a80aba902e3280013f9daf54e777e68c763c50910f626b368c368c0df9e86b9f16e907e47e6b69311bb8479f3ee067b82e5bcae4d61946fbd7523373284a3017de3299ea4a984f225dd457adcc8e286ab1cd2cb84a5964a34600a90690f9bda64c14dcd291c23b45fd4830f5e208d429169e89aa2e767d9437982741f7cb8f5234afca30bacfdc6ed9957023a36aa5f7991d83d2eb97e13411b656524a7d685bfda4cede6b11e8e408f161f99148b0fc5fb7ac4a43b38f414198949b0a8285db46a9c0e690879aea29c50995a9e0f9a82e3d5b03290c1d6d07221f621a06c544451d034d90735ad4c9465985f0e88009f8b2c5056c8ee0905c8ab84f0dc2fe91c66e2837728b9443b67b9e99ea6c92bbb44b9126a9982d88d0d1814c48f3abbba4385bc1aa67d84ef1b6f19a5a29e51802ecd297b69c355ddd05fd72af6f544e71452879b80be71f8892adb6df920fc76b10d9628f9d6b79900f45f12f178c7c560ffa820f5754a184e4168d54debe334e3572a343299af279b047a8d0cade76bada8dc5869a5477ebf642c281a886c42ff5fe0d2be492a9bd4d727448287e20aa2417ec327a06c7ee404660cae86b4f7a34f857dd8c3aa68e5425ce86c89c3b7eadfa9ca23084a5a65557e57215cdf2b666599ad390ca7634889503b8365c5470027e15b4d196979cf01e60f63f44ac34cf7d4def381254045b6826e841036fc0015fd3628e7dd7d34ec05333f739962a7df47a5fbfbaac4eb18e2f4b6bbe5fc6b96f1f06af97aa19a50c6d8882a9eb372478464c0d0e5e42f734cc8afc22ecf3404952792eb7cd1a42f2a9f517d69c1bc0489ae8bd83198dd258ecbecaf5b7d226a107950f9fab163f642d6916a403b9a6a109e57b8de1d710f20f76c07dd41d551af10eac5bb5aac04f868837830cd185bf63decc952cc91e696a0db2bf65f6c8e049a57a06ef7e15fa3e0271922feed7dc6146971d4dc89746d65a878fb76457068a1918d237efbe4a07d75bf2b2d9085828131fc4bc3dce974eb0026702a180971469b0ffa30ca4ab386e5d2df671f4d469ad9505a84ef34369de5f9b425003aee85ed71c1b466555fa6e983d62276d4ca286f1d0be7068e9cbd5b8d37f40eb638501faaae4725846380f4514ed9d22bc982c241c9ecc390827744dc6ee093b7109baa7e2d8a49b7c24b50b051b9eb845b5e05abf1457d391006bf3a99c0a43f7bb267c013a952c6b42595085a903644d4ba0c2976f7c988cad2114d2483c14684b70bdc97f97c8aa4c385bd97fc1efedd08e440938bba732fef5dd86f552fafe776fc5eb1dbe76d549fd1c7a2b76d02b6fe611f496ffc4062a558feee93ee859ecb99b38a132de259bb518bbddecd7fa49b3b40b4be737661ad2b5d1ad8d67cddec26796b0b2809019f637c697f7a08dc2f8fc59bcf17e19f461ec7ed81a89e107e4b35df4e895530d5149ae1576495a8b75997eab6f6b33dbc30ad4bc102109eed30a977613c74d5ce0a3aa89e699863715cb70de6c075bff6f6c9984ef1b38706ac2bbb88feb99ff66b9fafbbe86886141cdfce6340dc26466b97ac61dfd8ba8435d3292631727c4f8a48ad319ffbd577ae12850eb235bb7ae18b04c62728353fa376cb1158906142fcb00096cb55bb5597f1c0b76cb9534495b48ccbf0a4266ff4611247aae512716cc79a1b59a94e635f2df78f017639313f2d34c5117d8c17f86bc0ad664f26f41fa93a790dff23e67477c0fb224ee9c5b32edd83207c909f50f6ab50c37bdef5255c2a2324ccbacaa579460ce1ceb9dcbb69cbd60d8e9333dffebd8d2ecbc1c66f41b6caff7eb279e0101268b2f6cae95e001136d7dd374a448d16e6ab9730a37b5bdaec469491c0e98c7d445aa16fd5f48a54b0a7daeefe7146f7c831840c95d9d630b78c485e5066f6b0aabd254775e01fb4bff6d6fe7385ee9424c890730fda31ca13369a0129a131ca3fb4de3fc7ccb24cabf7c", 0x1000}], 0xa, &(0x7f0000403000-0x1cc)=[{0xc8, 0x11f, 0x1, "0a45debe165c3b58c1a7f2f04b3f4f77e78505c022c1be5b69f80cafbc1bbf6884e4ad55bb63362c74a55c5abce4999cd6b09f62788317f538a3621113841342cfbcf92b63fc30c614d85c7127f835b1afc81fd7574eff47255d3e36b3cdd84b149d31c43a72967553d6a365e9b945e1128d8c48d0443196eb9dd81612ac54dd5a5508e3a4c3d6a33305b1cb21c750beeeea67c68728af94b9a5d0d446c008624a1592470c84a4487955d5c30d3526e09dec9840a7eb41d160"}, {0x70, 0x18b, 0x8, "539fffe0a6c00d1772945af9e480b70959ae7f65ca3bd25f2cc33d58731d318a306b48aac4a027550a6445b4998ac20232a20331cbd89647f568a890757233cf6524831c17345cf27890cd3f00e459228cce69575604ba1594e411ad0480f351be811f"}, {0x94, 0x1ff, 0x2, "1898011309d495e6ff4933f25cafefc90bc1aa7740de841daf8418ae84e2183c3ce06e91ba82400171ba0a86d79d5f24c2d4ae664c7f477900ae3218f92d510f666a3a3779db8d91332a654dc856013c6c4f8f47570c3ffc6e3947464beb3fe65657f34d2753b429f0f5b371bc969265a0f062c0279b82ab9597e03ef2641904169640738fc3"}], 0x1cc, 0x48c4}, 0x20000000) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000ec1000)) r4 = eventfd2(0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r5 = request_key(&(0x7f00004bb000)='blacklist\x00', &(0x7f000054f000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f00009ec000-0x9)='/dev/kvm\x00', 0xfffffffffffffffa) keyctl$invalidate(0x15, r5) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) io_setup(0x7fff, &(0x7f0000f33000-0x4)=0x0) io_destroy(r6) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f000046e000-0xc)={0x6, r4}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00007ba000-0x20)={r4, 0xfffffffffffffffd, 0x7f, r4}) r8 = getpgrp(0x0) sendmsg$nl_generic(r3, &(0x7f00008f6000)={&(0x7f000051c000)={0x10, 0x0, 0x0, 0x100090}, 0xc, &(0x7f000033d000)={&(0x7f00002b8000-0x12b0)={0x12b0, 0x36, 0x100, 0x7, 0x3, {0xa}, [@generic="6a738529b3297124da36988e628d432f0bbf3ad9e42fd1b9d009fa2787777a2d4895f8c91cce836b810ce7cb5eae04ed7b3059c6b4c2c5f61c13786341d28cded0df4c39dfcf60a3cb6b4f0fb86765ab437cb254beb2c91b465c0564f110cd0bbfbcdeb8c2de27168d00e69648c65b1bb088d96cdbbafb292dd4a5e471cdbea610ae3dc3b77b63ca65c8732b9d2d582444410fce8fa14f2d74c544b00becb6f0f74dc10bca44e7674aa5e34496b6dd19de0b535d5ba59f8e7b2fede25ff8c8b921dd7e593a235884836addb93719865727fb4931de7a181fbc8730a23c4cdfe4352f6727", @typed={0xc, 0xd, @ipv4=@multicast1=0xe0000001}, @nested={0x1030, 0x46, [@generic="c890d397b2a2ea18f794c9337dbf45a712cf4bfdafcb569e43eb4e374588583629111f2fcd431364e2c7a84e8728be8b1f8e0c98247ead3ce6b74a3ba02bcc279f6950ffb2d48906b7725eb5d6cecab1f977ad75c5e98dc0a857fb8947a1825088fe94d015e98d5bb9ee342c43839d865e771efb97a4a81fe0a08c71447496d579e7457ade5548029740d715f27505ba66d80fd61b86fd11eaaa1346c2bbd7a5c4e165e474a4108427652683ef768029ef35a6be5e72878ab361fc2d040f03cc5078db76f4d07df7106af39b192e524d132d5835c44560f8f721a6f2dccc1955b1022eb79af1c2c28539b5ea288da67ea8b591a51b7d118855db3a6b781721d0a87ee32ce0bd04247f72a983dbbf3501e82818e6cc4e4fe3587de0ab000c27804ad289398b46b034ddbe23c732c0a188de1af71fe445a2e1ff51dd7fe9dd22dfe8688c91bc6c964bd332c2ae58ee9e5297f267585f09c9ec2de6bd5322e79aa4944f960259305c13ea5c806dae21d81adfea8cd70020a9c8359d1e06e6148d97aee6ee9928df39a0e8fc6f10dcc6807ea0d79549685986a2c84c029d0c0e887d1ea7ab9bb5ec65494bca7a73e98e2626b47c48ca8fb720c2d9e617ef9e35d3858ee04673c91d2e6543763f2444920fea63993e3792a5595664eb25efc54603f73284fb16dcd4f49dbcae9d09bd41948c814e2f86dcdf32d19014da05179d53eb2fb3a2479513cbd2941f1f22d3c2bc04143e35c045bfc85782db18481257ef22e44721e19fed2cce3d92a039308476053981ec1090b241fa66bb383be7ee48d22a1b67d6041a750908493f5820c0047d2d08eee38afce63818d5c779d7146466e26b8a1afa4a22c080f6193a12678eac74df4d45cdb0ce9fff3893c6f60758012cfe1a591b13858b8fdeeca62ea5a0ac26bb7e1317d61c20583238103ba9ed20e7f1d7481ef2603d142701d86bd7bf82f5cb1d718543ac0ea14654c1156bdeaf24484d5eb41d13d9b10d135b733cbc32fdacdcde18723c0f06d0e78498da6789d2a8141d8cdaa7f1973c011765ca0169d0415b169cd9e6df48cff560c594e7586ee733a32aec645a36b698c97c98c74221d57200ba1c9e7e34914d2431d68f0d7defb52a91c2b7d9c27677317765a503503c7de52700e624f0e3857d0549d92807673987015375c7331ca561c98d6cf087bcc0825315a2cae443b4b7704290adfc1034cfa18e2166abc159a3380c164c8ffb5156694a2d7a3e61a21a463ae8d87ffe19d88b7ee5ab5e2200c6869790361c231dff9fbdf585dd6d5dd68351858815b34d3a7fae21ef531ae190ffd9fb84124f493752e7de8e24d17a24bf057c53d18bce77a1e256966a21b303e3ed86bd99b1204d7f5de64977d013fa7000d46b18eb4504bd5213250b76e0c34a1958086167f27c76127c703d99d90e25ee481f117cdd1002022331a9c243dfeeebba9bd5b6b2c35a4baf3d414ea636ff4f1e552367493c1ee982e1f473b591b740c1f2a6bb2647cfea191bc4e7663c787a5cd7874b525aba1c9ea3d38ded42bf9ad65b7637ee1566342405dc0d21bdff1d799ca42a0355961ee836ea0465887a2d47a4eb31d17a8f6ae6a341c30a6bfa282efa94b0ddf14496196b0ddf9ad29ebc3f225a6b0eaa8bcd784c67975ee7b4cf6abb5183f9211915c7fece1cc57e9688ceb2900497d83766e63ac41a94b8a56340ddf09c6a448274a85f843d0b8c8c4eb2f0331ed09c286f8155cffee8a90b3befb2bcb40b3c6104e97627647642a010adfa2697fe5ddbda726b5744861b6d373940f938b0106ed75090973f7244e5e4703deb2eed6253af11c478fe83594acd9adfe4231566e16d25614b54a91972bb821b02ff4561ae5af888b1dcf74d6c1ec9939bbad8b32177dbb057c6fecb0679e32d19e362ef34a0fbe673c8edb2d6a6f24442aada1902ca8e5bbc74d79d56c6609a71162abe72349c1dc73728965e0a3ac494a05b623d4643a81ab9f581d09f2b7f36129505f12bba094f925c9f1c78e4478a93f20ffd0094ab690df8287521c0f27711064d37bbdfac4183d436c02735cac3c5d3386658cc92fc1dbdccc5bbafcfd941f3d48fafeee7c0275752c7742732ee4cf75c1a0d1be078cfc46f419b720bd5d9b3aaf95789c6e3853af9932599c2ae73d17e0bfdc9c58639d586f568bc4c8f437002f84d6674621163324a613841c8b9a68e44aa467ce62b016746d18a3490057194c4c7b69d315f4e1a1a46279a06480403b3c18004ff92a04266c4272afb8e374fc69ee7184a31d424b94e98f4aaf7f365f257d2a5a8b6a7dc9e9141c8fbf46e3465b108cfa962aad7ed741c8302bb5249a7f41691907cc9dfd720fce180bbe72b4c5761089080f56dfc2d77b3ca896d502190cf8d973cd41c3af2d35b7e79a85943220670b98acaf745eebd641c7b679c6b20f2cab0a60b4f6308cb20fc954062a24dfc0e550789b8f5f4b6447fb633386aa81bfcc65af9f60f0797819dfcf78329925a8277d7b6793eac56c38fcffbcdc0c15558e3a903d18261d82ac7454c09e4f2378ee01af27be93546ace9f988f276a0aceab16e9eef80fc526b609955cefec600167aced50ca2358346e99b41d298ad3dde01a7a1ee2bc7414d3104a6dfdd252dd74886ae0d79a0042163ac9fa527162f7e57bd75ba09298c832397594715041c4aa32c0ff2a9397126eb105b4fa28a125324537b1d936f8f1f83481c01a4a07dc86d88ca35fea1b3989c586e09a22808b9ce8e4cfce6df5b90962d79a1f01c76425685efabc22c3716065993aa24d27dc2e4912820bea5882f7a4739dad1083db901d83d6a599dcc60c157f77da9e6f616c74a885a572073ec5615bb256424b26a8e23fa166ff34e2114900cf583be3ec38f6fff2b9afe9eced5951c3288a06d97dbb8dfc4f8b72c9cf09a7db261b18434ac9de7b73699041feedcce17a265876c1209c06564a72f40b857f570db19a678e53f3d17a8144159209c463b2a227320633ca13414c48aefc10382b1dda7ebb3111e0ca37536ec9464d4ae97f28d8a918fbaefc01b416b543dc9269ef15b800275a49356c4346d012c5ca51f16592843b2736d9663ba0a9667874cd0c224a47c5a0eca30fa25ccaf27d3a834a8894052eaa3b3054b7fd405878a926bf9c2c11ef8fe628e3d04f5330a748ef85b2ca226258f681695db298aebcd90e1cfe79ace36cbb8148a567e4c1ba98244d50aee8697bdb78488ced43e76c365ddb533b24aa7633f3409434fcd9abce950178a2ef84e5a67441a5863bb493d3188537b6a1d3de70742cdc4d8283130fd20005ec0da3b3556dcabeddd84d6221538c0bd624dc70c00cf6cfb28cc3db0db1f03369c1e4f9cb87cc3ffd8d0291b6a06fd7f7a57c9670d2396edee51340d0c67a41435cbce0399f5d9bbe3d58eedc725379f783cff2eaa70bd6dadcbed93982465f171fbd14bb1358c487b579d6d2f3dcc53382aeb5362985ea4073c9b0e6729f6f0fced03081b44d0ff472f5bc679d04ad707980f605dbc2fd702f89de1d1a76f150c644a08f10bc7ae2ae04466c330836e7fc67aa1acfb8625faacd307ce34814caf08560001b6b63eee1aa589b2256cddc4bd15e3b99e64e35f6a6bef6556f92b7508d0960f0161405956262e660e22954c1389777b26eaa288de038317029190346cf67b5260df9924998029aea606f6748724c490adfd1eda34999248795d7328f071c2226fc3bb1c3d5d4aa55edd41f92c8e4fc8537b62cdae66464ef2a66a16550fa82c06dbc289dfecb2c06e182949e169b5bad08edddbd2b25c04698bbe0c8a45bf930e17ecae6623e303743e0b6a573b0f625a4acda29bf4e4a95a6040749b668d88765de893c93f1dbf44d1e1a40d0b0fac907bbd94ac040a5d6c5dd5689753ff2079fd9b2b40c2c37fc203f0188209dd5eb53f35af563de985da8aabb2313ae7370fb590bb62341fd8915826c909162131fbdc82ee16ee4ebe5aaead30af60c8e9041d38e9e6f4fe5b5e18bb496e0732244c05567464cab426c23ac5bc72a2f18d1101142d73ab9465e6ea2b5e6b37ae90ddb75ee63f42036e83b1f47d0c44dc48187cd15d50f8ff6ffdad0fbdcf54b1f72bb21288b7f9479abde80c394787f593e2acde1d17eb98cea16d1187543d16ebf9cab3eaba0fead2c0ccd8038417bf9166bd6c62b2f5c795c527ed0cd497468fff0940b9ec16ff0206aada2abaf3f38c2659229ecbb75eeba6d9da973e0374b11e644c3ac8d64c85645906ad7210a404854c5f922299cb30950bd51167c5fd6fdee7aa6719d35ae8e4b475ebe9cebb13ebfdba8c4dc46d27512ec2d59e859c8095b4bccd56709c49ce815513cc12316602fb23b249dc671e0931b6453f10be8419db203186c7c5a6cb7425209476f83eecfa3037b8ca8ee5a931b98c36134eec1336fbc1017b79c8e6339934b56c3864461ba6798bc9f428da6076b192effe7aadfcdb3cc83f5d55692922188e6563b3586c0c69aee56055bd52351fc3be021c7e8535bd219b039b6032a27d7dd08f77cb93ef4c6be4bd91d9b741602848a86d8f8597a0fb443d41f2384fde7e96b9b552bb267d1636bc5de048a306b809bc47078827d0041106509210f030a7e6307b8ce0ed2b277a97ba9d8da3e81627cb7493632731447f9e35bb5417605727590b87ca96108bfcd7ce26f01fcc26f930155db89f5680316ec78792a25e3c2b0d13dd7e48850c7430e01ab025621edcbec2e2bf8fd0b6543ad37bde9a4e983f313881b40760f34a4788a9bb8da82971d5ad7d21aa8775a14f686f55e3ebc61d4a5ea1a4f25df520530b210dfda34ad79e3441c80abc67d9884fd6889025125ad90298e6e5c130c79bbc6e24739020c08ab0b9afe07033630c238f820ea7c2b44c131d93b3a868b500ea858c900eb42b606c2e29792f8e6e524042cd344da50591c0e960e2e798fbb43aee02f51e322f8de5686543de775dd07946ed82ea8dad9d9ef4e6a63fbc9ce0a8bea398456dbed229453fcba83a124d578676902700d6b93131ffc5d9260c14635ca961ecf79db65915c88382278affde78011ad9c01a85576f7f576b0dde1d14a1612ae061b0dc2c7729b9105c59f9943a215d9772c3e1430e4152b2698284d0df51f0021496ae0f1f2c1b20344d332c3d1fa77776e484c0ab38adf84be3c8a197312a8271629ddf135e7149cd9269228c7620c9b57c3da02f657b5499cef791818dcdd035d1dff2ddb8176c89f66d66319344070718fe76aae9e7983ac248b654490e45ba11a05f4a1954b424e27ee71d1fc0467aed90a688d4a305f883962ca0b87fc73da37f3fbcc49caa27f6501d63101a838496e3e65274cef2c4d8b28dcc7c0c45a990ca1c2329a3c7dac03740da61201615fd359dbd358c378cf7a3260fc7d7b970a84348b6c9a0c11e634d069bac87e082b15208143b4599b9e3e8e0271b08d2e27c628de097505b7c142faf259291d1c7922b680d6454e08bf3139722dd0a74bf3e3774a63672973107b73f25f7b247296da135d9b63da71d0c1b591d5cecce70a7fae1794b8e2e29b9aa4f33399066ad7f757b5d5be47ebefe7283d3b2d93fa6733e2060bf3531a8d3a273701cdb660f660961a7e4190ab7d17f1721be3c6e79ddc67c9855705c3a8a2bb70b3835d462057042043c774ad478ed9ff41bc20a1d1821d26f92900ade81d36cb531de922116a61825a285cd71c2b2be41d7a13b440f469c9533e50155d0fb4210db24cffaf5a4e7afd7d20c7d", @typed={0x8, 0x7c}, @typed={0xc, 0x8b, @u32=0xffff}, @typed={0x18, 0x47, @ipv6=@empty}]}, @typed={0xc, 0xa, @ipv4=@dev={0xac, 0x14, 0x0, 0xb}}, @nested={0x170, 0x59, [@typed={0xc, 0x5f, @pid=r8}, @typed={0xc, 0x73, @u32=0x100000000}, @generic="311cea945a3835ade9f6fe6961d0b69c0c47ce4cb15e19f2178aabeca4176c40d8b792ada4304a4c0287b74d61b3719eb32ca481c5601eeffcbd75288dc3054d58eafdbc36c935b252fe9d72b4464dbc3f022bc2e935bba63600e483a0768545dc3d9b7a", @generic="77865bb95137ebe62ad9d61255f983011363000983d03c0e0fc3df28e35286dea9534386f1867dcc20c49d86508b1e20dee09b55ee01048bf7eefbc2c8dc8db1eac2d21cf2396a3b5d9e3b0bd99e740b521f3e4126f04544d82e0df0024c23155050f3f6e9303c49de95aa1829abdaefb0264a9c3f80174eb1cd309e965073d4ecfcc63679a73410998795fe5a62e56c76b38dc02732142e2ffdf14c06c17067655b37e9daf343f6f24819fc11b0620a18294b83de00b22c32b03cf6f4de4330e18443f3b951f8f7f734eb4fb48bafa5098a39fb5e84d44aa2a66b6cc97877a7485c9ef3", @typed={0xc, 0x41, @ipv4=@empty}]}]}, 0x12b0}, 0x1, 0x0, 0x0, 0x4000801}, 0x40000) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000993000-0x17)={{0x0, 0xf000, 0xe, 0x0, 0x8, 0x9, 0x9, 0x1, 0x8, 0x81, 0x7cb, 0x4}, {0xf000, 0x0, 0xf, 0x5, 0x0, 0x2, 0x5, 0x2, 0x0, 0x80000001, 0x0, 0x2a6}, {0x6000, 0x2000, 0x1d, 0x1, 0x100, 0x10000, 0x7, 0x3, 0x1, 0x9, 0x59, 0x2}, {0x5000, 0x4000, 0xe, 0x7, 0x8, 0xffffffffffffffc0, 0x6e, 0x5, 0x4, 0x1, 0xc1, 0x9}, {0x5000, 0x0, 0x0, 0x10001, 0xffffffff, 0x5, 0x6, 0x9, 0x8001, 0x3, 0x5, 0x800}, {0xf000, 0x1, 0xa, 0x5, 0x8, 0x7ff, 0x3, 0x8001, 0x9, 0x703, 0x5, 0x9}, {0x100000, 0x6000, 0xf, 0x2159, 0x1b, 0x3f, 0x2, 0x800, 0x9, 0x8d61, 0x6, 0x9}, {0x2000, 0xf000, 0xe, 0x0, 0x4, 0x1, 0x101, 0x1f, 0x5, 0x7, 0x2, 0x4}, {0x0, 0x4000}, {0x2, 0x4000}, 0x18, 0x0, 0xf000, 0x400080, 0xa, 0x100, 0x3000, [0x2, 0x6, 0x5, 0x80000000]}) ioctl$KVM_RUN(r7, 0xae80, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000f20000)=0x47, 0x4) 2018/02/04 21:33:31 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) r1 = fcntl$getown(r0, 0x9) rt_sigqueueinfo(r1, 0xf, &(0x7f0000000000)={0x23, 0x8, 0xfcd, 0x8}) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000397000)) 2018/02/04 21:33:31 executing program 7: r0 = socket$bt_sco(0x1f, 0x5, 0x2) fcntl$notify(r0, 0x402, 0x80000006) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000001000-0xb)='/dev/mixer\x00', 0x119241, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x8, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x100000000}}}, &(0x7f0000e8c000-0x4)=0x8c) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000c1b000-0x6)={r2, 0x4000000}, &(0x7f0000000000)=0x6) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000002000-0x8)) r4 = accept4$ax25(r0, 0x0, &(0x7f0000001000), 0x80000) syz_open_dev$sndseq(&(0x7f0000001000)='/dev/snd/seq\x00', 0x0, 0x400) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000001000)={r3, 0x80}, &(0x7f0000000000)=0x6) munlock(&(0x7f000025c000/0x4000)=nil, 0x4000) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000000)) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000001000)=@common='eql\x00', 0x10) r5 = socket$inet(0x2, 0x7, 0x4) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000002000)='/dev/mixer\x00', 0x40000, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000003000-0xe8)={{{@in6=@local, @in=@loopback, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000003000-0x4)=0xe8) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000003000-0x28)={@generic="880cb90c0e341d11dcf6d002b97ae750", r7}) r8 = syz_open_dev$dmmidi(&(0x7f0000001000-0xd)='/dev/dmmidi#\x00', 0x8, 0x200) getsockname$netrom(r1, &(0x7f0000000000)=@ax25, &(0x7f0000001000)=0x10) connect$rds(r8, &(0x7f0000000000)={0x2, 0x3, @multicast1=0xe0000001}, 0x10) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000003000)=0xffffffffffffff81, 0x4) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x3, &(0x7f0000005000-0x8)) 2018/02/04 21:33:31 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:31 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_extract_tcp_res$synack(&(0x7f000080e000-0x8), 0x1, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000f52000-0x9)='/dev/vcs\x00', 0x20000, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000696000-0x4)=0x3, 0x4) pipe(&(0x7f000098f000)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0x40a45323, &(0x7f000052c000)={{0x37, 0x9}, 'port0\x00', 0x4, 0x80000, 0x4120, 0xed7, 0x800, 0x7fc000, 0x6, 0x0, 0x5, 0x3}) recvmmsg(0xffffffffffffff9c, &(0x7f0000ef2000)=[{{&(0x7f0000c67000-0x8)=@sco, 0x8, &(0x7f0000d47000)=[{&(0x7f000004d000-0x6b)=""/107, 0x6b}, {&(0x7f0000fd0000)=""/66, 0x42}, {&(0x7f000020b000)=""/233, 0xe9}, {&(0x7f0000faf000)=""/161, 0xa1}, {&(0x7f0000266000-0x10)=""/16, 0x10}, {&(0x7f00004a1000)=""/71, 0x47}, {&(0x7f0000f1b000-0xb9)=""/185, 0xb9}, {&(0x7f00001fd000)=""/66, 0x42}], 0x8, &(0x7f0000574000)=""/149, 0x95, 0x400}, 0x6}, {{&(0x7f0000f51000-0x10)=@ethernet={0x0, @random}, 0x10, &(0x7f0000d90000-0x10)=[{&(0x7f0000219000-0xfe)=""/254, 0xfe}, {&(0x7f0000467000)=""/88, 0x58}], 0x2, &(0x7f00005d9000)=""/185, 0xb9, 0x6}, 0x2f1}, {{&(0x7f0000655000-0x3a)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @mcast2}}}, 0x3a, &(0x7f00002f8000-0x18)=[{&(0x7f0000deb000-0xa2)=""/162, 0xa2}, {&(0x7f00009ba000-0x55)=""/85, 0x55}, {&(0x7f0000553000-0xd0)=""/208, 0xd0}], 0x3, 0x0, 0x0, 0xffffffffffffff12}, 0x3ff}, {{0x0, 0x0, &(0x7f0000254000-0x40)=[{&(0x7f0000889000-0x45)=""/69, 0x45}, {&(0x7f00001ee000-0xfa)=""/250, 0xfa}, {&(0x7f0000ada000)=""/118, 0x76}, {&(0x7f0000fc8000-0x35)=""/53, 0x35}, {&(0x7f0000b89000-0x43)=""/67, 0x43}, {&(0x7f0000bb6000)=""/79, 0x4f}, {&(0x7f00002f8000-0x1000)=""/4096, 0x1000}, {&(0x7f00005ac000)=""/63, 0x3f}], 0x8, &(0x7f0000fd3000)=""/162, 0xa2, 0x80000001}, 0x80}, {{&(0x7f0000ca5000)=@alg, 0x58, &(0x7f00007fe000-0x38)=[{&(0x7f00009c6000)=""/4096, 0x1000}, {&(0x7f00009ce000)=""/49, 0x31}, {&(0x7f000042b000-0x4c)=""/76, 0x4c}, {&(0x7f0000849000-0x54)=""/84, 0x54}, {&(0x7f0000516000-0x83)=""/131, 0x83}, {&(0x7f0000052000-0x38)=""/56, 0x38}, {&(0x7f0000d39000-0x1000)=""/4096, 0x1000}], 0x7, &(0x7f0000c97000)=""/93, 0x5d, 0x10001}, 0xffffffffffffffe1}, {{&(0x7f00007b0000)=@l2, 0xe, &(0x7f0000912000)=[{&(0x7f0000e96000-0xe4)=""/228, 0xe4}, {&(0x7f00001b6000-0xb3)=""/179, 0xb3}, {&(0x7f0000169000-0x9)=""/12, 0xc}, {&(0x7f0000fce000-0xc5)=""/197, 0xc5}], 0x4, &(0x7f0000248000), 0x0, 0x1}}], 0x6, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000f9b000)={0x0, @in6={{0xa, 0x2, 0x6, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x8000}}, [0x8, 0x0, 0x7fff, 0x0, 0x40, 0x4, 0xd1, 0x9, 0x5, 0x3, 0x6, 0x9, 0x80, 0xfffffffffffffffa, 0x3]}, &(0x7f000056a000-0x4)=0x108) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000134000-0x10)={0x5, 0x1, 0x5, 0x69d, r4}, &(0x7f000082e000)=0xffffffffffffff90) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000e2c000)='/dev/ppp\x00', 0x2d0000, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r5, 0x4008ae48, &(0x7f00001cd000)=0x1) syz_emit_ethernet(0x72, &(0x7f0000cd8000-0x72)={@link_local={0x1, 0x80, 0xc2}, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [{[], {0x8100, 0x2, 0x7, 0x8}}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x60, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @rand_addr=0xfffffffffffffe01, @dev={0xac, 0x14, 0x0, 0x200000000000a}, {[]}}, @icmp=@redirect={0x5, 0x0, 0x0, @multicast2=0xe0000002, {0x11, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000000000001, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @loopback=0x7f000001, {[@ssrr={0x89, 0x1b, 0x0, [@multicast2=0xe0000002, @loopback=0x7f000001, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @empty, @multicast1=0xe0000001, @broadcast=0xffffffff]}, @cipso={0x86, 0x12, 0x0, [{0x0, 0xc, "88fe44cd5abaaa4de7f7"}]}]}}}}}}}, &(0x7f0000c29000)={0x0, 0x1, [0x0]}) fadvise64(r1, 0x0, 0x1f, 0x7) [ 84.252954] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:32 executing program 3: mmap(&(0x7f0000000000/0xac7000)=nil, 0xac7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000ac3000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) socket(0x1e, 0x2, 0x0) bind(r0, &(0x7f0000557000+0x130)=@generic={0x1e, "00000000e5437c79f38e0962fd064b94f8c579e221b30c73c8980405c7bad62e0a53a632ed4938d33973fb8f8401a3ff59829a2b0afe9de43a4b0470a0c52166698e021f6f65dcf160e7e58f358c719af00fd158899bcb3151314acaf1f1322ca5bdb9c8386f0baa77aeb86eef1c1d6d7c980ee590c8b9f70dc13bcb184a"}, 0xe901116c7eb27e3e) [ 84.277230] binder: 10997:10998 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 84.296202] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/04 21:33:32 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000151000)='/dev/usbmon#\x00', 0xe5, 0x50d500) accept4$vsock_stream(r0, &(0x7f000042a000)={0x28, 0x0, 0x2711, @any=0xffffffff}, 0x10, 0x80000) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:32 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 84.320356] binder: 11001:11005 ioctl 40046207 0 returned -16 [ 84.340157] binder: 11001:11021 transaction failed 29189/-22, size 24-8 line 2842 2018/02/04 21:33:32 executing program 4: r0 = socket(0x40000000015, 0x5, 0x0) setsockopt(r0, 0x400000000114, 0x7, &(0x7f0000a00000-0x4), 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000000)={0x9, 0x9, 0xfffffffffffff001, 0x3, 0x0}, &(0x7f0000674000-0x4)=0x10) socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2000, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r2, 0x7706, &(0x7f0000001000)) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000001000-0x8)={r1, 0x7}, 0x8) 2018/02/04 21:33:32 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000b80000)='./file0\x00', 0x0) r0 = creat(&(0x7f0000016000-0xc)='./file0/bus\x00', 0xbc9dc8fbd81cb4af) r1 = geteuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00005f8000)={0x0, 0x0, 0x0}, &(0x7f0000aef000)=0xc) fchownat(r0, &(0x7f0000927000-0x12)='./file0/bus/file0\x00', r1, r2, 0x1400) syz_open_dev$amidi(&(0x7f0000168000)='/dev/amidi#\x00', 0x0, 0x22080) ftruncate(r0, 0x0) [ 84.366554] binder: 11001:11005 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 84.369288] binder: 11024:11026 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 84.402211] binder_alloc: binder_alloc_mmap_handler: 11001 20000000-20002000 already mapped failed -16 [ 84.424700] binder: BINDER_SET_CONTEXT_MGR already set [ 84.430215] binder: 11001:11005 ioctl 40046207 0 returned -16 [ 84.458286] binder: 11001:11005 transaction failed 29189/-22, size 24-8 line 2842 [ 84.466107] binder: 11001:11021 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:32 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000f0f000)='\x00', 0x1) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00002eb000+0x417)={&(0x7f0000423000/0x1000)=nil, 0x1000}) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:32 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000267000)='/dev/vcs#\x00', 0x200, 0x8000) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0186415, &(0x7f0000a95000-0x18)={&(0x7f00008a2000/0x4000)=nil, 0x6, 0x3, 0x28, &(0x7f0000533000/0x3000)=nil, 0x2}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00003bc000)=[{&(0x7f0000505000)="29000000200019fff63d0014000000060a00003415de0005190000040d000c000000800000f9000008", 0x29}], 0x1) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000db7000)=0x3) ioctl$KDSKBLED(r1, 0x4b65, 0x20) socketpair(0x17, 0x6, 0xffffffff, &(0x7f0000919000)) socketpair$inet_icmp(0x2, 0x2, 0x1, &(0x7f000010b000)) 2018/02/04 21:33:32 executing program 3: mmap(&(0x7f0000000000/0x39d000)=nil, 0x39d000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f000039b000)=@filter={'filter\x00', 0xe, 0x4, 0xfffffffffffffe04, 0xffffffff, 0x1c4, 0x94, 0x1c4, 0xffffffff, 0xffffffff, 0x98, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f000039c000-0x40), {{{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0x1c4}}, [{{@ip={@local={0xac, 0x14, 0x0, 0xaa}, @loopback=0x7f000001, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @common='lo\x00', {}, {0x800000}}, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00'}}, {{@ip={@multicast1=0xe0000001, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a, 0x0}, @syzn={0x73, 0x79, 0x7a}, {}, {}, 0x0, 0x1}, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00'}}, {{@ip={@rand_addr=0x7, @empty, 0xff0000ff, 0xff000000, @syzn={0x73, 0x79, 0x7a, 0x0}, @common='bond0\x00', {0xff}, {0xff}, 0xff, 0x1, 0x44}, 0x0, 0x70, 0x98, 0x0, {}, []}, @common=@unspec=@NFQUEUE0={0x24, 'NFQUEUE\x00', 0x0, {0x3}}}]}}, 0x2b8) 2018/02/04 21:33:32 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$midi(&(0x7f0000caf000)='/dev/midi#\x00', 0x7, 0x1) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r1, 0x80dc5521, &(0x7f0000ac5000-0x55)=""/85) bind$alg(r0, &(0x7f00005c0000-0x58)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58) bind$alg(r0, &(0x7f000092e000-0x58)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) 2018/02/04 21:33:32 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:32 executing program 2: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000001000-0x4)={0x0}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x100, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, &(0x7f0000003000-0x8)={0x0, 0x3}, &(0x7f0000002000-0x4)=0x8) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r1, 0x118, 0x1, &(0x7f0000001000)=0x8, 0x4) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockname(r1, &(0x7f0000000000)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000005000-0x4)=0x14) io_setup(0x1, &(0x7f0000004000-0x4)=0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KDMKTONE(r1, 0x4b30, 0x3) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendto$unix(r0, &(0x7f0000005000)="249a1003e26ed557d208fd04f971d81b08a43cd13bc2464864460c93b6e6128884ff151853d10f4af2671529232a276738cee059e5734ddcb8a787035eaa6b99a44dd7feac42cc281decf0a9bdd619bf34c294275217418f650063bc766dca3423e90a53c03fb0bde25428edc5203db044e10902c6ef8be742dafc45739226d9144222e88f9763300b2cd494aacc1afa382d026c376327187eaa4ea8e2bb141087ec5838b8", 0xa5, 0x4800, &(0x7f0000005000)=@file={0x0, './file0\x00'}, 0xa) io_cancel(r3, &(0x7f0000001000-0x40)={0x0, 0x0, 0x0, 0x7, 0x10000, r0, &(0x7f0000000000)="083d11faf9f938d21b9b2784bdd3c34d950dea08819a7733801505429a043b069f05a6b0af686820586fcefbc27960a5fe7f8b36abe1b8d1e4c6080d8ab0cdf02e3770b56a30563690881dfd05126ffae9ff3e70179d8eb43936fde8feedca8aae7230ad821e48a03c13793fa9f119cf3302c0337ecd2b1f070dc2bb7ebcd1a9160244d9b3ec8ceb7bcfd51b924c65202d18f54b7823bc975ac96f3a60f4c42419a0606e1f66fec993f0d779c418fadc7765a5f582a5c85465b794c84b58c93c13eafc6c7f9a21488a4d4518b9213deff5674259d06a62", 0xd7, 0x7ff, 0x0, 0x0, r1}, &(0x7f0000003000+0x1aa)) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000002000-0x8)={r2, 0x1}, 0x8) 2018/02/04 21:33:32 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000, 0xffffffffffffff9c}) ioctl$DRM_IOCTL_MODESET_CTL(r0, 0x40086408, &(0x7f0000a1b000)={0x200, 0x1093}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_VERSION(r0, 0xc0246400, &(0x7f0000867000)={0x1, 0x7f, 0xd7c5, 0xb0, &(0x7f00009c9000)=""/176, 0x27, &(0x7f0000818000)=""/39, 0xd4, &(0x7f0000cd0000)=""/212}) perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_get$uid(0x3, 0x0) 2018/02/04 21:33:32 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f000079c000)='/selinux/checkreqprot\x00', 0x40, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000488000-0xc)={0x7, r0}) [ 84.490251] binder: undelivered TRANSACTION_ERROR: 29189 [ 84.495843] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:32 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:32 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc010643a, &(0x7f0000d43000)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fdd000)=0x3) ioctl$PIO_UNISCRNMAP(r1, 0x80047456, &(0x7f00007da000-0x7a)) clone(0x0, &(0x7f0000560000), &(0x7f0000489000), &(0x7f0000001000-0x4), &(0x7f000067c000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:32 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000f9c000-0x8)={0x0, 0x0}) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00007c8000-0x14), &(0x7f0000f31000-0x4)=0x14) r1 = syz_open_procfs(0x0, &(0x7f000059c000-0xc)='net/igmp\x00') perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f000061c000)=[{&(0x7f00003d7000)=""/23, 0x17}], 0xd7, 0x0) 2018/02/04 21:33:32 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:32 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000cf7000-0x1c)=[@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}], 0x1c) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000a5a000-0xb)='/dev/hwrng\x00', 0x40080, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000b2a000)={0x0, 0x0, 0x30}, &(0x7f0000964000+0x1e5)=0xc) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000b1f000)={r2, 0xffffffff}, &(0x7f0000a5a000)=0x6) connect$inet6(r0, &(0x7f00008e1000)={0xa, 0x2, 0x0, @loopback={0x0, 0x1}, 0x9}, 0x1c) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f000070b000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x14) 2018/02/04 21:33:32 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f000043b000)=0x0) r1 = syz_open_procfs(r0, &(0x7f00008e0000-0x6)="6664001f66d0") exit(0x0) accept4$ax25(r1, 0x0, &(0x7f0000081000-0x4), 0x80000) linkat(r1, &(0x7f000046a000)='./file0\x00', 0xffffffffffffffff, &(0x7f0000465000)='./file0\x00', 0x0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00009dc000-0x4), &(0x7f000015a000)=0x4) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f00009a7000)={[0xd000, 0x6000, 0x7000, 0x104000], 0x9, 0x20, 0x100000001}) [ 84.548269] binder: 11048:11049 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 84.556343] binder_alloc: binder_alloc_mmap_handler: 11047 20000000-20002000 already mapped failed -16 [ 84.577242] binder: BINDER_SET_CONTEXT_MGR already set [ 84.583876] binder: 11047:11050 ioctl 40046207 0 returned -16 2018/02/04 21:33:32 executing program 3: r0 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x8001, 0x4) mmap(&(0x7f0000000000/0x29000)=nil, 0x29000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000029000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f000001b000)={{{@in=@multicast2, @in6=@loopback, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000002000)=0xfffffffffffffe8c) mmap(&(0x7f0000029000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f000002a000-0xe8)={{{@in=@broadcast=0xffffffff, @in=@dev={0xac, 0x14, 0x0, 0xf}, 0x3, 0x0, 0x0, 0xfffffffffffffffb, 0xa, 0xa0, 0xa0, 0x67, 0x0, r1}, {0x0, 0x0, 0x1, 0xc000000000000, 0xff, 0x7d700b9b, 0xffffffff, 0x40000000000000}, {0x0, 0x0, 0x2, 0xa5e}, 0x12, 0x7, 0x0, 0x1, 0x2}, {{@in6=@local={0xfe, 0x80, [], 0x0, 0xaa}, 0x1, 0x33}, 0x2, @in=@remote={0xac, 0x14, 0x0, 0xbb}, 0xffffffffffffffff, 0x4, 0x3, 0x7, 0x5c7, 0x473ca89a, 0x6}}, 0xe8) r2 = socket$inet(0x2, 0x80002, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f000001f000-0x310)=@filter={'filter\x00', 0xe, 0x4, 0x6f, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000), {{{[], 0x0, 0x70, 0x98}, {0xffffffffffffff8c, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@uncond, 0x0, 0x70, 0x98, 0x0, {}, [@common=@ah={0x0, 'ah\x00'}]}, @REJECT={0x28, 'REJECT\x00'}}, {{@uncond, 0x0, 0xfffffd9b, 0xc0, 0x0, {}, [@common=@unspec=@connlabel={0x28, 'connlabel\x00'}]}, @REJECT={0x28, 'REJECT\x00'}}, {{@uncond, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}]}}, 0x5e0) [ 84.630199] binder_alloc: 11047: binder_alloc_buf, no vma [ 84.635861] binder: 11047:11050 transaction failed 29189/-3, size 24-8 line 2957 [ 84.644622] binder: 11047:11058 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:32 executing program 3: mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) mmap(&(0x7f0000013000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f0000005000-0x38)={0x0, 0x0, &(0x7f0000004000)=[], 0x1, 0x0, 0xfffffffffffffd5a, 0x44000008}, 0x0) 2018/02/04 21:33:32 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f000022a000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair(0x20000000026, 0x80b, 0x0, &(0x7f0000de5000-0x8)={0x0, 0x0}) ioctl$KVM_DEASSIGN_PCI_DEVICE(r2, 0x4040ae72, &(0x7f000067f000-0x14)={0x8, 0x100000001, 0x3, 0x4, 0x7f}) getpeername$llc(r2, &(0x7f00000d8000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f000048d000)=0x10) ioctl$DRM_IOCTL_SET_MASTER(r1, 0x641e) setsockopt$bt_l2cap_L2CAP_CONNINFO(r2, 0x6, 0x2, &(0x7f00000fb000-0x5)={0x80000000000801, 0x3fe, 0x1f, 0x9}, 0x5) 2018/02/04 21:33:32 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000f59000), 0x4) sendto$inet(r0, &(0x7f0000fd0000), 0x0, 0x200007ff, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000b06000-0x4)=0x290, 0x4) sendto$inet(r0, &(0x7f00006fd000)="c3401c344654f3c7d9b41ba48c8e399aa4eedc3d6bd8ebd65c856a27d61154adc2b2a9763ae0201c0d32e11f38e9dd18c58f6bd779650fc30f93653bdaecf323c9f6502ceab47e58114347b289546465a5eb278de12b1989f64cc99412e36880d20c34d91051b22f6c8acc9d082b7bcdec844f667da0867d08d4154004997e317b79", 0x82, 0x0, &(0x7f0000e66000)={0x2, 0xffffffffffffffff, @rand_addr}, 0x10) writev(r0, &(0x7f0000447000-0x40)=[{&(0x7f0000afd000)="87586a29a1cf4fd66a13df6c", 0xc}], 0x1) sendto$inet(r0, &(0x7f00005ca000-0x90)="1f2c5bf5d20860edd616704012d4344825b07f123e0471cbff0bddf748e0d4390f7d59a04c8caef9327ff596db57dab59ae28d2e4fc172c39132c0c529754899253f7a2ae04dad49b3fb6922a9363fd2ead98b297c5d89fb1a54fcb30851bf8c727e06fe7303ad96715b468117d011d46c52f11ce74a", 0x76, 0x1, &(0x7f00006a1000)={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}, 0x10) shutdown(r0, 0x1) 2018/02/04 21:33:32 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:32 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) r1 = open(&(0x7f0000cb8000)='./file0\x00', 0x2001, 0x20) getsockopt$inet_dccp_int(r1, 0x21, 0x10, &(0x7f0000a78000), &(0x7f00002b3000-0x2)=0x4) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f000063d000-0x48)={0x2, 0x0, [{0x3001, 0xac, &(0x7f00006bb000-0xac)=""/172}, {0x1001, 0x1f, &(0x7f000025a000-0x1f)=""/31}]}) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000c8a000)={0x10000, {{0xa, 0x0, 0x5, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x1ff}}}, 0x88) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000113000)='/selinux/checkreqprot\x00', 0x181040, 0x0) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000708000)) 2018/02/04 21:33:32 executing program 2: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000001000-0x8)={0x0, 0x0}) pread64(r0, &(0x7f0000229000)=""/88, 0x58, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00007b2000)) r2 = getpgid(0xffffffffffffffff) r3 = syz_open_procfs(r2, &(0x7f00005f6000-0x3)='io\x00') bind$alg(r1, &(0x7f0000466000)={0x26, 'hash\x00', 0x0, 0x0, 'sm3-generic\x00'}, 0x58) r4 = accept4$alg(r1, 0x0, 0x0, 0x0) sendfile(r4, r3, &(0x7f0000807000), 0x3f) 2018/02/04 21:33:32 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f000045c000-0x12)='/dev/snd/midiC#D#\x00', 0x7, 0x8100) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f000046f000)) r1 = epoll_create1(0x80000) fsetxattr(r1, &(0x7f0000c68000)=@random={'os2.', '$\x00'}, &(0x7f0000bde000)='#\x00', 0x2, 0x0) capset(&(0x7f0000fc2000-0x8)={0x4000019980330}, &(0x7f0000002000-0x18)) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f000052d000-0xe8)={{{@in6=@ipv4={[], [], @multicast1}, @in=@rand_addr, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f0000fbc000-0x4)=0xe8) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000e65000-0x18)={@empty, 0x85, r2}) syz_open_dev$admmidi(&(0x7f000043f000-0xe)='/dev/admmidi#\x00', 0x0, 0x40000) socket(0xa, 0x3, 0x9a) 2018/02/04 21:33:32 executing program 3: mmap(&(0x7f0000000000/0xde4000)=nil, 0xde4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x5, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) ioctl$sock_proto_private(r0, 0x89e1, &(0x7f0000b44000-0xf4)="d84856522bdc0bf31cd4b7c3dfa66e5a5237c26893e46eedffadc33a499572cfb4bfd8d07059f8c6da0b41ae59093e6480f0e9e6e3db97f404d9b292492a0bfbbd5636403a7ad80c890bf8a622f9a0ff2e7d4452f05e12422fe8eef083478fa17ffdc9c7e7d2bae0e75ea98a80d30911524f02d1ce3d914b43f7633c585bdeb12abe00d381b55ade73fe13cb317e719b09f7bf764b1b431afe93e343757bc16e36114650b68caff55fda8127f3f4b48654e16276e45d60a6884b68acb5942786ed3e03a0a624f1cc067deb12afd792d94ec56cd0d1e143b86ca9af2a9e9bd8d4e18b6e9ed66a3d7ec49ed0c8a6e98b9965575990") r1 = dup2(r0, r0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000713000)={0x6}, 0x1) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000001000-0x54)={0x0, {{0xa, 0xffffffffffffffff, 0x1, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}, {{0xa, 0xffffffffffffffff, 0xfffffffffffffffc, @empty}}}, 0x108) mmap(&(0x7f0000de4000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000de5000-0x8)={0x0, 0x6, 0x2}, &(0x7f0000335000)=0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00007e6000)={r2, 0x4, 0x5, [0xa030, 0x84df, 0x100000000, 0xe17, 0x8]}, 0x12) 2018/02/04 21:33:32 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = accept4$inet6(0xffffffffffffffff, &(0x7f000015b000-0x1c)={0x0, 0xffffffffffffffff, 0x0, @remote}, &(0x7f0000ea3000-0x4)=0x1c, 0x80000) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000c82000-0xc)='/dev/rfkill\x00', 0x22600, 0x0) ioctl$KVM_GET_TSC_KHZ(r1, 0xaea3) connect$inet6(r0, &(0x7f000038a000-0x1c)={0xa, 0x0, 0x3, @dev={0xfe, 0x80, [], 0x0, 0x13}, 0x5}, 0x1c) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) [ 84.700078] binder: undelivered TRANSACTION_ERROR: 29189 [ 84.707562] binder: release 11047:11050 transaction 172 out, still active [ 84.714655] binder: undelivered TRANSACTION_COMPLETE [ 84.719844] binder: send failed reply for transaction 172, target dead 2018/02/04 21:33:32 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000b7f000)='/dev/autofs\x00', 0x101000, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000f5000), &(0x7f000062e000-0x4)=0x4) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:32 executing program 6: r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:32 executing program 0: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffffff) fchmodat(r0, &(0x7f0000666000-0x8)='./file0\x00', 0x20) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) readv(r1, &(0x7f0000e95000-0x28)=[{&(0x7f0000a78000-0x1000)=""/4096, 0x1000}, {&(0x7f0000e01000)=""/24, 0x18}, {&(0x7f000084c000)=""/64, 0x40}, {&(0x7f0000b47000-0xc6)=""/198, 0xc6}, {&(0x7f0000f19000)=""/240, 0xf0}], 0x5) sendmsg$nl_generic(r0, &(0x7f0000391000)={&(0x7f0000cef000-0xc)={0x10, 0x0, 0x0, 0x80008}, 0xc, &(0x7f0000c17000)={&(0x7f0000090000)={0x168, 0x1d, 0x10, 0x2, 0x1, {0x18}, [@nested={0x154, 0x2d, [@generic="5d7f60376ec12bb9d85cd4bf3d888436c3682cc4286b6ecd766cf06b554247057381fb9367269a9f6bb6fab40122ca0f20b347c7ed7efee04f9dc645c0426d348cc62f4e5f5edb5965e9b84e7bb8a6fb1be37b7cf10d1a6e81e97a54d4eab13b5f7be5aa433825acfc27c16e8a3ab1784c8409b3336873ae926d35648dc729e55b876fa510cb1f4a45573cd1434edb89d6b87c18f8e3b426cd93f60032", @generic, @generic="bdb0dd83a7659bc96f69e42694e7f244ea7ef2fe8096c4dc282468dec6e9c6e5f3689dd6da1853457bde7a373d58a35f53b5d1851acbf9672d6d972840db248d922e1ebbdc917c6dcb0edd966ec10f82364ce09e56ba6432c37868e6bec86f676708a475c207b77c0fca3b82b33791dca58f9245f73625e90e8c6360befece381b556d82047a810b7206b7220e2044a705f0d3ddcfcb0d7d531adc3490e3ce34", @typed={0x10, 0x21, @u64}]}]}, 0x168}, 0x1, 0x0, 0x0, 0x4000}, 0x800) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0xd}}, 0x0, 0x0, r1, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000852000), &(0x7f0000eb8000)=0x4) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000818000-0x8)={0x9, &(0x7f0000304000)=[{0x8001, 0x3}, {0x1, 0x1000000}, {0x6, 0x9}, {0x1ff, 0x8}, {0x6, 0x3f}, {0x1, 0x8001}, {0x4, 0x2}, {0xffffffffffffff53, 0xffffffffffffb4de}, {0x0, 0xffff}]}) r2 = syz_open_procfs(0x0, &(0x7f000022e000-0xe)='oom_score_adj\x00') clock_gettime(0x0, &(0x7f0000575000-0x8)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000bdc000-0x10)={{r3, r4+30000000}}, 0x0) writev(r2, &(0x7f0000b97000)=[{&(0x7f0000962000)='5', 0x1}], 0x1) r5 = add_key$keyring(&(0x7f0000447000)='keyring\x00', &(0x7f0000a01000)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$invalidate(0x15, r5) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f00009f6000)) [ 84.808691] binder_alloc: binder_alloc_mmap_handler: 11100 20000000-20002000 already mapped failed -16 [ 84.846444] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/04 21:33:32 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = fcntl$getown(0xffffffffffffff9c, 0x9) r1 = syz_open_procfs(r0, &(0x7f00008a5000)="6174747200cdbb2e9a7c90f69495564acbd0c81d5e20a4e3588c1adb8abd5aaf36b8ed03bc14374c6261bfd9323ef1d0798a55b84b0ac091680b56e04318e94fe790bdd8a988c1eb87613d") ioctl$TIOCNXCL(r1, 0x540d) readlinkat(r1, &(0x7f0000730000)='./file0\x00', &(0x7f00004d6000-0x31)=""/49, 0x31) 2018/02/04 21:33:32 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000250000)='net/fib_trie\x00') sendfile(r0, r0, &(0x7f0000efd000), 0x2) 2018/02/04 21:33:32 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair(0x5, 0x5, 0x4, &(0x7f0000000000)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0485510, &(0x7f0000547000)={0x8, 0x3, 0x1, 0x3, &(0x7f000048c000)=[{}, {}, {}]}) futex(&(0x7f0000001000-0x4), 0x85, 0x0, &(0x7f00003de000), &(0x7f0000153000-0x4), 0x40000001) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000003000-0x20)={{&(0x7f0000b6d000/0x4000)=nil, 0x4000}, 0x3}) open_by_handle_at(r1, &(0x7f0000002000-0xdc)={0xdc, 0x15, "b2e42b0309e21e59c054ca91eef680293c627c2dfd3ddee1142b1d7899049e0355bca02b61f6237db8113ef1c1539e60eda7e2be371dca1b0c066a5a8d3004718f23c7b5c65ace88a735fbb867cebda71e4a1871f31e57b40e3cbd0747c038c457c0ab7a1ecf81660ef2fe44677ee80a3224eb5ddf2aa32ac47dc365bea1ba0345f1a1248c292e3504f4a0367a2f567e20ff110167124026e570d151463df280ea0ccc0dcc498338673c82df9875cd27a9e25c00b2eaf52a9cc90e91a4c053806b7ae6b06630f2e7375d1a3db3becafb29f8af84"}, 0x210002) 2018/02/04 21:33:32 executing program 6: r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:32 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00003b7000-0x8)='./file0\x00', 0x10000000080040, 0x0) fcntl$setlease(r0, 0x400, 0x0) rename(&(0x7f0000fdc000-0x8)='./file0\x00', &(0x7f0000888000-0x8)='./file1\x00') rt_sigprocmask(0x0, &(0x7f0000033000-0x8)={0xfffffffffffffffc}, 0x0, 0x8) rt_sigtimedwait(&(0x7f00009ac000)={0xfffffffffffffffd}, &(0x7f0000fe5000-0x10), &(0x7f000003a000-0x10)={0x0, 0x8000000}, 0x8) fcntl$setsig(r0, 0xa, 0x3f) creat(&(0x7f0000fdf000-0x8)='./file1\x00', 0x0) fcntl$getflags(r0, 0x401) 2018/02/04 21:33:32 executing program 7: mmap(&(0x7f0000000000/0xd000)=nil, 0xd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000005000/0x2000)=nil) mlock(&(0x7f0000003000/0x2000)=nil, 0x2000) mremap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000003000/0x3000)=nil) mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f000000e000-0xf)='/dev/sequencer\x00', 0x4060c1, 0x0) mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mremap(&(0x7f000000a000/0x4000)=nil, 0x4000, 0x1000, 0x0, &(0x7f0000000000/0x1000)=nil) mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r0) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f000000e000)={@generic="e0c580f00d96b91c283c6bc8a8ab1811", @ifru_addrs={0x2, 0x1, @rand_addr=0x4}}) ioctl$KVM_GET_DIRTY_LOG(r0, 0x4010ae42, &(0x7f000000d000)={0x1fd, 0x0, &(0x7f0000005000/0x1000)=nil}) 2018/02/04 21:33:32 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00008f8000-0xd)='/selinux/policy\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0x0, 0x4) syz_emit_ethernet(0x2a2, &(0x7f0000d53000-0x2a2)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x26c, 0x21, 0x0, @dev={0xfe, 0x80, [], 0xffffffffffffffff, 0xe}, @dev={0xfe, 0x80, [], 0x0, 0x17}, {[], @gre={{0x0, 0x0, 0x1, 0xd4d, 0x0, 0x20, 0x0, 0x1, 0x880b, 0xaf, 0x2, [0x6, 0x4], "104659a71cad83a968ac6c4bf63119c5642a70de862f148943f17b15020cecd5561b27ec5edacd6baf9690104856854bbf3f6cabe6f9454a64550fab7c6c8ec176cf4c4acb7d9a7896300de5ee4cf348191dcd000bee4b2c1773679dda5412b4769435026aa7e0ea7c81197415a9b290f4f428be6598177d89721905640345c9c2d12d9240783337c82d6f4816108d5ee66bab6d9f34dd57149f90dd513837440089e790d29cdc546002eb00979f43"}, {0x5, 0x0, 0x1, 0x8001, 0x0, 0x0, 0x800, [0x0, 0x2], "786459b81b9f79f0edbcb72498d7db2337dec36dd880a6f56d7749f25b861666fc489faed0a222e83448c2af95799a20a53fe59b481e482725d28b3d33f79fa0c8b29ec156a437d69dd047d8434472717d2b1234c21bc8954d9779b6361169c05636093fffde357d593ab87fe38a5f803e80130884218ae4c2b955a3f60bba2ebcd6b8e03eeb5aac172f8e56e5a734f2596f6f23c2e4eb67456428e6a636aa1956b786ef408803868799fa30c2c2c7bacee74b3d2c0f2abd88de3ce5db658273aebdd9e9881ca2dab762da41e7862728478c679c7796757797dd0092f3ce89ed25a73b40ca8a8f3abf74df494db93aba47c171de5c"}, {0xb04, 0x0, 0x3, 0x3, 0x0, 0x0, 0x86dd, [0x49ac, 0x8, 0x7], "8e523d92419f25c2d359d7e45788347568f8cf85a2ef4b6cfc0a794d0cbcb41e885bcdae5ee36e1c818be15e29ace24301527082ccbc24898499f852fa770b7d6818a847ed3055da2ae03fde802594ec45fd97ebbdd3349ea477d822b92d543a95ac9f9389496d519900aac8276b8771f15cdb629550581e9487b19d5e904f32b35434dc11ff4e53a13d50a089e9260e5b45cb933c6fe927252e58c372c597a42b73e673c79c725957cb"}}}}}}}, &(0x7f0000a8f000-0x8)={0x0, 0x0, []}) 2018/02/04 21:33:32 executing program 6: r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 84.853379] binder: 11100:11104 ioctl 40046207 0 returned -16 [ 84.867577] binder_alloc: 11100: binder_alloc_buf, no vma [ 84.873343] binder: 11100:11126 transaction failed 29189/-3, size 24-8 line 2957 [ 84.894600] binder: 11100:11104 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 84.964146] binder: undelivered TRANSACTION_ERROR: 29189 [ 84.970595] binder: release 11100:11104 transaction 177 out, still active [ 84.977607] binder: undelivered TRANSACTION_COMPLETE [ 84.982781] binder: send failed reply for transaction 177, target dead 2018/02/04 21:33:32 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$llc(0x1a, 0x3, 0x0, &(0x7f0000001000-0x8)={0x0, 0x0}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000899000)) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000fd9000-0x4)) getpid() gettid() r2 = getpgid(0x0) r3 = syz_open_procfs(r2, &(0x7f0000c88000-0xa)='sched\x00') bind$alg(r1, &(0x7f000039a000-0x58)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-ssse3\x00'}, 0x58) getsockopt$inet6_buf(r3, 0x29, 0xd2, &(0x7f0000afa000-0xa1)=""/161, &(0x7f0000777000)=0xa1) signalfd4(r0, &(0x7f00003d7000)={0x7}, 0x8, 0x800) r4 = accept4$alg(r1, 0x0, 0x0, 0x0) sendfile(r4, r3, &(0x7f0000a2f000-0x4), 0x3ff) 2018/02/04 21:33:32 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00002fc000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) utime(&(0x7f0000c4c000)='./file0\x00', &(0x7f0000a98000)={0x5}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00006cf000)={0x10005, 0x0, 0x0, 0x1000, &(0x7f0000a98000/0x1000)=nil}) ioctl$KVM_SMI(r2, 0xaeb7) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000cf5000-0x9)='/dev/rtc\x00', 0x41, 0x0) r4 = getpid() lstat(&(0x7f0000aad000)='./file0\x00', &(0x7f0000447000)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getegid() sendmmsg$unix(r3, &(0x7f00006a9000-0x38)=[{&(0x7f000077d000)=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000280000-0x10)=[{&(0x7f0000fce000-0x15)="696e0aa15790a764fd1a70131c244cdd355433e610", 0x15}, {&(0x7f0000b77000)="8837e2485f5215f3e08ab497653b2c34be08d1b53bb7fde3fae680f6d61e1e8aa044f45948aeec88875db47cf2c51176271906bb52d39b", 0x37}], 0x2, &(0x7f0000262000-0x8c)=[@rights={0x18, 0x1, 0x1, [r1, r2, r1]}, @cred={0x18, 0x1, 0x2, r4, r5, r6}, @rights={0x28, 0x1, 0x1, [r2, r0, r0, r1, r2, r0, r0]}, @rights={0x10, 0x1, 0x1, [r2]}, @rights={0x24, 0x1, 0x1, [r2, r1, r1, r2, r2, r2]}], 0x8c, 0x4000010}, {&(0x7f000066b000)=@file={0x0, './file0\x00'}, 0xa, &(0x7f000047b000)=[{&(0x7f0000c83000)="f6f838a6bd7f8f7ca4df52b3ed3289a0c44b193f6b3c19653a0e75245257a1d3b80127c67cfda45606f4278119294cadb8b31f6ac76d1806c9b28b4dffc96ca78d13e2ffdb3de09f07afb8345746d092f16fbae37ee127826ec4f99d9a897499d6bb8977b076d8703ccc561e26713a802c03da5801e8751bdc652f8291d6f99af082f1cca37508be4932aeeabd79e997d040a4b071c18e53af9b25755b3b33f9b426bf67bc5c66f2f46208d345c6e7f35a686284e3b022ac8d41c9d5c9a8bd29e6a981181bfc12471c8f8a8512ef582da75f104188fb157f0bbdcf", 0xdb}], 0x1, 0x0, 0x0, 0x880}], 0x2, 0x4004) mmap(&(0x7f0000000000/0xf72000)=nil, 0xf72000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x1, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r7, 0x6, 0x1000000003, &(0x7f0000a14000), 0x4) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000c9c000-0x138)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0xfffffffffffffffc, 0x0, 0x0, 0x204018}) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000757000)) 2018/02/04 21:33:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000ab3000)='/selinux/policy\x00', 0x0, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f000031a000-0x4), 0x4) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x2}], 0x0, 0x0, &(0x7f0000601000)}) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000406000)='/dev/sequencer2\x00', 0x2, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r3, 0x800443d3, &(0x7f0000cec000)={{0x100000001, 0x0, 0x400, 0xed, 0x9, 0x5}, 0x800, 0x9, 0x7}) ioctl$PPPIOCGL2TPSTATS(r3, 0x80487436, &(0x7f0000e95000-0xd3)="373ce37155bab445b19c9df5b391423a2e749df6e41a20e2e2ca7b1ab2c3e504b1f1f08a8e81c4aa4230e15c6791e9e16f83afe6f6ffa925cd559e79213fea687986c9ca60d550bb95abe794e857373eb382af9c520d96b3cfe2820d92a41f08ce3fee3d41dd2501b8bb4b9634a1f8308bafb91ab90a3a7584bd3106049027ec63a3a5bbcddef8ce7d3192471593f4309dce9e9304f35b5d70813b5f92e8b406ff31dde57382cbc1f81df415d752c2f8adccd7ec1a33ebcfd77136fd881821940f8d222f3598821891e34d6a60c6acdf8b750b") r4 = syz_open_dev$vcsn(&(0x7f0000ad8000-0xa)='/dev/vcs#\x00', 0x4ae, 0x10000) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000003000-0xd)='/dev/binder#\x00', 0x0, 0x802) ioctl$DRM_IOCTL_GET_STATS(r4, 0x807c6406, &(0x7f00007b9000-0x7c)=""/124) 2018/02/04 21:33:32 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00001d3000-0xb)='/dev/mixer\x00', 0x400000, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f00004e2000-0x8)={0x0}) ioctl$DRM_IOCTL_LOCK(r0, 0x4008642a, &(0x7f00002e1000-0x6)={r1, 0x1}) perf_event_open(&(0x7f000002f000-0x78)={0x2, 0x78, 0x1f12, 0x6896f02, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f000070c000-0x8), &(0x7f0000c12000-0x4)=0x8) 2018/02/04 21:33:32 executing program 0: mmap(&(0x7f0000000000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = getpid() mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unlink(&(0x7f000000c000-0x8)='./file0\x00') mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000006000-0x56)={@random="cd3997fb0f00", @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "c8fba2", 0x18, 0x40000000003a, 0x3ff, @empty, @mcast2={0xff, 0x2, [], 0x1}, {[], @icmpv6=@mld={0x88, 0x0, 0x0, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}}}}}, 0x0) process_vm_readv(r0, &(0x7f0000008000)=[{&(0x7f0000009000-0x1000)=""/4096, 0x1000}], 0x1, &(0x7f000000b000-0x10)=[{&(0x7f0000009000-0x1000)=""/4096, 0x1111}], 0x1, 0x0) 2018/02/04 21:33:32 executing program 2: mmap(&(0x7f0000000000/0xd000)=nil, 0xd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x3, 0xff) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000003000-0x10)=@common='ip6gre0\x00', 0x10) mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$admmidi(&(0x7f000000d000)='/dev/admmidi#\x00', 0x23, 0x400000) sendto$inet(r0, &(0x7f0000005000), 0x188, 0x0, &(0x7f0000001000)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) 2018/02/04 21:33:32 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:32 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000b6f000-0x16)='/selinux/checkreqprot\x00', 0x20040, 0x0) readlinkat(r0, &(0x7f0000358000)='./file0\x00', &(0x7f00007b3000-0xd9)=""/217, 0xd9) 2018/02/04 21:33:32 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000919000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f00008fa000)={0x79}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000760000-0xa)='/dev/ptmx\x00', 0x521040, 0x0) ioctl$TIOCMBIS(r3, 0x5416, &(0x7f0000a4c000-0x4)=0x7) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000ebf000-0x400)={"b3a640564b6b3c4a552c1bf7a097e2599a7dced92edc20eef803ca02b90000000000008000c73b52bc3910e90c3cd9b08f9f0c66d5060000007f652cd85a009f834ca0277319becde7fa12824b8c67f23e2e4b329a5d70a089b19adb319c213eca82fd2a3fba9ecd740e45048c23efbaee092f30205a1c24c0f4048bf5a4b0c4f3f12787f14e6ac556aa27202eb1fc1b53629037a6891e0c4adbc0157a66b4ee4b0507870f2d43b22a433711d0098e74196c3410417332ed4b74252b0b35e0f97cc50d1ac561c8862ca2ff9021f014d5a1916da1a85f43b13b54d20968d3589c7023c5e52efce267bb4035ccfcaf06d8e1238a43214b2c010001008ef5d9adebe59d134b7ddbc75a5233f7e3bf29438b9dc6b42971b08f7c310cb7893025c377cd552e246a09ca3e3c3e2857961500010dca5c050f70ffa0cd816aaac8ffe43ade51f8b228f11040bb056a4dc09e636ea63f6e46b960355553969ee62299d391ea90484d7fc901659ab8ca00000100da888e0a9c7ae207639fb7bad86791891fc5eb426feb1d03d065598e9843f6a641e50006ebaea5e00d554ea11bd17a55903b55a5bddc1c410d8fce7fbcf931af94b07d1051c07b63fb2630ca451f8f8f6171ea68ba2503a46eb681078ca5bc212ac03d2a19aec137048ac9fdb5f6ecc86a4d327a658d6db195415b98bc9e40f31f4a2998320efbf5b33623bfb68c882f295d60c760f014bd890cc8ce48820d62440a63400f84398b0ecd366e33786cb70345999f592e25f9a6ddd1f35882a96c51179e30a7985ac3ef0800b19abc812d75fe2d1b72d4c37b0b731101b0e36c557b5036cb0f559bcb8bde2dbd5eddbb1a1615e796bab2f5ab8a816f8e3f7d05f30000000000000000f96864528345792160482c4c3d63b535c49cb0a1c715414219bfd1521881f4e8696dd38667f3431c298d8559bc046d73c70767d0eda839fdffffffffffffffbdcbbe0800000008707916aea7065c6c4800000000000000407d6ba11a881542276462bb0dfd30560615cd0ec41c4118878daeb1ea2c67f2071bccde6a20efac7afb7002713423522e3e245194876051ae20f66d3590bf1bfc3e96917108d4220209fd33f3da7e6207f60a187e38704ca0b8b0ccc690238dfb597eb33a48b972d635fab0db5b2cda45dd74127f5fa37ac27e30a671ae4ac3590e9988713dbd001375dc0b9ff68990573b196c8248ea1df61dbfd5107c872123b7ddc911076a41ecdc973908bf65417dc1c33cdcd45df4ddf43890aee999f8bb2f2aa5315cad61550246065a69c6f97b216ab7847b0a4c34a36eba20460657b6c369fccc121d3ac2c75ea64df3877bca562408d431091cb1578389c48d2512f5f808204a213264cfe890c4439ca9f32e0f69ad1006a618128dbdf1545079d797664765f972b52126dcdc50cdbba6010043"}) r4 = dup2(r0, r1) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r4, 0x800455d1, &(0x7f0000e30000-0x10)=""/31) r5 = dup3(r4, r2, 0x0) bind$inet(r5, &(0x7f000085f000-0x10)={0x2, 0x0, @broadcast=0xffffffff}, 0x10) 2018/02/04 21:33:32 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:32 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$llc(0x1a, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00008b8000-0x20)={r0, 0x1, 0x1, 0x600000, &(0x7f00009fd000)=[0x0, 0x0], 0x2}, 0xfffffe08) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f00006ad000-0x98)=""/152) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) sendfile(r0, r0, 0x0, 0x4) r2 = syz_open_dev$sg(&(0x7f000013b000-0x9)='/dev/sg#\x00', 0x8, 0x111441) syz_emit_ethernet(0x1e, &(0x7f0000179000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty, [], {@can={0xc, {{0x3, 0x81, 0x2bac}, 0x6, 0x3, 0x0, 0x0, "13d01150be12ce8d"}}}}, 0x0) vmsplice(r2, &(0x7f0000bd7000)=[{&(0x7f000092a000)="511902e8f3b16e99f0fb6a24d0ccdfc40b79", 0x12}], 0x1, 0x7) 2018/02/04 21:33:32 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000002000)='/dev/dsp#\x00', 0x0, 0x21c000) ioctl$TIOCSBRK(r0, 0x5427) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='ns/ipc\x00') syz_open_dev$mouse(&(0x7f0000001000-0x12)='/dev/input/mouse#\x00', 0x81, 0x701900) dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001000-0xa)='/dev/cuse\x00', 0x400, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000002000-0x10)={r1, 0xffffffffffffffbb, &(0x7f0000001000-0x50)={0x0, 0x0}}, 0xfffffffffffffe3d) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000cb000-0x4)=r2, 0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000821000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000863000-0x58)) [ 85.051851] binder: 11159:11164 ioctl c0306201 20008000 returned -14 [ 85.060205] ICMPv6: NA: 00:00:00:00:00:00 advertised our address fe80::aa on syz0! [ 85.069330] binder: 11159:11161 ioctl c0306201 206b0000 returned -14 2018/02/04 21:33:32 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f00007f4000)={0x0, 0x0}) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000f83000)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sg(&(0x7f0000d79000)='/dev/sg#\x00', 0xa14, 0x200000) accept4$inet(r3, &(0x7f00002dd000)={0x0, 0xffffffffffffffff, @multicast2}, &(0x7f0000a56000)=0x10, 0x80800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:32 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000baf000)=0x101, 0x4) lstat(&(0x7f0000fc1000-0x8)='./file0\x00', &(0x7f0000b77000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) r1 = getgid() rt_sigpending(&(0x7f0000b94000), 0x8) lchown(&(0x7f0000524000-0x8)='./file0\x00', r0, r1) clock_adjtime(0x0, &(0x7f0000013000-0xd0)) [ 85.098415] ICMPv6: NA: 00:00:00:00:00:00 advertised our address fe80::aa on syz0! 2018/02/04 21:33:32 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000a31000-0x24)) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00006ec000), 0x0) sendto$inet(r0, &(0x7f0000e32000), 0x0, 0x0, &(0x7f0000970000-0x10)={0x2, 0xffffffffffffffff, @empty}, 0x10) setsockopt$inet_sctp_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f00001a4000-0x4), 0x4) add_key(&(0x7f000047a000-0x8)='cifs.idmap\x00', &(0x7f0000845000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00003da000), 0x0, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000dc000)='/dev/usbmon#\x00', 0x44, 0x80000) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000b4b000)=""/19) [ 85.164088] binder_alloc: binder_alloc_mmap_handler: 11187 20000000-20002000 already mapped failed -16 [ 85.212899] binder: BINDER_SET_CONTEXT_MGR already set [ 85.219636] binder: 11187:11189 ioctl 40046207 0 returned -16 [ 85.229000] binder: 11187:11195 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 85.229855] binder_alloc: 11187: binder_alloc_buf, no vma [ 85.242509] binder: 11187:11189 transaction failed 29189/-3, size 24-8 line 2957 2018/02/04 21:33:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000939000-0xc)={@multicast2=0xe0000002, @local={0xac, 0x14, 0x0, 0xaa}}, 0xfd15) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x88) recvfrom$inet6(r0, &(0x7f0000fbf000-0x93)=""/185, 0xfffffffffffffeba, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f00008a8000)={0xa, 0x3, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f0000868000-0x1c)=@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c, &(0x7f0000fc8000)=[]}, 0x8000) sendto$inet6(r1, &(0x7f0000b0d000-0x92), 0xffed, 0x0, &(0x7f000001b000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f00001f3000-0x14)={0x0, 0x3b82, 0x9, 0x6, 0x7, 0x80000000}, &(0x7f0000cdd000-0x3)=0x14) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f000018e000-0xe)={r2, 0x20004261, 0x0, []}, &(0x7f0000404000)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000348000)={r3, 0xffffffffffff30d7}, &(0x7f0000491000-0x4)=0x8) 2018/02/04 21:33:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f00002ce000-0xc)='/dev/amidi#\x00', 0x0, 0x20000) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000ba5000)=""/210) flock(r0, 0xe) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000223000)='/selinux/mls\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00001db000)={{0x7ff, 0x3}, 0x0, 0xff, 0xf3, {0x3, 0x100000001}, 0x658b, 0xa8}) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000dc9000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x6}) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) ioctl$int_in(r1, 0x5452, &(0x7f000032b000)=0x9) 2018/02/04 21:33:33 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000e9f000-0x4), &(0x7f00004f7000-0x4)=0x4) recvfrom$unix(r0, &(0x7f0000a81000-0x12)=""/18, 0x12, 0x40, &(0x7f000023f000)=@file={0x0, './file0\x00'}, 0xa) 2018/02/04 21:33:33 executing program 3: mmap(&(0x7f0000000000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f000000c000-0x9)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000005000)={0xffff, 0x1a, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000002000)) r2 = gettid() getpriority(0x2, r2) 2018/02/04 21:33:33 executing program 0: mmap(&(0x7f0000000000/0x39d000)=nil, 0x39d000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f000032c000-0x2c)={0x5, 0x7, 0xffffffffffffffff, 0x2, 0x0, 0xffffffffffffff9c}, 0xc) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000397000-0x18)={r0, &(0x7f000032c000), &(0x7f000039d000-0xcb)=""/203}, 0x18) r1 = syz_open_dev$sg(&(0x7f000002f000-0x9)='/dev/sg#\x00', 0x1, 0x0) mmap(&(0x7f000039d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e05411, &(0x7f000039e000-0xe2)=""/226) mmap(&(0x7f000039e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000039f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000039f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = request_key(&(0x7f000039f000)='.dead\x00', &(0x7f0000196000-0x5)={0x73, 0x79, 0x7a, 0x1}, &(0x7f000039f000)='\x00', 0xfffffffffffffffb) accept4$alg(r1, 0x0, 0x0, 0x80000) keyctl$read(0xb, r2, &(0x7f0000193000-0x7f)=""/127, 0x7f) ioctl$TUNSETPERSIST(r1, 0x400454cb, &(0x7f000039e000)=0x1c000000) 2018/02/04 21:33:33 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000445000-0x8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000cf7000-0x1c)=[@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}], 0x1c) r1 = syz_open_dev$amidi(&(0x7f000069a000-0xc)='/dev/amidi#\x00', 0x6d, 0x400000) ioctl$VT_RELDISP(r1, 0x5605) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000108000-0x8)={0x0, 0x10040000}, 0x8) connect$inet6(r0, &(0x7f00008c0000)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f000081e000)={0x0, 0x400000000000002, 0x8000000000000006, [0x0]}, 0x2de) 2018/02/04 21:33:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 85.262937] binder: undelivered TRANSACTION_ERROR: 29189 [ 85.268481] binder: release 11187:11189 transaction 183 out, still active [ 85.275512] binder: undelivered TRANSACTION_COMPLETE [ 85.280653] binder: send failed reply for transaction 183, target dead 2018/02/04 21:33:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000018000)={&(0x7f000001a000)={0x10}, 0xc, &(0x7f000000e000)={&(0x7f000001e000-0x14dc)={0x20, 0x18, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0x1}, [@typed={0xc, 0x6, @ipv4=@broadcast=0xffffffff}]}, 0x20}, 0x1}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000cda000+0xd52)='/dev/autofs\x00', 0x4000, 0x0) setsockopt$packet_int(r1, 0x107, 0x13, &(0x7f00004ed000-0x4)=0x1, 0x4) 2018/02/04 21:33:33 executing program 3: mmap(&(0x7f0000000000/0x33000)=nil, 0x33000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r0, &(0x7f0000007000)={0xa, 0x1, 0x3ff, @empty, 0x3ffffffffffffffd}, 0xfffffffffffffe1c) connect$inet6(r0, &(0x7f0000027000-0x1)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x0, 0xaa}}}, 0x1c) sendmsg(r0, &(0x7f000000b000)={&(0x7f000000c000-0x1c)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x10, &(0x7f0000017000-0x60)=[{&(0x7f000001e000-0xde)="cb", 0x1}], 0x1, &(0x7f0000023000-0x378)=[]}, 0x19fff) mmap(&(0x7f0000033000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TTUNGETFILTER(r0, 0x800854db, &(0x7f0000012000)=""/76) sendto$inet6(r0, &(0x7f0000034000-0x1000)="af85b751510a0bf9a8436d667343555c6bc3f8a5c8d6b9f695690f5bc4ef2a60a8b7d463984038f405443d0e2f7dc40e8777e348ae4e9a3e42452c566d2937181461fa2864f45ee52e9c2741d8796144ce2c6012d2d1253399cdf82ec4f939baaf6b52e87255ef45b6842bf14e57e32f0daaed3776da2002627d494c498a86692deae3cb7e5abd631e01c802281fa220a4c2f54ee9ef1cd0d9756ff1ee9b999f113e1cc9acbe9750bd6ca53397074a4182b5202028c74ed4b6963f95b245a2b7722825f997bf0ab3df87c6c31a256f8da4a2540d5421547d402de2c1c4f5c96d13e864e1c0856281d0cd7c04866a036212b3807709cedce73e56ac93a0c1fa1953b01b88a372083a8279fea1c6380c3ed5f7d318a0bcb6118fcc8614e83c019e57aed5b8b48552742b8e0ba5ad5a7e92f2ddae1e0fdf7932e6e757238fc319f9aaa56d1b30a2ffc8e156259992bdc7767faf25553ffec2202aa01bb710e003c1c68f98d525401b26963ffdc0d23764edee6cdfa15460de477115dd17dc0d18ed418577f8194972b6041a4f9aaf811379c57fe499ac9fea88c2baf1b6ca079675f05611ea4cb727042348c4a78ba8502d492d7a5c53ae8cf1e17b21920c7f5d3fa82baf87baa216870084c8d16f7c4504a5eec5ed580df83aae69e2fb794bcc5213bddaa5fb3ffe980cdca920a14953d332f2a6598f63bf4e5a327105a2b796eaf6a4551461697a1f3b6898450b2c1f1a5b5cbea1101f027e61023332eca593e79aed27f234d10dc0c0af709dc47b570fe923c025090f85c5929ce0081ab01bcbfa589459c39a99b03fa3fae97bab5faceebe0e7e95329542dac7e082c83d4376fc3700775f4bf86b6398078efb653d6e85bf3460acdf37b190a69ac1b0fc970da5c2cf77e28c54e48cae230d95a11c9f6425ce2647b387b4fb3070bcc3e79927dabfa8488e0b841825eafcca2f2c4b64a25068e4bc71eac1d21c7688a1c46200999b16edb242f442760d6d70e9f0ae6be995632662daa479054ad1125bf6e673ef89ba44481570173c766c0b1a1c6c7115090cc495170fd80d7bce97bb3ae865124fbc531726b47cba0066080dedf8189f17c47edbaf3e31b57afe4a8bade49243815556601bd2e20528c64d585b32378aeffb7c14884e4eeea37035928de96bf74e0481aa6b9155920fa067731e122d7f7bd09e289f81d707ec379aaa75c5b25c0946b1f19e6c17bbd869a7bad47b196ecf50a133165c8738eaacf0cbfd03941d5a77e9e6fe5362409b4c481b2e8e8aeb53e1df565bbe3acbe3d2b2d0af9bc745d240fec9477b690b21ca037a8a5e19d70014e747512baeb940a20cab33ed11f33a268e25d8978101cfdd48bf06b2506c783d6a4d908a65575325497e02ddeff0608e7d6fd591a89354e481936e6facf2d32266e3329e33d12d2d3713b1915dc727f4587bbd1b3320d1225a400c6831938cab1001a41895f8dc9373876b2ca0444e9e7e20f2373eb57e4b6dc7d0b28a81086eae635955804be823409924ae46f56594f6bb13205a2a97c3127ee6611b5e9ea794e469b9ec880315421e090809d1d48f3107a2bfbd409f3142c7ca90200e1bab57d0f31cce19ee0a554c4ebc160695c2847241d61d36a887706b230cecb7dd8080f96bc4e6ff21a466f836fa88e37fada57af00cfeddc6cd4d5d2f5b89855351d5305e895530eca39340bd015a50d877743240bc8f46c0cf9e71e8a273d1289bd26e5d8a28289b908d44571357133cf01ff6a17416147a60baeb9aa24214be87d630f78a8cd80311a8682d964a6b9a1cb171674ac31dcef85d635e1534ad300bb1ca667eed50965ac41ea20c01cdaa7a5e53f6e68ea3654d7d6335d61536a7740159c46c3c898690a664ad44a1133b4cb6c4d37091f7b8f43e5c0695c34f02292a0ecbeb2dd6f92f7f4c664b736b1af1bfba99e674ecee0b222f1622a72096526be145d475373feabcefab5cd3a164710b72a3d521f7e03c62b17f8647060211d60dc18fc5c0a7de1afe548e043abc5e2bec8ac156f69f8818850b647903b31dd545fcc713ea146077c323e2b793cc0442739d75452e9a935e68bcd66f29a079aa8a8fc7f57af3b09a9b747dbfcd481281d1c2bfcac374e4abbcd2e1feabf41c467bb5db40fae72d30698661e71455bd501dac6095ada3068b33c6466d4b808263029d160404c0daa3905170096ed4bf318962e87fbc2ddf19cad0f2797a0a14c7efdd5c3de1c8aecb7f4025c776c425e4d6ea6cff916e082415d459367436a22fe9620642bf24ef07f0ee635deb445ba5e729fe0cfff8536f8bb597df00172af263d32fde517f61938d5bb666f6bf14735e198489f383adb18da135dddc1012d465c823210a1b20d6875fc57cad9bf9cdea2e1bba5c84ba5c005f70eca2e1504394a576495a0be1a6228d15364e93e5257704b908b31c5727425343f1d33e23d5368f6b8f3439efdfac25d3dd05eb25ecec61acfe9d02631cbda861359c4ec80cec95a8bfeb68dbdde2b65bc47e5899963687b3b906c7358a60c510e63a662aeeaea70291825136474834219745c2f5b4a3be2d5cc5d35e4c8c32c4413109a62d8e138a101b4cba2370de2805b56a2a0b6864f471b841829a6522833a86fd9b55db60774503a3177051ab1ec5d191e7149634262410b88152660523118ef7f5250b66174fa359bd721198b665897a757de94961d2439efcc4c86371ed0e6bc06e37ca550e108429115fd143481928c6d6a8d65a1bd9fe597ddd1d23157ed6c50798d65cf2b38c0406c24cd3dc0793a10bdc7b1a6338662d11bd443535cca1ffc76b4b7af1479dd947d39e26e555444a96780cb1626f719ba15e336cd9df17c233ae7b266da67b1c61714cad9cf1fb79b597adec9e5e738060e847305f779b2dde93fe9b9dce673ff8ad427ca3b33fa89e8b24ec302b15af9f041fa44a38bf6d7f446bb3a750766efac10af1928a448b78ef4ede4d84fff877f652ddd3fad1b1a6c044a4ef58e572ec20c709988f434db8023bf625e90a2e4a379819694554f5e9b1ac382be4eb5b11a3d70e92e54d287f88f3e6d37c827387430411306f9d42655b4587429af2697c05ed2be7b1334f9759a3c9e77d18a83fe5b808b77ebb58af39ae18193fc806496c407a0e59da7cad3097e25bea07fb90bb5a2bd4f3318604de0b596ce399f9ba6d74aa2cf5e1145de0efd56d74f44f66e9097c03f66719af5e9c2dbc7d8f48230024af1974d8e4ad61ca3583f260d81cc1e2384f7e423e0e5b0ef747aa401aa2edfe7d7ff35dc1a5e34c064eb9268f824bf13350e2d614df2ef7b320691bf55bc4d7fcaa365eac59e1f06a51a9b3922ba3223f8ee05350770e980dc9b560dcda2e52165b2b9368e82d73feabb78d70d2b130ae44feba31fc5f04cc78762051777f592f5f2c3b0998a8de09fdfe4237e8446719409b8c7bb6921204022037a6e4656b0ac69b9aa9aac950b640841d8ccf9e8928b1e44c882af7d0e9cd8a9489f9eb037dda4966d0efe360d229d2c11a6d4f8f5108064e00881348e685b5a8790d2872bfb44f69af6f4e3fdd9c0adf5ec21ede61b897b64f4b2736fee6f19e05ae382c52962cbd3ec185b8b706bbd70d254024392ef03adf7d83bdbce910f6679a6995be40e31f4d1b8975712fadd752d7e623334920f2242cf15d3e4deb926d622072d788942d6c8debe059229205bc548e30b1dbc1f9915ad5085e10cdc515047850be31895a08e725fb376b3d36c0c5215fb28ef75872fbe6c811cd12f6851e142ed46183a758bd214c35f78d25bf569623a4681f99bb4d045b8659736d3df8f236f9a38426046b047160890218ae9d36423e04984c4069ef6e3f0e25f709ac96a721b7f432058b65eef5d2d7b9dec191046dc32e3e4f819c1c8bb7152ed3be445e2136552ecd887cf91b6308282fbc113aa32f5291ce0ab4d582788f745c64b04ac613ebe64da8eff11d7bff99ddea6641e3d152846d78709ed2f7cfc1217966ba3292086de710156618a7f00b8723f59469b17169232c27e2e154c9a792bf4b914f292a3450051cc6cbb2423bf9566c9d75cdf0aedccb29199cd7b2da28bd783e4a26b4a6a6f2250b8c5071a5e2d6e6b19f3c73c86863f51c42e2ab57d8aec39fdea5ebb8fd5648ed17cbf3a279d110487eb737988787b4d46d9f138380832e93cedac6ccf39c3e6ead2f0d0699e01b32c4daf6d59e1303113a15e9dff3ddef4d9e6a9800346eddee1af69c96c9bbdd44ec2071262f659032676cf228305e1ac16499fe37d6f760a61a8afa4d1617255e9ebdc2d0e5609a80fc3c9aae0d95271c013ec9fc3b985b6a1607951b43faedd8fbaa5f74104579d9bea70f8893c8eee41b2d37227451d842c8a4b9ea2f7008b8c339e009f5fa58fcebcd4f6919b095b449b81a21d9716c047fec342769b19ead4ae6df7a80783b1aadbc5047e93282be33a18a2f6f6283e12058afbf0069e1b16c3b6093242aafe1f49c47d8404c6ca4f1835cc1e3f2d9674bf0b9fd2fbfd2f7e8fe9810e4efb3863b035d60049943e7d113e4a42672680df7ffa4cfd70fb4df6e8fd45827c9a59c7f7bf5220a1130da634e34ffbcc30e3b7d784caaa4153ca2db95c30bfb1b37eebb2ced22b5deeab2a570c8cae350b1c52af591b17fc782be2a8433b985db53e7008df73746094e1f0123e4c73bead1fa09fe55494b44d86620998a0a662b069a793cfe9fc8d9a20f90f0dd65ff76346fab9560ee4925cd5ba74a6b86a4116d64faded28ca873cf29ef1868ae9172f47460f3f67f262bea39e49c4ae82c8e47ee7d0e60908c19fb64c035cd2d23706a5896ac562d325073668f8626f7a7df0156d9ef19d0386623144475a947a43990c888e4a8cffc35e0d55563ed7fed0ad5bbbb14974cbd7b5121211333e91501b57e387d3e57b77137b9b5c2c2c16f4f8b04e5a9d9cd8c4f4dfe0522357b4a4cd431edf021d8f9f0c2d016d6169c62b2e0511d28cf255868b41a47c74dc16143084eb9aecf66f3c5266969dd094f5297251f643d781235ad5b5099f1502756c34a01160d949118613b12f9f8f882db3ffc0c10f3dd48273b9176d1b89abf784319209116d2c85ba51e8e2f01160ccb8fa99bdb9ebe914c64e731f5a682427e05b787eef42be9a4cdd26de6b2e94d0e2cf2f0b0faa203144e47eb77ae98868187f95ef5122aa48a79f1f70f20aadd739c492800a534eaf621358f93c6a89b488022cafa92d94941411ee64d247e9e41fc367c96d74ec27f92ea2a8e7084c6f1590f54a7ef3c00fd5b289b08018eb461501b633b88c52889392f6b5b40f13123f331ab5c9469da366e01ba3a66b65aa5fa2dc8ce34c962246595b3547298fa8f3b192b42d726ffe52a609d18e0d732b014c94451170fd30037adf87d4d812fc1baa51c1e090d4f21e98cc9df6d4977f0fb5fc97c0c309fa2493b9e602df7b546ea7b79845c9d825e63dd6d0b94c395daaf32d54d7e3887a64558c3fff8ccfa5c7d55d3906c503d59ce2211b62860071dd2ecb715e62c71f3f2ecd491cb792537e026fcee0644ee47ecb4688502b8feb18721739af4b1f27d2d8981e7ec86aa54a70bf5be60947e0fc47ddddafe4d4cacb6e41da8cd1f81bd106a0dffb5d30f10367096708c5774ed6acbcfc7d859b05539488d630880c81af9c0e8d1d52eb124cba9b20f91b6f778fda0bef18138991125490a9b7664a2405a82452fe3ad5a9436c2b6ad7603c698053bea1641f2850564f6d540d923e37a364c81b04c", 0x1000, 0x4000000, &(0x7f000002d000-0x1c)={0xa, 0x3, 0x2, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x93c}, 0x1c) 2018/02/04 21:33:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x80000) fcntl$setlease(r0, 0x400, 0x1) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:33 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msync(&(0x7f000090e000/0x3000)=nil, 0x3000, 0x0) set_mempolicy(0x4003, &(0x7f00003cd000-0x8)=0x10003, 0x7742) mbind(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1, &(0x7f00004ff000-0x8), 0x5, 0x80000000000) mbind(&(0x7f000000a000/0x3000)=nil, 0x3000, 0x0, &(0x7f00002e0000-0x8), 0x1, 0x2) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f000039c000-0x8)={0x0, 0x0}) r1 = pkey_alloc(0x0, 0x3) pkey_mprotect(&(0x7f0000da1000/0x3000)=nil, 0x3000, 0x1000000, r1) ptrace$getenv(0x4201, r0, 0x7, &(0x7f00002d4000-0x4)) 2018/02/04 21:33:33 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mounts\x00') signalfd(0xffffffffffffffff, &(0x7f0000001000-0x8), 0x8) timerfd_create(0x0, 0x0) epoll_create1(0x80000) pselect6(0x40, &(0x7f00000ac000-0x40)={0x3ffffd}, &(0x7f0000768000), &(0x7f00007fc000-0x40), &(0x7f0000349000)={0x0, 0x989680}, &(0x7f0000f14000)={&(0x7f00001da000), 0x8}) socketpair$inet(0x2, 0x8000e, 0x80, &(0x7f00006b8000-0x8)) 2018/02/04 21:33:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 85.310383] binder_alloc: 11214: binder_alloc_buf, no vma [ 85.316248] binder: 11214:11221 transaction failed 29189/-3, size 24-8 line 2957 [ 85.339622] binder_alloc: binder_alloc_mmap_handler: 11214 20000000-20002000 already mapped failed -16 2018/02/04 21:33:33 executing program 5: syz_open_dev$loop(&(0x7f000029f000-0xb)='/dev/loop#\x00', 0x0, 0x482000) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) [ 85.381157] binder: BINDER_SET_CONTEXT_MGR already set [ 85.394376] binder: 11214:11228 ioctl 40046207 0 returned -16 [ 85.404848] binder_alloc: 11214: binder_alloc_buf, no vma [ 85.410489] binder: 11214:11240 transaction failed 29189/-3, size 24-8 line 2957 2018/02/04 21:33:33 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000) modify_ldt$write2(0x11, &(0x7f00008c9000-0x10)={0x1, 0x1000, 0x0, 0xdeee, 0x81, 0x6, 0x0, 0xfffffffffffffffb, 0x4, 0x9}, 0x10) r2 = dup2(r0, r1) setsockopt$netlink_NETLINK_RX_RING(r2, 0x10e, 0x6, &(0x7f000057b000)={0x8, 0x5, 0x7fffffff}, 0x10) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000b31000)={0xffffffffffffffff, {{0xa, 0x0, 0x9, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x4}}}, 0x88) name_to_handle_at(r2, &(0x7f00009c2000)='./file0\x00', &(0x7f0000398000)={0x8}, &(0x7f0000565000), 0x1400) setsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f0000158000)=0x7, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40042406, &(0x7f000083c000-0x9)='-%vmnet1\x00') 2018/02/04 21:33:33 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rt_sigprocmask(0x0, &(0x7f000003a000-0x8)={0xfffffffffffffffa}, 0x0, 0x8) r0 = gettid() timer_create(0x7, &(0x7f0000044000)={0x0, 0xa, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000004a000)={{0x0, 0x1}, {0x0, 0xe4c}}, &(0x7f0000040000)) clock_gettime(0x0, &(0x7f0000be8000-0x8)={0x0, 0x0}) rt_sigtimedwait(&(0x7f0000e99000)={0xffffffffffffffff}, &(0x7f0000ac4000-0x10), &(0x7f0000685000)={r1, r2+10000000}, 0xffffffffffffffcd) 2018/02/04 21:33:33 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x11, 0x38, &(0x7f0000006000-0x341)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000012000), {{{[], 0x0, 0xa8, 0x2fc}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@ipv6={@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @empty, [], [], @generic="28447731605bfefb40ca55d89ccefcf6", @generic="b09f4c0f65a437e1937917274a593f7a"}, 0x0, 0xa8, 0xd0, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, []}, @REJECT={0xffffff44, 'REJECT\x00'}}]}}, 0x1) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000efa000)='/dev/cuse\x00', 0x2000c0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001000-0x20)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000e3a000/0x2000)=nil}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000001000-0x4), 0x4) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000000), &(0x7f0000001000)=0x4) bind$bt_sco(r1, &(0x7f0000000000)={0x1f, {0x7fffffff, 0x5ce, 0x0, 0x4, 0x1000, 0x7}}, 0x8) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(r1, &(0x7f0000002000-0x1c)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x60458}, 0xc, &(0x7f0000001000)={&(0x7f0000000000)={0x1a8, 0xc, 0xf, 0x400, 0x2, 0x0, {0x0, 0x0, 0x7}, [@typed={0xc, 0x54, @str='&]/'}, @generic="e35e41cf6aad82ef57cab3588dfc388358822fc95b9b08e4df14b99ec57cda213fa3d154823f002b3e4fc9ce8a86b7f90074a34ca3ab7132e4b0f91c1f30d20d08a12922f8a36f8f8df28dfb818400088e25186dc50e71599681527d70c85367204baf96060c8c0539a3274f0493f0e563fac52d0f223709d9379ebbc31f58a16f777efe294b7e40b12a31500ef5491a8d0ecd6513c43f943fe0ad71948c4fadce07466e1ae4", @generic="75a0f631c1f46352f05fbbb150f856ce8fd1d353e5bb4baf0507ac9be3635e9d3d1b53ba3d44aab63c630f1c390f3ac262ff1527d601d858779dda45365e10625ac1313251802a38cb8dd7bc8f2507495964b30aecc28b71958a6732d2e6c936fe519711bbf77cb74d6c41843ebd9325c76124e5e57126ed2352f6a2b44c5d1d28a21ca64544f51bff8ca329b1f025f7e701d860417e30f6a03295cedb4582572dba959383d213678ae65806a6fd03c650a83a71854a980dca0f2fafb89476bd8d56925794acce9d6ccd60e3cff9c06bcca5e9df7359351e545d7f6c1d14b75699"]}, 0x1a8}, 0x1, 0x0, 0x0, 0x8080}, 0x0) 2018/02/04 21:33:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x13, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80, [], 0x0}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) syz_open_dev$sndtimer(&(0x7f0000551000-0xf)='/dev/snd/timer\x00', 0x0, 0x200102) 2018/02/04 21:33:33 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000399000)={0x5, 0x78, 0xae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000001000-0x4), &(0x7f0000000000), &(0x7f0000001000-0x4)) 2018/02/04 21:33:33 executing program 4: mmap(&(0x7f0000000000/0x16000)=nil, 0x16000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000006000-0xe)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r0, &(0x7f0000000000)={0xf97cff8c, 0x8, 'SE Linux', "f2bc755a195554bc845c9bf8550628f9"}, 0x20) fstat(0xffffffffffffffff, &(0x7f0000017000-0x44)) mmap(&(0x7f0000016000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ustat(0x2, &(0x7f0000017000-0x14)) openat$audio(0xffffffffffffff9c, &(0x7f0000015000-0xb)='/dev/audio\x00', 0x0, 0x0) 2018/02/04 21:33:33 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000fcf000)='/dev/binder#\x00', 0x0, 0xfffffffffffffffd) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 85.449401] binder: undelivered TRANSACTION_ERROR: 29189 [ 85.455006] binder: undelivered TRANSACTION_ERROR: 29189 [ 85.487259] SELinux: policydb version 1517665522 does not match my version range 15-31 2018/02/04 21:33:33 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000480000)='/dev/snd/controlC#\x00', 0x0, 0x42a180) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000339000-0x8)={0x0, 0x0}) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f000082e000)=r0, 0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0485510, &(0x7f00009e3000)={0x8, 0x0, 0x0, 0x0, &(0x7f0000f93000)=[]}) r2 = syz_open_dev$mice(&(0x7f0000ec0000)='/dev/input/mice\x00', 0x0, 0x80080) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000c5c000)={{&(0x7f0000555000/0x10000)=nil, 0x10000}, 0x3}) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000104000), &(0x7f0000c93000)=0x4) 2018/02/04 21:33:33 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00001ad000)='/dev/hwrng\x00', 0x54080, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000c78000)={0x80000001, 0x2, {0x3, 0x0, 0x81, 0x2, 0x5}}) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000a05000-0x4), 0x4) clone(0x0, &(0x7f0000136000), &(0x7f0000370000), &(0x7f0000bb4000-0x4), &(0x7f00006c9000-0x43)) madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) 2018/02/04 21:33:33 executing program 5: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000001000-0xc)={0x0, 0xbd3, 0x2, [0x8, 0x224]}, &(0x7f00001de000)=0xc) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000001000-0x10)={r1, 0x81, 0x100, 0xfffffffffffffffc}, &(0x7f0000ff3000-0x4)=0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f0000aae000)) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0xe, 0x21, 0x0, @ipv4={[], [0xff, 0xff], @empty}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x148, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r2 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0xffffffffffffffff) ioctl$KVM_HAS_DEVICE_ATTR(r2, 0x4018aee3, &(0x7f0000f2a000)={0x0, 0x10c48f61, 0x8001, &(0x7f0000318000)}) ioctl$EVIOCSABS2F(r2, 0x401845ef, &(0x7f000083a000)={0x9, 0x3, 0xfffffffffffffffa, 0xd41, 0x8da, 0x8}) 2018/02/04 21:33:33 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000ae1000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f000045e000-0xa8)={{0x80}, "706f7274310000004000000000000000000000d600fffffff0000000000000000000eda4000000000000000700", 0xbfffffffffffffff, 0x2}) fcntl$setpipe(r0, 0x407, 0xffff) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000ac9000)='/dev/sequencer2\x00', 0x2, 0x0) close(r0) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f000089c000-0x4)) 2018/02/04 21:33:33 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mouse(&(0x7f00000b8000-0x12)='/dev/input/mouse#\x00', 0x40a87751, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f000070a000-0x10)={&(0x7f0000324000-0x8)='./file0\x00'}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) splice(r0, &(0x7f0000276000-0x8), r1, &(0x7f00006ef000), 0x24, 0x0) r2 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r3}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 85.516095] SELinux: failed to load policy [ 85.531206] SELinux: policydb version 1517665522 does not match my version range 15-31 [ 85.544567] SELinux: failed to load policy 2018/02/04 21:33:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000001000-0x11)='/selinux/enforce\x00', 0x400, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000001000-0x4), 0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000f92000)={0x1, 0x3, &(0x7f0000002000)=@framed={{0xffffffb7, 0x0, 0x0, 0x0, 0x0, 0x7}, [], {0x95}}, &(0x7f0000004000-0xa)='syzkaller\x00', 0x1, 0xc3, &(0x7f000049a000)=""/195}, 0x48) unshare(0x40600) bpf$OBJ_PIN_PROG(0x6, &(0x7f000000e000)={&(0x7f000000f000-0x8)='./file0\x00', r1}, 0xc) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000262000-0x14)={0x0, r0, 0x7, 0x1}, 0xffffffffffffffd6) [ 85.563225] dccp_invalid_packet: P.Data Offset(72) too large 2018/02/04 21:33:33 executing program 2: mmap(&(0x7f0000000000/0x39b000)=nil, 0x39b000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) pipe2(&(0x7f000030b000)={0x0, 0x0}, 0x800) mmap(&(0x7f000039b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$llc_int(r1, 0x10c, 0x6, &(0x7f000039b000), &(0x7f00002fa000-0x4)=0x4) bind$inet(r0, &(0x7f000000f000-0x10)={0x2, 0x1, @empty}, 0x10) listen(r0, 0x0) r2 = socket$inet(0x2, 0x80001, 0x0) connect$inet(r2, &(0x7f00001cc000-0x10)={0x2, 0x1, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x10) r3 = dup3(r2, r0, 0x0) mmap(&(0x7f000039b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f000039b000), &(0x7f000012c000-0x4)=0x4) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00001a7000-0x22)={{0xa, 0x1, 0xffffffff, @ipv4={[], [0xff, 0xff], @empty}, 0x4}, {0xa, 0x2, 0x7ff, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x9}, 0x800, [0x21b6, 0x5, 0x11d6, 0x4, 0x100000000, 0x9, 0x9, 0x7]}, 0x5c) 2018/02/04 21:33:33 executing program 7: mmap(&(0x7f0000000000/0x27000)=nil, 0x27000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f000000d000)={0xa, 0x0, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f000000d000-0x1c)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = socket$inet(0x2, 0x80000, 0xb777) mmap(&(0x7f0000027000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000027000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000027000)={0x0, 0x8, 0x9}, &(0x7f0000027000)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000015000)={r2, 0x9, "88b08fdf22617ffb15"}, &(0x7f0000015000-0x4)=0x11) mmap(&(0x7f0000028000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000028000)={{{@in6=@empty, @in=@loopback, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@dev}}, &(0x7f000001c000-0x4)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000021000)={{{@in6=@dev={0xfe, 0x80, [], 0x0, 0x11}, @in6=@remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x1, 0x4e, 0x0, 0xc2, 0xa, 0x20, 0x80, 0x0, 0x0, r3}, {0x793, 0x1ff, 0x46, 0x9, 0x100, 0x4, 0x1, 0x4356}, {0xf31a, 0xffffffc000000000, 0x100, 0x9}, 0xfff, 0x9, 0x3, 0x1, 0x1, 0x3}, {{@in=@rand_addr=0x3, 0x1, 0x32}, 0x0, @in=@multicast1=0xe0000001, 0x7, 0x3, 0x3, 0x8, 0x1000, 0x1, 0x7ff}}, 0xe8) sendmsg(r0, &(0x7f0000022000-0x38)={0x0, 0x0, &(0x7f0000001000-0x10)=[{&(0x7f0000013000)="8093958bca19ef5f839c2d988e80163d294835b196955ffacc24b7c09680a604f087ba79f9a5018cf9c341c7ef58e4a80210456641960cf37a14533fa28f808f47a654d6", 0x44}], 0x1, &(0x7f0000005000)=[]}, 0xc100) sendmsg(r0, &(0x7f0000013000)={0x0, 0x0, &(0x7f0000003000-0x10)=[{&(0x7f000000c000)="bc", 0x1}], 0x1, &(0x7f000000c000-0x1180)=[]}, 0x0) recvmsg(r0, &(0x7f0000019000-0x38)={&(0x7f000000a000-0x2e)=@pppol2tpv3={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @local}}}, 0x2e, &(0x7f0000026000)=[{&(0x7f0000026000)=""/78, 0x4e}], 0x1, &(0x7f0000022000)=""/12, 0xc}, 0x0) mmap(&(0x7f0000029000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000026000)={@local, @local, @remote}, &(0x7f0000029000)=0xc) [ 85.613697] dccp_invalid_packet: P.Data Offset(72) too large 2018/02/04 21:33:33 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = dup(0xffffffffffffff9c) getpeername$ax25(r0, &(0x7f0000a33000-0x10), &(0x7f000059a000-0x4)=0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000ba5000)="440d0503130000031d078900ec", 0xd) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f000008b000-0xc)={@remote, @multicast2}, &(0x7f000039a000-0x4)=0xc) 2018/02/04 21:33:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x0, 0x0, &(0x7f0000a4e000)=[], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) execve(&(0x7f00005fc000-0x8)='./file0\x00', &(0x7f0000245000-0x4)=[&(0x7f000056b000)='\x00'], &(0x7f0000614000)=[&(0x7f0000465000)="25776c616e307070703075736572942f236d696d655f74797065656d3000", &(0x7f000001f000)="6264657689776c616e3100"]) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) [ 85.659979] binder_alloc: binder_alloc_mmap_handler: 11286 20000000-20002000 already mapped failed -16 [ 85.672369] binder: BINDER_SET_CONTEXT_MGR already set [ 85.680574] binder: 11286:11295 ioctl 40046207 0 returned -16 [ 85.686708] binder_alloc: 11286: binder_alloc_buf, no vma [ 85.690068] TCP: request_sock_TCP: Possible SYN flooding on port 20009. Sending cookies. Check SNMP counters. [ 85.692436] binder: 11286:11304 transaction failed 29189/-3, size 24-8 line 2957 [ 85.719399] binder: 11286:11295 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 85.737780] TCP: request_sock_TCP: Possible SYN flooding on port 20009. Sending cookies. Check SNMP counters. [ 85.761589] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:33 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000001000-0x8)={0x0, 0x0}, 0x4000) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair(0x1b, 0xa, 0x100000000, &(0x7f00005cf000-0x8)={0x0, 0x0}) perf_event_open(&(0x7f0000d0c000-0x78)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0, r1, 0x0) setitimer(0x2, &(0x7f0000b18000)={{}, {0x77359400}}, &(0x7f00004f0000-0x10)) getitimer(0x1, &(0x7f000086b000-0x10)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000fa000)) 2018/02/04 21:33:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x0, 0x0, &(0x7f0000a4e000)=[], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000001000-0x12)='/dev/snd/pcmC#D#c\x00', 0x7f, 0x8000) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000001000-0xa4)={0x0, 0x9c, "738b762b1c0e32b6eb716fc04f9fe3fb3810349b3070976c59aac1a1002bdd4ff96750b5e19586a7c2993a7a020e83a26d3492daf771effbaefe971526514e37b5290cf8eb17187da2856ee3338754754331a82f65b704fc513cf62fc123fb0149c277260c023474da1e7dcbea55302b4c58f8c14fd7464c0f26a62136f4daffcd551b202e7b31231032f72a17a3aea449167c013e0c9352b10a25af"}, &(0x7f0000001000)=0xa4) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000000)={r1, 0x39}, &(0x7f0000002000-0x4)=0x8) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001000-0x9)='/dev/dsp\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000001000-0x68)={0x81, 0x0, [0x5, 0x1953, 0x0, 0x4]}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000f53000)='/dev/dsp\x00', 0x101000, 0x0) r3 = syz_open_procfs(0x0, &(0x7f000059c000-0xc)='net/igmp\x00') r4 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(r4, 0x5429, &(0x7f0000626000-0x4)) preadv(r3, &(0x7f000061c000)=[{&(0x7f00003d7000)=""/23, 0x17}], 0xd7, 0x0) 2018/02/04 21:33:33 executing program 2: mkdir(&(0x7f00000e1000)='./file0\x00', 0x0) r0 = open(&(0x7f0000851000)='./file0\x00', 0x0, 0x0) rmdir(&(0x7f00002e6000-0x8)='./file0\x00') r1 = syz_open_dev$amidi(&(0x7f0000cab000)='/dev/amidi#\x00', 0xfffffffffffffffa, 0x4000) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x2) lseek(r0, 0x0, 0x3) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat(r1, &(0x7f0000000000)='./file0\x00', 0x40c000, 0x10) 2018/02/04 21:33:33 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000f9b000-0x8)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f00009bc000-0x3)='/dev/input/event#\x00', 0x20, 0x80a02) clock_gettime(0x0, &(0x7f0000c65000)) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f00001cb000)={0x0, 0x2}, &(0x7f0000df0000-0x4)=0x8) getrusage(0xffffffffffffffff, &(0x7f0000497000-0x48)) mkdirat(r0, &(0x7f0000f8a000-0x8)='./file0\x00', 0x1) r2 = gettid() ptrace$setregs(0xf, r2, 0x7, &(0x7f0000fdf000)="4cd06e24805234749739cb6c15e999d1ce994a942521714464f53f727ce68c3e6f49e93199160809d511fe3a26d496bf941562795cd654f02613a65d25b2c54d55c23c26f1f2a158829b88bc4028eb29151f8871858305bd5d9335ddba209c6a94a8902c51a19bf0be2c4ff7116020afd1ebfd5f2201b167c8205ed549bdc9198ae0349049") wait4(0xffffffffffffffff, &(0x7f000032a000-0x4), 0x60000000, &(0x7f000074d000-0x48)={{}, {0x0, 0x0}}) write$evdev(r0, &(0x7f0000f47000-0x10)=[{{0x0, r3}, 0x1, 0x400000000052, 0x2}], 0x10) sendfile64(r1, r1, &(0x7f0000b97000), 0x0) sendfile(r1, r0, 0x0, 0x72439a6a) 2018/02/04 21:33:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = syz_open_dev$vcsn(&(0x7f0000b0a000-0xa)='/dev/vcs#\x00', 0x3, 0x48140) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f000041c000)={0x0, 0x62, "4cc012d4732251c8a0448c3cd358a7bb901a61fe66390c56c485994527f55d13a9007e2abdf09a289c36fe5a4a920c20b2b0d426c12c923df14f49aa0313f5ebf8b873273f9ca25b221bc7eeee36fcfe1fbad8f66e73a6e87aa4d6f3fa0310c9dd02"}, &(0x7f0000dab000-0x4)=0x6a) socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000edb000)={r1, @in={{0x2, 0x0, @empty}}, 0x8, 0x0, 0x2, 0x0, 0x90}, &(0x7f0000f05000-0x4)=0xa0) 2018/02/04 21:33:33 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) writev(r0, &(0x7f0000a27000)=[{&(0x7f0000ea4000)="7b65bde5d2be1e1e043ee2d8777d12533d0491d1da29c8537fc93870a8e7e51e35945dd636a54982764fa12e4b1f4eb3939534cc6e36b8e2f1de67e5e31862bf489a4f9f1817a6bb2d0d785197f7b3485f13f3f711e59fbdbe8fbf5042eb7a573e29eda2ebceb016364b776dd5bd545f41f7de28ac3b2e082511467f85e4c59d1cf7d4ea780fc0cb5a89cbb1482d3a2e439e7a3832661ad6a4eaedee3649431ca32f736b573363df8a2706e929c0426e1a5ed30555f0e28f1f12f63759a928135b6309835e96ed9f147e8e2e11a49497afdbb891c3c7ee1ff399877f30608ee67c5f9f115fcfeee8702bc520277424d3d8fd99cd", 0xf4}, {&(0x7f000082b000-0xa2)="721147b8c0300f7b42f73390d263c8d831ea9c198bd79d25071477ff8cc9599388fc14de7c0e3a3fa1a7368ca807c022fdfacab7be7ada4ed263fc693b98a4e0e7d1dc8dde0803ba93c612b1e1b983a3eafc5bfaba6a25b8f667278b324b928b057eae4e200fd4dc6fa01526477d22d64f730cbba2b22736ca9ef8db4042886521b909f0ec4120497b35063475b0d63d75096edf0e9674955469df4cd2379cb51f9a", 0xa2}, {&(0x7f0000d91000-0x9c)="0f0578d271d421a94faa6f7ed08d7d2ab3d9894750edf41de26a6887e46c09cbee9cc6970167c9cf789dfd330de7907e0a5fe4b360f452bf7ad921307e92f5cd4a3735191ed35f2ece8f1d182d2f861d04467dba8a136352bc60d2d153545432415ca595475c83555db208ade516e2270d15ff9f6b3c9f2726e6279fc85942d206e4e666755a958b743f3a63da90f4528735164f245c9dd95c8f8697", 0x9c}, {&(0x7f000098e000-0xe)="3042fd293bd3a591fe687d517cbb", 0xe}, {&(0x7f0000512000-0xb9)="31b3f46e5391a0aee68a75db3ae5aa514fd16eddf62c61734dd96e407b3eee9bfdeb0ec01cf3a0c1e7bc94a0d59e25c2b9d7064f05293fa0d5b67e47a43dec57a2b5a45aec8642cedf0ee5f481f7f38e64a92e7032aa7470f6b28f06175d722f92b069a0ed5bf828cca61856c558f8672440954f3f26dc44ad00a9164801c5098dda16f822e2f8ab048853f4d8f4732c4edc8b2c224e6badd59348826a9b33f478491cbcc6665c4ad2b6906f9eb01e699d8b59a58a9313c26e", 0xb9}], 0x5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x37c, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000), {{{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@ip={@dev={0xac, 0x14}, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0x0, 0x0, @common='bcsh0\x00', @common='dummy0\x00'}, 0x0, 0x70, 0xa0, 0x0, {}, []}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1}}, {{@uncond, 0x0, 0x150, 0x178, 0x0, {}, [@common=@ttl={0x24, 'ttl\x00'}, @common=@unspec=@conntrack2={0xbc, 'conntrack\x00', 0x2, {{@ipv4=@multicast1=0xe0000001, [], @ipv6=@dev={0xfe, 0x80}, [], @ipv4=@loopback=0x7f000001, [], @ipv4=@broadcast=0xffffffff}}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2}}, {{@ip={@rand_addr, @broadcast=0xffffffff, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @generic="05df19db18153787adb78e5959c5635b"}, 0x0, 0x70, 0xd0, 0x0, {}, []}, @common=@unspec=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv4=@rand_addr}}}]}}, 0x3d8) r1 = syz_open_dev$amidi(&(0x7f000042e000)='/dev/amidi#\x00', 0x3, 0x28000) setsockopt$RDS_FREE_MR(r1, 0x114, 0x3, &(0x7f0000ec8000-0x10)={{0x10001, 0x5}, 0x2}, 0x10) [ 85.770669] binder: release 11286:11295 transaction 191 out, still active [ 85.777655] binder: undelivered TRANSACTION_COMPLETE [ 85.782842] binder: send failed reply for transaction 191, target dead [ 85.815841] xt_HMARK: hash modulus can't be zero 2018/02/04 21:33:33 executing program 5: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000416000)='/dev/cuse\x00', 0x0, 0x0) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000ee6000-0x9e)=""/158) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x20, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f000057c000-0x28)={@generic="2d0f29f96026bbd9b787e0ce4f0ce5b1", 0x0}) sendto$packet(r0, &(0x7f0000bbc000)="685038557a55e92eb777ee9e5a87fb484a288db0b9d9e59198d48aab33cbd37aadb53f249cd3adfa1dd751a79accc2987c0b88c96c469cfb25c481ea6d8ac0b700689ec71e581938ecd59e9ec99005d60d26390565f564f7a5e92914b572c8808e8db50e6ca2071f269f3a1a263ae09d9fb65e5fdecb679b5bafdb02a6d336428df6123d7c82097f9c0598877c68a0d1d768484c2fc61d1669f7d858a145d4e6a8084e19f2ac0f58f0871f33acd4bbd09d27739756963df0018481ef4883eb6069c184c3753ae4f8d9398083cf377536a2f804f390e21f821570d083ac6a852d960633e8fd16f5f3e965fb793c87b283019d2d78fbc421cce6", 0xf9, 0x810, &(0x7f0000a80000)={0x11, 0xf7, r1, 0x1, 0x5, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xbb}}, 0x14) r2 = syz_open_dev$dmmidi(&(0x7f0000af4000-0xd)='/dev/dmmidi#\x00', 0x5, 0x2000) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000354000-0x6)={0x0, 0x97}, &(0x7f00007d2000-0x4)=0x6) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00002ce000-0x98)={r3, @in={{0x2, 0x2, @dev={0xac, 0x14, 0x0, 0x11}}}, 0x0, 0x9f35}, &(0x7f0000e88000)=0x98) ioctl$KVM_GET_PIT(r0, 0xc048ae65, &(0x7f000024c000-0x70)) getsockname$netlink(r2, &(0x7f00009e7000), &(0x7f00007ef000)=0xc) 2018/02/04 21:33:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x0, 0x0, &(0x7f0000a4e000)=[], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 2: mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$random(&(0x7f0000003000-0xc)='/dev/random\x00', 0x0, 0x40001) writev(r0, &(0x7f0000001000)=[{&(0x7f0000009000+0xd8f)='}', 0x1}], 0x1) r1 = syz_open_dev$random(&(0x7f0000000000)='/dev/random\x00', 0x0, 0x480400) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000005000-0x1)=0xe33) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000005000)='/dev/qat_adf_ctl\x00', 0x40000, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$PIO_CMAP(r2, 0x4b71, &(0x7f0000006000-0x30)={0x8, 0x2, 0x7, 0x7, 0x4, 0x54a0000000000000}) [ 85.847291] xt_HMARK: hash modulus can't be zero 2018/02/04 21:33:33 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000349000-0xf)='/selinux/policy\x00', 0x0, 0x0) pread64(r0, &(0x7f0000480000-0x49)=""/73, 0x49, 0x0) setrlimit(0xf, &(0x7f0000a95000)={0xffffff7ffffffffd, 0xfffffffeffffffff}) fcntl$setlease(r0, 0x400, 0x3) 2018/02/04 21:33:33 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = fcntl$getown(0xffffffffffffffff, 0x9) r1 = syz_open_procfs(r0, &(0x7f0000ba8000)='clear_refs\x00') exit(0x0) writev(r1, &(0x7f0000b97000)=[{&(0x7f0000962000)='5', 0x1}], 0x1) syz_open_dev$sndpcmp(&(0x7f0000e6d000-0xc)='/dev/snd/pcmC#D#p\x00', 0x6, 0x0) [ 85.871368] binder_alloc: binder_alloc_mmap_handler: 11326 20000000-20002000 already mapped failed -16 [ 85.883373] binder: BINDER_SET_CONTEXT_MGR already set [ 85.889213] binder: 11326:11333 ioctl 40046207 0 returned -16 [ 85.897108] binder_alloc: 11326: binder_alloc_buf, no vma [ 85.902734] binder: 11326:11341 transaction failed 29189/-3, size 24-8 line 2957 [ 85.926554] QAT: Invalid ioctl [ 85.942572] binder: undelivered TRANSACTION_ERROR: 29189 [ 85.950473] binder: release 11326:11333 transaction 196 out, still active [ 85.957512] binder: undelivered TRANSACTION_COMPLETE [ 85.962679] binder: send failed reply for transaction 196, target dead 2018/02/04 21:33:33 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f000088d000)='/dev/sequencer\x00', 0x400, 0x0) ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000456000-0x4)=0x1) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000302000-0xc)='/dev/ashmem\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000972000)=""/132) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00007da000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TCSBRKP(r2, 0x5425, 0x0) ioctl$VT_DISALLOCATE(r0, 0x5608) ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0x7ff) 2018/02/04 21:33:33 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000044c000)='/dev/binder#\x00', 0x0, 0x800) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000d0c000-0x16)='/selinux/checkreqprot\x00', 0x80000, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f000054d000-0x4), &(0x7f0000588000-0x4)=0x4) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 6 (fault-call:2 fault-nth:0): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:33 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000120000)={0x26, 'hash\x00', 0x0, 0x0, 'vmac(aes)\x00'}, 0x58) poll(&(0x7f0000e79000)=[{r0, 0x10a0}, {r0, 0x4700}, {r0, 0x8000}, {r0, 0x80}, {r0, 0x2}, {r0, 0x20}, {r0, 0x2000}, {r0, 0x2008}, {r0, 0x4220}, {r0}], 0xa, 0x44c3f18c) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000f3f000-0x10)="01010000000ef40000000300409d9254", 0x10) r1 = gettid() sched_setaffinity(r1, 0x8, &(0x7f0000b56000)=0x100000001) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) recvmsg(r2, &(0x7f0000105000)={&(0x7f0000cd4000-0x9)=@rc, 0x9, &(0x7f00007c5000)=[], 0x0, &(0x7f000041c000)=""/4096, 0x1000}, 0x0) write(r2, &(0x7f0000bf5000-0x4a)="d5440be5d808b032a2ab11c22a16176077", 0x11) 2018/02/04 21:33:33 executing program 7: mmap(&(0x7f0000000000/0xb000)=nil, 0xb000, 0x0, 0x4031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000000, 0x6, 0x0) mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f000000c000)='/dev/hwrng\x00', 0x400000, 0x0) mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f000000d000-0xd)='/dev/dmmidi#\x00', 0x331, 0x10002) mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000235000/0x18000)=nil, &(0x7f0000008000-0xc)=[@text32={0x20, &(0x7f000000d000-0x4a)="0fc759088fc9009a4805f2ad0f00953ef60000660f1f000f16e6f30f119ff2958f2cb8050000000f23d80f21f835800000700f23f866b800000f00d0b9800000c00f3235000400000f30", 0x4a}], 0x1, 0x10, &(0x7f000000c000)=[], 0x0) mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clone(0x120000, &(0x7f000000c000-0x95)="253540ad2e84e9e73d6f67cf14e057ecb42afac2426133e4bdd623c512996e0652149ea7f474e0ee1b3a60ec1cbddd63067d41daff325470c36940a4290fff8f8307decd326caf321c674aa9cce1017862d09d1fed91787dc76a8f88731e1034138107e4fdd1e800761c941d23d44429192d1dae8cbf21ecabd2975fbfa923e9353f5a93d7765f1cfe61584d7530859fc885508533", &(0x7f000000b000-0x4), &(0x7f000000b000), &(0x7f0000008000-0x1000)) 2018/02/04 21:33:33 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000001000-0xb)='/dev/adsp#\x00', 0x4, 0x14080) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000002000-0x10)={0x2, 0x3, @multicast1=0xe0000001}, 0x10) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000000)=@pppol2tpv3={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @empty}}}, &(0x7f0000f03000)=0x2e, 0x80000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_netrom_TIOCOUTQ(r1, 0x5411, &(0x7f0000001000-0x4)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:33 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x1, @empty}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000a64000-0xe8)={{{@in6=@ipv4={[], [0xff, 0xff], @rand_addr}, @in=@empty, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2}}, {{@in=@loopback=0x7f000001, 0xffffffffffffffff, 0xff}, 0x0, @in=@local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}, 0xe8) openat$dsp(0xffffffffffffff9c, &(0x7f0000a67000)='/dev/dsp\x00', 0x400002, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ac6000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000606000-0x10)={&(0x7f0000430000/0x3000)=nil, 0x3000}) syz_emit_ethernet(0x2a, &(0x7f000000a000)={@broadcast=[0xff, 0xe0, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001, {[]}}, @udp={0xffffffffffffffff, 0x1, 0x8}}}}}, 0x0) 2018/02/04 21:33:33 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000c53000)='/dev/snd/seq\x00', 0x0, 0xfffffff) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a45321, &(0x7f00006fb000-0xa8)={{}, 'port0\x00'}) [ 86.025532] FAULT_INJECTION: forcing a failure. [ 86.025532] name failslab, interval 1, probability 0, space 0, times 0 [ 86.036854] CPU: 0 PID: 11367 Comm: syz-executor6 Not tainted 4.15.0+ #207 [ 86.043867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 86.053219] Call Trace: [ 86.055811] dump_stack+0x194/0x257 [ 86.059450] ? arch_local_irq_restore+0x53/0x53 [ 86.064119] ? __lock_acquire+0x664/0x3e00 [ 86.068358] should_fail+0x8c0/0xa40 [ 86.072064] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 86.077152] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 86.082323] ? print_irqtrace_events+0x270/0x270 [ 86.087057] ? find_held_lock+0x35/0x1d0 [ 86.091101] ? check_noncircular+0x20/0x20 [ 86.095318] ? check_noncircular+0x20/0x20 [ 86.099543] ? find_held_lock+0x35/0x1d0 [ 86.103630] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 86.109490] ? lock_downgrade+0x980/0x980 [ 86.113614] ? lock_downgrade+0x980/0x980 [ 86.117746] ? rcu_note_context_switch+0x710/0x710 [ 86.122652] ? lock_release+0xa40/0xa40 [ 86.126603] ? lock_release+0xa40/0xa40 [ 86.130569] should_failslab+0xec/0x120 [ 86.134528] kmem_cache_alloc_trace+0x4b/0x750 [ 86.139115] binder_get_thread+0x1cf/0x870 [ 86.143338] ? binder_inc_ref_for_node+0xbc0/0xbc0 [ 86.148259] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 86.154133] ? rcu_note_context_switch+0x710/0x710 [ 86.159054] ? __might_sleep+0x95/0x190 [ 86.163028] binder_ioctl+0x20c/0x1417 [ 86.166909] ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0 [ 86.172523] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 86.178394] ? rcu_note_context_switch+0x710/0x710 [ 86.183312] ? __might_sleep+0x95/0x190 [ 86.187273] ? _cond_resched+0x14/0x30 [ 86.191149] ? selinux_file_ioctl+0x444/0x690 [ 86.195624] ? __fget_light+0x297/0x380 [ 86.199583] ? selinux_capable+0x40/0x40 [ 86.203643] ? __sb_end_write+0xa0/0xd0 [ 86.207614] ? security_file_ioctl+0x7d/0xb0 [ 86.212006] ? security_file_ioctl+0x89/0xb0 [ 86.216411] compat_SyS_ioctl+0x151/0x2a30 [ 86.220630] ? do_fast_syscall_32+0x156/0xf9d [ 86.225104] ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0 [ 86.230710] ? do_ioctl+0x60/0x60 [ 86.234147] do_fast_syscall_32+0x3ee/0xf9d [ 86.238465] ? do_int80_syscall_32+0x9d0/0x9d0 [ 86.243056] ? syscall_return_slowpath+0x2ad/0x550 [ 86.247972] ? prepare_exit_to_usermode+0x340/0x340 [ 86.252976] ? sysret32_from_system_call+0x5/0x3b [ 86.257810] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 86.262648] entry_SYSENTER_compat+0x54/0x63 [ 86.267036] RIP: 0023:0xf7f55c79 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000f53000-0x11)='/dev/vga_arbiter\x00', 0x2, 0x0) ioctl$TIOCSBRK(r0, 0x5427) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000c49000-0x10)={0x80, 0x40, 0x5, 0x4}, 0x10) ioctl$KVM_SET_GUEST_DEBUG(r0, 0x4048ae9b, &(0x7f0000fbb000-0x48)={0xc0000, 0x0, [0x5, 0xffe, 0x1000, 0x7ff, 0x200, 0x3, 0x3, 0xfffffffffffffffb]}) 2018/02/04 21:33:34 executing program 4: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000006000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000005000-0x15)='/proc/self/net/pfkey\x00', 0x80800, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000001000-0xc)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r2, &(0x7f00001b0000-0x8)=0x20200000001, 0x8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000001000)={r0, r0, 0x3, 0x1}, 0x10) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) connect$pptp(r1, &(0x7f0000003000-0x20)={0x18, 0x2, {0x0, @dev={0xac, 0x14, 0x0, 0x13}}}, 0x20) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000)=0x10001, 0x4) [ 86.270380] RSP: 002b:00000000f775108c EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 86.278068] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00000000c0306201 [ 86.285314] RDX: 00000000206b0000 RSI: 0000000000000000 RDI: 0000000000000000 [ 86.292564] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 86.299811] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 86.307059] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 86.334677] binder_alloc: binder_alloc_mmap_handler: 11368 20000000-20002000 already mapped failed -16 [ 86.340744] binder: 11365:11367 ioctl c0306201 206b0000 returned -12 [ 86.348559] binder: BINDER_SET_CONTEXT_MGR already set [ 86.356567] binder: 11368:11371 ioctl 40046207 0 returned -16 [ 86.377351] binder_alloc: 11368: binder_alloc_buf, no vma 2018/02/04 21:33:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000ffd000)) sendmsg$nl_route(r0, &(0x7f000001c000-0x38)={&(0x7f0000e4a000-0xc)={0x10}, 0xc, &(0x7f000000b000)={&(0x7f00006c1000)=@ipv6_newroute={0x28, 0x18, 0x505, 0xffffffffffffffff, 0xffffffffffffffff, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@RTA_METRICS={0xc, 0x8, "0600100000"}]}, 0x28}, 0x1}, 0x0) 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0xfffffffffffffd60, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00003a8000)='/dev/ppp\x00', 0x800, 0x0) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f000065e000-0x28)={0x2, 0x0, [{0x986, 0x0, 0xfffffffffffffffd}, {0xbdf, 0x0, 0x81}]}) 2018/02/04 21:33:34 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000b3b000-0x4), 0x22a) 2018/02/04 21:33:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000041000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KDSETLED(r0, 0x4b32, 0x0) getsockopt$ipx_IPX_TYPE(r0, 0x100, 0x1, &(0x7f0000fdd000-0x4), &(0x7f0000da2000)=0x4) writev(r1, &(0x7f0000a2e000-0x20)=[{&(0x7f00004d6000-0x18)="8cb46fd4ba774e85ffd94b2625506601487f3210c3015f76", 0x18}, {&(0x7f0000e39000)="0e07805da19e136b7ee6520591bb9141646038b2ec2ff565893c811830a1c40798f4da7153e1a96fa345c62d27e42b1970", 0x31}, {&(0x7f0000d02000)="a18730e3bcd4562e1b1f0d8e79708c3dccce49514733a579667424aa628c6876621922c538469d992637a484efb8ecfb7fcbdb5e97d0acb2e2b186842d75bf26607f379298f8340fe34ade476a3f91c5e8681a76454a7c67d055bbaa15f8842783ad9c8a04fd7dc93ba3e8c956f7dac53c0bb14279f1476684883479af8120f16ed048c7cf138a343c643534", 0x8c}, {&(0x7f00009b8000-0x82)="d92e82d9723ac375c97acf91296da7f3e2647e49931345ace68185451b5d4831708ff13f0ff1f59231e5cfbd0018ef8c4479d5d629ea8df1dd6983dbb95519eb4b242443d6c00bc6737b220effc1e0767d6240b93992530e2c94a3b8d1313db339f34b6a305dc4ec3ad889a0a77e4c4f43e135bd898086c23be25ee4373c95a7e2d4", 0x82}], 0x4) 2018/02/04 21:33:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000b1b000-0xb)='/dev/adsp#\x00', 0xa6, 0x1fc) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000936000)=0x100000000, 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000f12000), &(0x7f0000927000-0x4)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) fcntl$setlease(r0, 0x400, 0x2) sendmsg$nfc_llcp(r0, &(0x7f0000fdf000-0x1c)={&(0x7f0000335000)={0x27, 0x1810, 0x4, 0x0, 0x10, 0x7c26071f, "cd5385366df58ba96285eed2142405ece5639494174626cf863795995e1d0f60cea2d09e7d05aa6b33895644a766e196245893b2ef57d0ec48a5bb1ede089e", 0x89}, 0x58, &(0x7f0000b9c000-0x40)=[{&(0x7f0000155000-0xb0)="7ee417586233e12c8ef791ab401a0f53ea85bee80a1020a355dea662f6c855f9ba1f05d287729855113af9bcd2397c17491c4971209199332b2abd86e48562018f128143795def6226d9cfb254726c9db104879f12a99743383893a382e88cc8eee0a5c936f0622fa1083f46a17648bdd1c64247511d569ece3b072a4a7488093317768ec0445f57b9240616e78188571083b39d5e2b185031802640408ef0c256e020225cd7adffd2745413a4cad7eb", 0xb0}, {&(0x7f0000f32000-0x9)="c67a31c1590f65b9a0", 0x9}, {&(0x7f0000317000)="433394f0127928a9c89d1c024deb77438b92975de1986d6bbc2404c5b9d7470e023de95b7306f901b29f110500543f0d5e945d20d4743061eb56b7c3ae3e392df969ea8d3ce6610cd8c88d3a427c7f3c9ab8ebfc2d6b6212e06c82088831c02070d690fbbc5e06cb55bbe03026e0c79602fc2c8a710ba91315199b02d7a055578f108d344d6ebef7a3f3b8bd2be5498d808f1cf3b9b8b00f0f7d3d3a5ad48cd7e2d34336d9ac486aae3c1aae58879b252dbd46c5f2488f415fcb000d5904857919fbce13fc71a584d95bc14aef3f1a0a96f7dd7c6d013f714061ef4a968c5fe643872cfe3f738aee8a6bf4b53b54c04fe5822365b9", 0xf5}, {&(0x7f00004b3000-0x2d)="e69b265037601f0bf617a827675e55275b2088f67b47f68c699759987906c1b94810b5e54cca932377102c7006", 0x2d}, {&(0x7f000028f000-0x7b)="7c0a68a57c9a945233cdddd08ab51de3ecab1b18f0987decf2e36c9fcf162fafcd4207817e9f5883c890c392c79ba25f476865a02e4d0242533ae84a7606e02697918ec340750e0167ca3954ac0087970877ecef95ae1ce242f8f2b9d038790b76be10e826572fec47b8439054729dd584487d6fad1e138465f9ca", 0x7b}, {&(0x7f0000fbe000)="df9df8852921dd3ba210c0a8f73ab32b0f0ebe83ce80beae1ac9be76151d56ca2417134c27f9d083562be6daead3cb33b977faf81db64b2056b1dedd12f3d1359f09", 0x42}, {&(0x7f0000fa8000-0x91)="e3f5737a5359d45a048ab0b114242ba400054e3ff1feacdd6da254b6bed9321ed372dce65e5b729716b7bfa74e458e9d6f80fb8f18c9ccc3524477e2e454f8366db195ccabfe6ad89ed9e215a44f0fe966d797b5bbe1098b5fb6b5e2932259d6fc589c0c08830baae9c2853a156fb2d1ab715861aec9e98ed68af3f7388c2e9aafbff60c4e3bbfb76ea693ccad9ce815fa", 0x91}, {&(0x7f000097f000)}], 0x8, &(0x7f0000d03000-0x24)={0x24, 0x11f, 0xfeb, "4e54900c1d8fb41954c1e2355aa94c7ee777da36a1"}, 0x24, 0x800}, 0x4000004) 2018/02/04 21:33:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f000023b000-0x18)={@multicast2=0xe0000002, @loopback=0x7f000001, 0x1, 0x1, [@multicast2=0xe0000002]}, 0x14) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000559000)={@multicast2=0xe0000002, @local={0xac, 0x14, 0x0, 0xaa}, 0x0, 0x0, []}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000033000)={@multicast2=0xe0000002, @loopback=0x7f000001, @rand_addr}, 0xc) 2018/02/04 21:33:34 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000fd7000-0xa)='/dev/cuse\x00', 0x8000, 0x0) ioctl$KVM_GET_CLOCK(r0, 0x8030ae7c, &(0x7f0000813000)) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KDDELIO(r0, 0x4b35, 0xffffffffffffffff) clock_nanosleep(0x8, 0x0, &(0x7f0000f2b000-0x10)={0x77359400}, &(0x7f0000956000)) 2018/02/04 21:33:34 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) syz_open_dev$binder(&(0x7f0000f33000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:34 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000df9000-0x27)="2600000022004701050007008980e8ff06006d20002b1f00c0e9ff094a51f10101c7033500b0", 0x26) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000b4c000-0x4), 0x4) sendto(0xffffffffffffffff, &(0x7f0000cff000-0x12)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000fa3000)={&(0x7f0000d0b000)=@ax25, 0x10, &(0x7f00002e7000-0x80)=[], 0x0, &(0x7f0000878000)}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000c44000-0x1c)={&(0x7f0000d4a000-0xc)=@nl=@proc, 0xc, &(0x7f0000cfd000)=[{&(0x7f00002c5000-0xfb)=""/251, 0xfb}, {&(0x7f0000518000-0x5f)=""/95, 0x5f}, {&(0x7f0000f7e000)=""/190, 0xbe}, {&(0x7f00001f4000-0x1000)=""/4096, 0x1000}], 0x4, &(0x7f0000650000-0xf7)=""/247, 0xf7}, 0x0) [ 86.383109] binder: 11368:11393 transaction failed 29189/-3, size 24-8 line 2957 [ 86.404964] binder: undelivered TRANSACTION_ERROR: 29189 [ 86.415571] binder: release 11368:11371 transaction 201 out, still active [ 86.422586] binder: undelivered TRANSACTION_COMPLETE [ 86.427756] binder: send failed reply for transaction 201, target dead 2018/02/04 21:33:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x802, 0x0) r1 = socket(0xa, 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)={0x0, 0x9, 0x0, 0x2, 0x0, []}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000954000-0x15)='/proc/self/net/pfkey\x00', 0x2000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r2, 0xc05c5340, &(0x7f0000183000)={0x80000000, 0x5, 0x1, {0x77359400}, 0x1ff, 0x753856de}) ioctl(r0, 0x68, &(0x7f0000000000)) connect$inet6(r0, &(0x7f00003b7000-0x1c)={0xa, 0xffffffffffffffff, 0x3, @loopback={0x0, 0x1}}, 0x1c) ioctl(r1, 0x8936, &(0x7f0000000000)) sendto$inet6(r0, &(0x7f0000a01000), 0x0, 0x0, &(0x7f0000682000-0x1c)={0xa, 0x2, 0x0, @dev={0xfe, 0x80}}, 0x1c) preadv(r0, &(0x7f00004cd000-0x8)=[{&(0x7f00000e4000)=""/113, 0x71}], 0x1, 0x0) 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000376000-0xb)='/dev/mixer\x00', 0x80, 0x0) socketpair(0x2, 0x80800, 0x4, &(0x7f000058e000)={0x0}) renameat2(r0, &(0x7f0000eb2000-0x8)='./file0\x00', r1, &(0x7f0000aa7000)='./file0\x00', 0x7) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000aa7000-0x24)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000141000-0x4)=0x24) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000505000)={r2, 0xae, "b5098a73e22ff2d47729136505c5001ef5b81a0b7c1964e218ac954fc8bb53d15944d2183ddff26a556a8fbd512d793922269a5b4cb76fa1b31f490f097dc0b2b10f9acca7add3b34e8bc0547d71bd5137532d761aae6fc9780469aa5b093c987a772614e2e97270525380ac9e5c59cbe05ed198829840e0a57a39cbe244e1132e4fe33609b97a1fd79814dfa61b8544f24fa06ad2656bb4d71b46b1be08f98161c633067ed1b6ca6e345e3a89fd"}, &(0x7f0000c9a000-0x4)=0xb6) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000893000-0xc)={0x0, 0x0}, &(0x7f0000549000-0x4)=0xc) r4 = getgid() lchown(&(0x7f0000a7d000)='./file0\x00', r3, r4) [ 86.454321] binder: 11399:11413 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 86.475083] binder_alloc: binder_alloc_mmap_handler: 11403 20000000-20002000 already mapped failed -16 [ 86.496564] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/04 21:33:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000faa000-0xa)='/dev/ptmx\x00', 0x0, 0x0) lsetxattr(&(0x7f0000fbf000-0x8)='./file0\x00', &(0x7f00008f1000-0x14)=@known='security.capability\x00', &(0x7f0000565000-0x6)='eth0,\x00', 0x6, 0x2) ioctl$TCSETAF(r0, 0x5408, &(0x7f00006d1000)={0x0, 0x0, 0xfffffffffffffffc}) 2018/02/04 21:33:34 executing program 2: r0 = syz_open_dev$sg(&(0x7f00000ef000)='/dev/sg#\x00', 0x4, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fcntl$setlease(r0, 0x400, 0x3) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0086426, &(0x7f0000001000-0x8)={0x1, &(0x7f0000000000)=[{0x0}]}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_GET_SAREA_CTX(r0, 0xc008641d, &(0x7f00007b1000-0x8)={r1, &(0x7f0000000000)=""/4096}) mmap(&(0x7f0000001000/0x20000)=nil, 0x20000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f000001c000-0x38)={&(0x7f000001a000)={0x10}, 0xc, &(0x7f0000013000-0x10)={&(0x7f000001f000)={0x18, 0x32, 0x3ff, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@nested={0x4, 0x1, []}]}, 0x18}, 0x1}, 0x0) 2018/02/04 21:33:34 executing program 4: mmap(&(0x7f0000000000/0xb000)=nil, 0xb000, 0x0, 0x4031, 0xffffffffffffffff, 0x0) msync(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x4) r0 = creat(&(0x7f0000003000)='./file0\x00', 0x3) mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f000000c000-0x28)={@generic="1c4f741a54ee05bc1596c2d76b7742d0", 0x1}) [ 86.503872] binder: 11403:11412 ioctl 40046207 0 returned -16 [ 86.513122] binder: 11399:11413 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 86.527412] binder_alloc: 11403: binder_alloc_buf, no vma [ 86.533140] binder: 11403:11421 transaction failed 29189/-3, size 24-8 line 2957 2018/02/04 21:33:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x2000000001, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000951000-0xf7)=""/247, &(0x7f0000b8d000-0x4)=0xf7) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00008ad000-0xa)='/dev/cuse\x00', 0x400000, 0x0) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r1, 0x12, 0x2, &(0x7f00005be000)=""/182, &(0x7f000013f000-0x4)=0xb6) ioctl$DRM_IOCTL_SET_UNIQUE(r1, 0x40086410, &(0x7f000027f000)={0x1000, &(0x7f000018e000)="dcdaa6bb2c853228e8dffd3473312bcee4b042f61fcbb787e9fe151382b948cf6ae645fd6be25d5f72f187ac3d242878a01455fad582b3bc26722fd259e41a38ba3c674a9346496b93c58e8c5598adb72ac4bf22c64bf2a69fdf27f4ae3092f68645870a63ff64a9b618b26e57edfbebb88688f144427cd8a0b94105a5ea29d8f3d0971285e8c63577ae7b294ee207306a484b9348db17a20b1566afbdb4080522d4046bdb2b392d3d8a38ad9bc070026f3e24b1db28dcbb9332c754cf9edeb16b2ad75f85a6e7cf95865b38cf17ed9979ef9c8f1c0bb8a7d1990a3e6055e1661204f6865fa4450c79927b7b59506c6e9cad8236af588acfa26eaafeb92415ab0701a6466ae4dc479ba1792e3119a8996572614e7ec5bfac2bf6629fa1a7c305c6569f3da51e63ccad3b4d4dc9acc641ba82fec3a0f1514193fa46fcf06fcd58de5719514b1279e27d4a6d301c1b5b4145bc70db24b1c41555e8f6bad8ae906f06010b0c32ecf214dd93b926c2034bb3250176ab1b96f78ec15ac756b76d6afc29c41adba24e682b0f03884db594c2896cd1bdde8e3071d9d869d64d65c42bcfbd0bf7bec9cb4a5c5f714f2993194b6b16eb0c5215872457d843404a9e7a2d579b0269a1392eb8c046b877acf167977e4db10a3ebfb210d2d61f9c10cb2d1fcb1c8df06c711feaa386605d27fa7c857ff42dabc67c2511794398a99035f57dff40fe01aa079b559dbaa4ffb4f1d93623a678f06eaa65c134b77712dad6583c8de2cad9fb5dcb45522dd402e9075f849051441228461d2c2a918c2012420c2d65913a46e5deaf442008967b5add00465f67b868536cf2adef7e5c822088ff9f381cec789d6056d9adf4531d69ec037d752049f82bd7e973db13f2a73be00bd3b6996affe28e78f56a804806047be0e60a117fbef05e550a8e9d3ed5e131cfcd7cc5d31c5125d89b059f67f62ce5137b56947d2ebd09bc71e93c8665fd59260fd1b09ef670527a30db6f8bb197389a65e6dd24f3aee4b507597988bd1c971b3f8a4fe4c48f2786e887815248eaf2d25e8a136820384788c2f5b8ed101adc0282a853f99987f1b6524f047c464550a5f7ec3e64afdcd3e456e9cf82f8ce52d08ba24d7ed87615923456ba12afe1f2c3f1b57c7e5af607167216ec3812623fe9c5979547ca71cc8c2aa5bc0c077a62ae7aca131471f63e697ee78fb294357ff2ac4d610dfed337493a4890f88bb33a309805aa7d3af662200304a457f2bf10af0843cbc0879d493ab62117603f70e8a64c8e38982da0d4dfba8864c645f7734838c5622ad10a02d73888d80b6ef1fc8c11133936af4002eaedf1ed9522ceda768382579f8960aafbd14e7df6ad2801a5da34d3274911064a08f13537e26905a2968faaf7ff95fd4de0165c01d572b05aa5ac5c0cc353c09860c0f1589faeae1ea21c950a26ea0492e521660716a333286d9994604baf0f160d2b9344c6e4bf7efd93eea706e90b8ba59da1462fea35ea4ed85458bc972825650b7657227a0f118f0e426deacb16f1b9f87749600ddfc568bac5410d4696de056e3e659d3c6fe0aebac814be79919407398b8e67850eb51552c5517ca838f87df1c0a2d2610c76be7bcf847897c1a87330d8a741fa1e95405a88dee8cdbb756447ad3872827c150cddc87e7e0c4f1800c21fe02122f8b9a89f7dcb7d3dfdb0c6b6e45b2bf7f09cc42dffb2d31097dc98e2440bff0ed257eba3cb50ca604a1ed7e44125328d33d45b739fd30ad78afcb5893a3c3b5e49ecaca80f69e75deb08dc7e5431e206427ed76a80785ee92b5b9eff28e78484c12a743699c3c830a6767c21a8cc0570ca43f91e378ad19e293ff17db744dcff7f2564dab7e256eb9e12e51e255e63c60675759dbd18e8e31d10ade65dbe42154d6d9ba27663a63253d8e772e587643c0f626dbcb35ec8fffce92d0aea84abeee266ccec1f77f1925ee87dd6bb835db9559a5863d09ec7923b6d4f38047084c425fe2b3afa2a7a7fad33be5f68eb0a81e4e42cd5a1524fb45ae51b2154b4b2d531f6df20f23a75bc75ceff9075b315a015a40709ad7b9eb58737f957ae6f0f652889a16faa39a936309ae13c3937ca10bedb9bb76353ed139b003fef4580951a347f62940ccd73deb7458519507f33afa781b10fd3e074ea352390b58ac323df93549110a02fb960d4194d8b954bb65efb44accbd52224722b78c4fa1755f40716a478cd45819cd7e8323126b499aee2a116b50fd2b77753387f294120fbd11321ab21d1aa816ca87c7ed19f3efc6cf133ef8931ad9c4daac539fa4d7afc2b97647dfc021dff0ed7150a14c14fb1696a6ddffabb942561fc1e03851e1dea6e92a4a473acbb8d35f0b7a078c59027eb94d6b40c6ea8e4f59071672c36a9c8f8e9464c9ef116af98e6935f545987f1f121b5dfb1a735b1b307517c078a1fdc3924562af7cd5a2a24d7ae0529b9f981d11bdce60471f323d16bdea3cbbae37b31e9a5ff3523954c20a8880047ec27b803122f405d2b138bdac2f6b807a4fa72a12b694f212eda511e719bfbd97510b5bb137c588191c37440513d6cfb9197945a88b5e6e7771ca0836f91035d061f49e227db711818a0505927d39dbb6c62f0f7f7ce4ebec478ba15625c15fe7e7303021492f815a14a086b97031a7dfa87c2812e1ba72523f575ccf420425aa21a7f6cf6da5e9c338cee9d37170688cb062bb0e890d1bab29deb11ff0f0322ab7d80b17407194130c4a47053016587d684d23c3801725782d14f17496958d911bd0d05084cb4095150dfae95d0c0693edd32dfd38882ccd01f264311efce53c30e7c968fbeae8ec76b22bc6045fd3e2e2a7e46f6190821fe9b6ea37e9f9d0234a6edfc16cdd1d5d675e5007a8ea4219ba1d98d34090e614f6688474f90f6487c570f13b6d07058cfaa7806a5a9945288e51f1be39d1ec72cca6caa70ec1ea835c961a51863509e4bca09b31f6fd0f2a287b56316a73e0624e5142e116c58b70ceb959f9e797f5d92a4eda54b85edca884296e395682409b6d104693fb051a613463d217c72c773fb461ae8f86ce53c72f70e86829a532ce2b529c58569492d3d65b40d52fe45e18d69153f4a7f384442a64f94d21f29eaecb2304cedd1d204c5d3f1c36f288ba3051e1ef9dd8263a6530ee9a46a8648b626505eb7c4a0e581b8f0479d4cb3823e60f58023621475ed71ad7d0f3a33315a4a55a1127300bdc3ce5515121cab2576c9e391fe14e5cbd3acfd9ed743626bc2eb860ecc93dae2fda88d92fb4314bab69601198f99cc9881685890336ae1c73db3f9cf50b5abd34e4c09b63af7c9a28fba509bd78914b7d88cb0fb4a4a1799733497ebb23c20b7bd1a5b8ac89357046a19afbfd624ca73fcb17e8dc108ee9aad38e3c25f41465f62da3efdaa5fedeab5cc2a1155a6abace23da8a0c6d6635a3f8f9bca897afbc9eb5cbbda3662f4b26bcd320f50992324b58f2e5dabdca1bd0a59477f789b5f7db6b745a86427ca35cb35f51dc850084fcd8b88541fde174eaf997bea121a1fdd05c1d37adf7fc8227c4314ee95cfcb29b187e4a1302d1e6d34dc4b0780326537216af25ef1175375621feec6f513d9879447a1924d148f02a74818fbda676dbfdd91b902a724f76bbd12cb34a49c544421dbdb6c6584c5e08ad6bd452b7f67205b90e4ee20f218708fa9d6b52f95b3e90278cb4fad5400eaa12b28f31a762617eb7e7aad11171bed6fe819986641e041535ef4e8bed1a2b954d1a2f70f671b12f054c191439179466958b0ea6808d599e748fa59e0477db5178039d58242c554e2ac9f4db92a2601a50a984fe9f94aee6b72111ff1dea1fad750e16020bdf1db31a125cdfc245bff4fae47edcafd882905f94e293ecd4bd4eb9c3a5e5c79a1ae6313c9aad192a68a4af5b363e37f005c4ffdd059fd7ad2f504326cd973fe19f867163bf2f42e73fffa9ef18a51ff6baa79c7ba873111403d6114503bb3c7e6dd4d6738650176a03308c66712d85dcb1412eb7b5e6c2d6cae920e7183f94481d6fd112278b9190603418057e0a740f55492090df328532373bae44ae9292f5376b8578ddd6c587976b484bc27080042fac3e81d51f17383ded9f5f7e62b4124ddeae0f0ef2bd28c584f56ea3190dcff9c7a48e4f4fb2558b7fa622701a013dc24e6f0fe3451a9e90d70671b115e96f99de093a7ea97d1c39a363df54b8c09b00808c7fdd9b349e30c138710b885ea31ed8daf2ee6d6eabf09373371a62e115ceb0443f6f8882cb701a016ae9005072584ec0bb38f8035ece519e5bf3cdede48ecb80bd806bcf12d3ec23741bd729723cf879574e7ce95ec7d59421d6926b17d2262bf701eaefc470b735631188bbb16b468d6bc574419c44fcc83b17a2df83ad1d5e5655bde3550e9f1a6fc0652c46e335ee1b352a5d8863bdf8d88d7130c7716bf8568ff0b7bc88592a9aa40fc02b6e7bd59e9dbf2fb5b21bfcd80978f75bf1f8c7cebc475e8df40f1a42a9b82808545b9c64d5673f1b3172f0d9b16b1f8fd5b2d5f3705e61495e760d018569653fdde9cb140ab8951948a38995b368885ade51c5b40b801b3be33834fd55c8c6c4b0466fcafbbab550238ddb67f201fa0fd21424e41727850312961e81ed9af04ab4433fe9dd64005e1cf81d9ec30d2ca5c08308b596cb9a73692f0b235a93528cdb45fc92bc9e55eeb048fa397617a64725470ac63700b2a943b2ba02fe867aeda821bb0e8afebfad033a8adb58e912d6a7ac732808deaeaa30e457fe794f92e5489cea53f62d5b12b551b5e806f056cbcd5499ad4a78118d780d9d118dad77eb7f0dd790c99114bb92a9ae3e45d07e3df034ff6bfeb51922e63e726e059f55a8ad20b07da58f2e297714e622723e004578357db3e076f7af4f49886ee4256a64c90643b535f580a8850ccabb94185eac9b6362a8fad0403c8490ff5c06336ca7f70ce3aac312c859197297a36009eb04a36e457ecdb8e38ae528ec8e70ffd1f3d786927433d98d1072c8c88e9beed8b2891353233ef802a1351369deb4ac6cc683c9bd875f13d7d416dcfe5fec1b3e630d67b5ca3de13c86aff8ca05b1d4cab52ff049f933a5bcb33cc6f9c475ef9c49adfc611a971dba2fb7149573dba96b7b156867bc100c2d6d0bdf404bcc573411a0d95a7acfc5403efed8c5c1bf307283b446abe81a23d6d9531c3f73a3e8b55a119b04e97bb9558572d81cbfb70191e9748da0b4e030416e2fae698a00d512f2c5fb77162b88e42cb88184a687ae84e37b5640a2ee4dff6b5d481215e014fcdbc0c15cc3a5edb208f1bf976ebb6433cd1870f200581a85f248716908d50d9f6ea0bedbaff221a0cc5833b5416b88123f603fc32ae5fcc424fdd5f29de9908fb7b6bd7a02c29522eb968fca4df8011eb6ac54275debc4115b54beb92d473d074b18597dc9177a4fcb0c5bca4428b2effea97d22b184e33150048b50bc07bbe49cd944e46120c8a8cf495b48d76f662a408cedd63e8e977bd727d4b36870f85f2bfe2e1dfe87ba8f969c07029aef2ed40f67ad6c070915a40077e9123be96577a7dacf1ce2e8dccd1a9c1d2f3dfa2ed66d7bcca98fd82b5668b00da365a8d9d83985f7a5a9938eda824277acd2d9a3ca6b9fa05f7d43869b997e6e698ba6ee7a424814f39b2affcb7778ea599fb368006be9a8521664caa954b2afeded4f29a2340207dcf0c5714d7c30caef6e982ab63c8f513c812f205b17e14e56377f6bdd8a74ddf3b391ed9c136e8644e"}) 2018/02/04 21:33:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) fstat(r0, &(0x7f0000a96000)) 2018/02/04 21:33:34 executing program 7: mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000003000-0x15)='net/ip6_tables_names\x00') mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0xffffffffffffffff, 0x11, r0, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r0, 0x81785501, &(0x7f0000006000-0x14)=""/20) 2018/02/04 21:33:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000ee000)='./file0\x00', 0xfffffffffffffffe) mount(&(0x7f00000a9000-0x8)='./file0\x00', &(0x7f0000532000-0x8)='./file0\x00', &(0x7f00009cf000)='ramfs\x00', 0x2000000, &(0x7f000081f000)) r0 = open(&(0x7f000017d000-0xc)='./file0/bus\x00', 0x141042, 0xfffffffffffffffb) pwritev(r0, &(0x7f0000a5d000-0xa0)=[{&(0x7f000049f000-0x47)='Z', 0x1}], 0x1, 0x0) [ 86.553525] tc_dump_action: action bad kind [ 86.606338] binder: undelivered TRANSACTION_ERROR: 29189 [ 86.608718] binder: 11445:11449 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 86.612247] binder: release 11403:11412 transaction 206 out, still active [ 86.626748] binder: undelivered TRANSACTION_COMPLETE [ 86.631913] binder: send failed reply for transaction 206, target dead 2018/02/04 21:33:34 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f000052e000-0x9)='/dev/kvm\x00', 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f000043b000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f000014d000-0x4)=0x14) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000e75000-0x90)={[], 0x0, 0x10210}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000c15000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f00001db000), &(0x7f00006fc000-0x4)=0x4) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2018/02/04 21:33:34 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = getuid() setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000570000)=0x100000000, 0x4) sendmsg$nl_netfilter(r0, &(0x7f0000aba000)={&(0x7f0000791000)={0x10}, 0xc, &(0x7f0000e2a000)={&(0x7f0000275000)={0x298, 0xd, 0xa, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0x2}, [@nested={0x284, 0x7c, [@generic="6dcbac1dda17977b0fdb1dc9b777c7511f6279705a16eda01e2eb95fd29610054a5b911b6cac298d195133a6ea537fe82d303f0d7213192c867bd8f1017d7036175a7dd5e198b06db82dd4630a4b6e01fa27a5214f55f20c075c3ab5de5a75bf2d242aa83297a8ac4f01177dcd1dce60bbe1ad05358f3e35075c65fc0ad3f151cb44d0d74cedf715999b9e35fc1ac45dde1f9923fd6794a0cc8451c039a285684fe6c39b019812c2972652af8d3d0107b989128ef565ecb5ec085f9a70cbdd201eceac883e072c53f584eb71631a6f227504e7e8c049416acf67a0b734354fc1660f954b8117432106aa", @typed={0xc, 0x41, @uid=r1}, @typed={0xc, 0x30, @u32=0x9}, @generic="e4b8b55ffa38b6951607898766f49adfe84840085f6030157ba8420e65eb4e3ae4326aa486e6af1c5bba1d68d022fcc576b5e0bb380ff0980d9e4ad9f1f4dbae2de0f7cb63cda8b963acf8bb6c1da71b662b6f7122930d4cc6bf", @generic="20aa68b7b31d82a5d12be456c84bc2eba8b22d8e9f1c2b99c80e1481a7e27bd5", @generic="69a7c6633e0e2b478037e517d16b05695d319e73ef5e267105b8b3c579e52dabe0d373b119f58c6ebb9771edc88f5c166ee9da7d2d2a0efc23ed91f8fc2e4dd60d8b68b1774545f8cbb0b1054166862f30251ea71f7d2a9f6437fe550c7edb3d476a04d3a0169241d00cde3bd66dabeef503e0556d98b695549b8345d3adbcabaf169d89f87588d3f89e8702e82c1a77ba33e7237334184c411bb5e59ac15ed153959c34ff66aa0bb5748f399124d6a55b224444", @generic="e7ccef9fa43a9112da6b87dc5f0e8040ded3b7ef3bfbf9a7229c289132b6d09855d63ec48f377bf9c5e41ea237c342f687bc21d5e1e83e4f63c78a492e87ef2dbcffc374745005f9e5d379f29c14"]}]}, 0x298}, 0x1}, 0x0) 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000e13000-0x11)='/dev/vga_arbiter\x00', 0x40000, 0x0) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f0000b23000)=""/254) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000f68000-0x28)={0xdfb, 0x7, 0x9, 0x7, "d06c83c870b67076d3f8c4368548f6a150a137e50a44545f4530ba2605ca85a9"}) 2018/02/04 21:33:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000940000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x880, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x80}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000dc2000-0x9)='/dev/ppp\x00', 0x100, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000c3a000-0x20)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00003c1000-0x4)=0x20) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000565000-0xc), &(0x7f0000bb5000-0x4)=0xc) 2018/02/04 21:33:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f00002d6000-0xa)='/dev/dsp#\x00', 0x5, 0x1) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0xf, 0x5) dup2(r0, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/04 21:33:34 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) poll(&(0x7f00004bb000-0x18)=[{r0, 0x3080}, {r0, 0x200}, {r0, 0x1}], 0x3, 0x7f) 2018/02/04 21:33:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000b47000-0x1f)='selinuxem1{)trusted!bdevvmnet0\x00', 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000bb5000-0x4)=0x6, 0x4) syz_emit_ethernet(0x1b1, &(0x7f0000be2000)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv6={0x86dd, {0x0, 0x6, "5401a4", 0x17b, 0x0, 0x0, @loopback={0x0, 0x1}, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, {[@dstopts={0x11, 0xd, [], [@enc_lim={0x4, 0x1}, @enc_lim={0x4, 0x1, 0x401}, @enc_lim={0x4, 0x1, 0x1000}, @padn={0x1, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @padn={0x1, 0x2, [0x0, 0x0]}, @hao={0xc9, 0x10, @dev={0xfe, 0x80, [], 0x0, 0x14}}, @calipso={0x7, 0x38, {0xb78, 0xc, 0xa2, 0x9, [0xa0, 0x4, 0xffffffffffffff7f, 0x80, 0x1000, 0x5]}}, @jumbo={0xc2, 0x4, 0x2}, @enc_lim={0x4, 0x1, 0x8}]}], @gre={{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x54, 0x0, [], "3cf61c40f45c20b61a5d8313618d31cced498e9d1a9524026266d2faf773397c52062a4cbc4695df06932883197733c8d90f0d905d4e32a9dfd307d102845dc7fe9a9195d78326b2dd0b27e248f2bdeffe0e1853"}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, [], "d66e0ed7b006c025e88e368fe8527c532510f3adde8d32758ef1eaf326f043d527d43b51dd424f0c6113d39176045824759efa69b1ca9baf035ae1e00f64384be9eb248e367df65e6971aeff1e8d338a233b1685fe65ae40489dd7d28c942586e49a2ebd39b93db9a76ab79f1d8352210cef5341f53fd530b009997584811c09d9f40638f34e96b89b265b968909bcb1bc74a73544f94287022653a86a195296fdaef42b"}, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], '\x00'}}}}}}}, &(0x7f0000a6f000-0xc)={0x0, 0x1, [0x0]}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00009e7000)={&(0x7f000077a000)={0x10}, 0xc, &(0x7f00007f1000-0x8)={&(0x7f0000ba2000)=@newneigh={0x30, 0x1c, 0x509, 0xffffffffffffffff, 0xffffffffffffffff, {0x2}, [@NDA_DST_IPV4={0x8, 0x1, @multicast2=0xe0000002}, @NDA_LLADDR={0xc, 0x2, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}}]}, 0x30}, 0x1}, 0x0) [ 86.650544] binder: 11445:11449 DecRefs 0 refcount change on invalid ref 0 ret -22 2018/02/04 21:33:34 executing program 2: pipe2(&(0x7f00002a4000-0x8)={0x0, 0x0}, 0x4800) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000266000-0x9)='/dev/sg#\x00', 0x0, 0x2) write$tun(r1, &(0x7f0000f96000-0x32)=@hdr={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @multicast2=0xe0000002, @remote={0xac, 0x14, 0x0, 0xbb}, {[]}}, @tcp={{0xffffffffffffffff, 0xffffffffffffffff, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, {[]}}}}}, 0x32) ioctl(r1, 0x227b, &(0x7f0000001000)="06") getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000ea000)={0x0, 0x9}, &(0x7f000038f000)=0x8) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f000089e000-0x8)={r2, 0x5}, 0x8) fcntl$setstatus(r1, 0x4, 0x3ffc) read(r1, &(0x7f00005c6000-0x39)=""/154, 0x9a) ioctl$EVIOCSFF(r0, 0x402c4580, &(0x7f00008c0000-0x1c)={0x54, 0x2f3, 0x6, {0xffffffffffffffb9, 0x101}, {0x8e6d, 0x4}, @ramp={0x5, 0x200, {0x7, 0x7, 0x11906049, 0x2}}}) fcntl$getflags(r0, 0x3) 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x101000, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000001000-0x49)=""/73) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000197000-0x1c)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000328000-0x98)={0x2, 0x400000000000003, 0x0, 0x2, 0x11, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @empty}}, @sadb_address={0x3, 0x8, 0x2, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @multicast2=0xe0000002}}, @sadb_sa={0x2, 0x1}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}]}, 0x88}, 0x1}, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f000032e000)={{{@in=@dev, @in=@remote, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000948000-0x4)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f00006e3000-0x48)={0xc, 0x9, &(0x7f0000966000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9c}, [@generic={0x8, 0x7, 0x79cf, 0x1}, @exit={0x95}, @call={0x85, 0x0, 0x0, 0x20}], {0x95}}, &(0x7f0000436000)='syzkaller\x00', 0x1000, 0x50, &(0x7f0000815000)=""/80, 0x41100, 0x1, [], r1}, 0x48) sendmsg$key(r0, &(0x7f0000f81000-0x1c)={0x0, 0x0, &(0x7f0000484000)={&(0x7f000036a000)={0x2, 0xb, 0x200, 0x3, 0x5, 0x0, 0x1, 0x3, [@sadb_x_sec_ctx={0x3, 0x18, 0x9, 0x4, 0x9, "afa6d7283d2bde1648"}]}, 0x28}, 0x1}, 0x40) 2018/02/04 21:33:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) eventfd(0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f00008ed000-0xe)='/selinux/load\x00', 0x2, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f000080f000)='/dev/vga_arbiter\x00', 0x0, 0x0) syz_open_dev$sndtimer(&(0x7f0000487000-0xf)='/dev/snd/timer\x00', 0x0, 0x0) pselect6(0x40, &(0x7f00000ac000-0x40)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000efa000-0x40), &(0x7f0000f22000)={0x0, 0x989680}, &(0x7f0000f14000)={&(0x7f0000554000-0x8), 0x8}) getuid() iopl(0x3) 2018/02/04 21:33:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000000) r0 = mq_open(&(0x7f0000000000)='^procwlan1\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000665000-0x40)={0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x20, 0x20001}) mprotect(&(0x7f00002b1000/0xc00000)=nil, 0xc00000, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000b6e000)='/dev/vcs\x00', 0x40000, 0x0) ioctl$KDADDIO(r1, 0x4b34, 0xffff) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000c23000)={0x1, 0x0, [{0x80000005, 0x81, 0x1, 0x9, 0x3, 0x100, 0x3}]}) r2 = dup(r0) mq_getsetattr(r2, &(0x7f0000fc6000-0x40), &(0x7f0000acb000-0x8)) [ 86.696902] binder: 11464:11468 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 86.706834] audit: type=1400 audit(1517780014.428:76): avc: denied { setopt } for pid=11461 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001000-0xd)='/selinux/mls\x00', 0x0, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f0000653000-0x50)={0x3, 0x0, [{0x0, 0x10000, 0x7ff, 0x7fff, 0x3}, {0x80000008, 0x0, 0xfffffffffffffff7, 0x5, 0x80000001}, {0xd, 0x3, 0x7fffffff, 0x1, 0x401}]}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:34 executing program 6: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000039000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000497000-0x1)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000261000)='/dev/amidi#\x00', 0x400, 0x2000) setsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000421000), 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) socket$nl_netfilter(0x10, 0x3, 0xc) 2018/02/04 21:33:34 executing program 2: socketpair$llc(0x1a, 0x3, 0x0, &(0x7f0000823000)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000000)={{{@in6=@remote, @in=@rand_addr, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000392000-0x4)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000a6c000-0xe8)={{{@in6=@empty, @in=@local, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @multicast2}}}, &(0x7f0000235000-0x4)=0xe8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001000-0xe8)={{{@in6=@dev={0xfe, 0x80, [], 0x0, 0x12}, @in=@broadcast=0xffffffff, 0x1, 0x9, 0x2, 0x6, 0x2, 0xa0, 0xa0, 0xc, r1, r2}, {0xd2a4, 0x5, 0x1000, 0xffffffff, 0x5, 0x100000000000, 0x1, 0xfff}, {0xfffffffffffffffc, 0xa8e, 0x7fffffff, 0x1ff}, 0x100000000, 0xa, 0x3, 0x1, 0x1, 0x3}, {{@in6=@mcast2={0xff, 0x2, [], 0x1}, 0x0, 0x33}, 0xa, @in6=@empty, 0x5, 0x0, 0x3, 0x20, 0x5, 0x1}}, 0xe8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000b78000)=0x0) wait4(r3, &(0x7f000013c000), 0x1000000, &(0x7f00000c1000-0x48)) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000326000)={0xa, 0x2, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}, 0x1c) [ 86.791309] binder: 11464:11487 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 86.797561] binder: BINDER_SET_CONTEXT_MGR already set [ 86.799424] binder_alloc: binder_alloc_mmap_handler: 11463 20000000-20002000 already mapped failed -16 [ 86.815818] binder: 11463:11483 ioctl 40046207 0 returned -16 [ 86.825951] binder_alloc: 11463: binder_alloc_buf, no vma [ 86.831586] binder: 11463:11489 transaction failed 29189/-3, size 24-8 line 2957 2018/02/04 21:33:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000673000-0x9)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f0000c36000-0x70)) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000a98000-0x48)={0x40000, 0x0, [0x1000]}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000fc2000)=0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2018/02/04 21:33:34 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) mknod$loop(&(0x7f0000947000-0x8)='./file0\x00', 0x1, 0x1) 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = socket$packet(0x11, 0x2, 0x300) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000a9a000-0x8)) 2018/02/04 21:33:34 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000163000)=@routing={0x0, 0x2, 0x0, 0x0, 0x0, [@empty]}, 0x18) r1 = syz_open_dev$mouse(&(0x7f0000864000-0x12)='/dev/input/mouse#\x00', 0x8, 0x80000) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f00006ee000-0x8)={0x0}) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$DRM_IOCTL_GET_SAREA_CTX(r1, 0xc008641d, &(0x7f0000ddc000)={r2, &(0x7f00004e0000-0x86)=""/134}) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000069000-0x18)="ff0204000000000100000000000000000000000000000205", 0x18) sendto$inet6(r0, &(0x7f0000fa5000-0x581)="dd0e801fde44abc11c779f1ef92c7288e58dc7cc45b4335d4a589c74e8050a21cdae9b48aa621c95d4f82880fc62cf012cac86398d17b27f0793e485496bd5636f384ea0963b97214facfb0689d402e780fe6ba088b006000000f6b205885bb69cdd690522cd27f30b0e641fa62fcf34284ebede588ab650387fb7bcb3e964dd4635b6edb6014814b5fd78df7279d94a715d1a53943f5150ab37dee0d891cea9c30cc63d9dc8663190ae67d00cb6b2ea8f4e32672e7707bb4bc0069473261ae4f4ea21f22be38bfd501792ecca53dad17d48735e8a53c433bd3cf72b87ba8e4e1e67add4821b2565187b2176f120eadb7a9c24ad3b5edbe1d8da0949e4369d0f04ca31e89a8241021f68c89de0788dba4c0b8da088eecdc90faa7b40cf1ca651733108f528f89418206aca1256b24af269934e72baff9d537c8a6811ed02a174cd930f1c6bcffff20e187f19de631c5dc38bd96ff28f5a28ab6a0213b3d6ed9fd07cd0fd73c1ece1e46756eb7ae221da3897c3f2e11d30950efd4a9b317e71a81aa13d2e2390339d637f275126a2e481be123e1d1b9f0111530cc39904ece9b2c5f682175a122def7c6e8dc9e386c3660937536ed99b7cc854d54cc52487302d756f52b789ee6da5a8945e5cfed41235297c021c1fdfd67a119a3eeff85a3ff866fe68159cf8a8cdf03d667cf23e22601c7b51b66e637899a7ef430b8161464a62825a193158393d79be3419c01dde728063a52bf8871b0e8938359aac09e390f3230210a62cb45b199bf17bafab6243c2fc5596759b552327e58e9cef3678359ddf8de2aba9d78dc4afc405eab864519344228a90371ba12e029af37d14402adee26a1e1ab3abd2c7c9632e853cbc7b119dc18431d00b447d58505bf59cafd0758141260f76f129bd8efaad6a33ab1d2e532f55e1a298c782e8c8932789111cd05fa87ab53cefad0d5a95979cec6de81d657f3222abc613e62e7316249922a1d00e5a2095cca78a2c747c7c9459af7fec53c8dd6dd927ed5d654848dedb1b47ec173303653494d3f2f10cb7c843cb9c12ba92a766eca3e0abd015f74b9b022f275a191a1ca0f3270077fcf9ae6cf1947dc9b1d221eda4fa440e315a33a411c893738e89b7f5d833a0750388757d872b0451ad56d4dae9f1534422ac09fec9c9f0967f71bbdab4d0459dd6ae86cbb014594b1aebbe8c81b1970d93fba2f9bc2e837bdea5cc9256836acce3138137604bb87e6a58ebe4c2554d07997fd5d6afed8306c5b91949f1750f8faf02a5e805421fe83b41c462f37c92ce7cfd4ede003e2d4bbffe54d4b1b0468b02a7f644e7d5a8aace9a090f649a170f6d496e8a363d65ee63f2f30f8cab7b3d1aeef846745b3893013b3dc661b587770faefb0602ca212a82eb6da1778a6c84b66feac25dd9592a354ea36646e7dfb58a11a3b1f5909294d1ecba941f4e3899f90e020b667ac8f2b6986947fc4d3c2181ef996703d0813ac18e924d8fa288302f45da3a459590ae688d6fe9cdde65fbe2b476ed296d67494e7ca7da2fb9c115eb2c5fe545424cedd434735bc088a95810cc161397b4654c44f7cafb6fcb265419816b3d9129a7d62ce8a1dfbc9f678f1c64c8546eba8e1184a03fdbf13f82492a371a71ead99c3b556e6d185a9d2c4a391e1ea321000000000000ffff57d366b5b23093834fd64f357076dfb3e17e7fbc366fc5b712c8e94eb4e22c647b3ef3852a0547db267294c3ff540a04cb98108aa816eadc7ab910b22ff01f44822479e1a624311e507f648e0668fa733517def9fcde2d3802a5ea8b92145341754d27fd109a13f612c7f49881a8c34ec14fbe92a0afd219c19b5ebf5d2296bc79c9d17a306e86bacbadee13e87cefb2d8eb660b4a8dc7527999f5e2fc6062dada962d3fad5089a7bc14ce36f25c52aa45b10cb1ed5b863f352e9795efe6590503c6", 0x569, 0x0, &(0x7f00004d5000-0x1c)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) 2018/02/04 21:33:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x88) r1 = dup2(r0, r0) bind$inet6(r0, &(0x7f0000d86000-0x1c)={0xa, 0x3, 0x0, @empty}, 0x1c) r2 = socket$inet6(0xa, 0x200006, 0x100000000000088) setsockopt$inet6_udp_int(r2, 0x11, 0xa, &(0x7f000073c000-0x4)=0xfffffffffffffffe, 0x4) sendmsg$inet_sctp(r2, &(0x7f000095a000-0x38)={&(0x7f0000a34000)=@in={0x2, 0x3, @empty}, 0x10, &(0x7f0000f71000)=[{&(0x7f0000f70000-0x65)="470a3747e4d6c6dc7e519c8cfa37b13380c40d870100010000000000a6fa401ca8969a47542c8e2cb000000b0000000000dbf1eedf91d955a9e84c62af9fc4452b9c97c651", 0x45}], 0x1}, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000052000-0x4)) 2018/02/04 21:33:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000a01000-0x11)='/dev/qat_adf_ctl\x00', 0x100, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00004c1000-0xe8)={{{@in6=@loopback, @in6=@ipv4={[], [], @dev}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@multicast2}}, &(0x7f0000a52000)=0xe8) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000adf000-0x18)={@empty, 0x1, r1}) r2 = socket$inet6(0xa, 0x1, 0x5) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00001ef000)={@common='lo\x00', &(0x7f0000ea2000)=@ethtool_rxfh_indir={0x1, 0x0, []}}) ioctl$sock_netdev_private(r2, 0x89f6, &(0x7f00000c2000)="7a8a0e0d0a84ba0cb1d2759b017831a624d766db0cd7f3e031ab43d4e03e3299c4f296836fbca7df2102c8830e01e590c19342ae6a7846654a741f4d83f0121fbc3d60daf72716008b86fe0648c84f88") ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000e1a000-0x96)=""/150) 2018/02/04 21:33:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000274000)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) r1 = getpgrp(0xffffffffffffffff) sched_getattr(r1, &(0x7f00006c4000-0x30), 0x30, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) times(&(0x7f0000cc4000-0x10)) 2018/02/04 21:33:34 executing program 4: mmap(&(0x7f0000000000/0x36f000)=nil, 0x36f000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000136000-0x8)=@assoc_value, &(0x7f0000356000)=0x8) mmap(&(0x7f000036f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000370000-0xc)='/dev/rfkill\x00', 0x200000, 0x0) mmap(&(0x7f000036f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f000036f000)={@generic="58a195669ba5159a9afcdd572265de45", @ifru_ivalue=0x9}) sendmsg(r0, &(0x7f00001f1000)={&(0x7f0000200000-0x1c)=@in6={0x2, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f00001d4000)=[], 0x0, &(0x7f000036b000)=[{0x10, 0x29, 0x32}], 0x10}, 0x0) sendto$inet6(r1, &(0x7f0000011000-0x76)="894495cffbeb6637699df9a82bf2a61adf2e2b6e38efdba9c7db5a374a79cacaf053fb44d8724b56f052c28ab94d90f38d00ff73931183b4978f99a1a025e5f4185fb8dad56a633e12315a951c951b97ed2355013707328049c2dd2f790e50ce74cca0d18c06e7a93fbd765770c644bde86b589bfb6e", 0x76, 0x20008050, &(0x7f0000097000)={0xa, 0x3, 0x8, @local={0xfe, 0x80, [], 0x0, 0xaa}}, 0x1c) [ 86.868931] binder: 11505:11506 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 86.881792] binder: undelivered TRANSACTION_ERROR: 29189 [ 86.891807] binder: release 11463:11470 transaction 211 out, still active [ 86.898840] binder: undelivered TRANSACTION_COMPLETE [ 86.901097] binder: 11505:11506 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 86.904065] binder: send failed reply for transaction 211, target dead 2018/02/04 21:33:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000002000-0x50)={@mcast1={0xff, 0x1, [], 0x1}, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @loopback={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x5}) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000011000)={0x1, 0x5, &(0x7f0000002000-0x28)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x6c}, [@ldst={0x5, 0xf, 0x2}], {0x95}}, &(0x7f0000004000-0xa)='syzkaller\x00', 0x5, 0xc3, &(0x7f00007d2000-0xc3)=""/195}, 0x48) r1 = dup3(r0, r0, 0x80000) sendto$inet(r1, &(0x7f0000de4000-0xa9)="fe109d8e47011b4205e071529e6f9c164e24bf6609bdc1038996d3eb276949c4862f9bd119c50b2a441c93c6c752b39b993aa460877b7e8f20238e0b093cf78a1145eba9e4cd53071bf3cb98370610655500097c3c739f0af997a18340ac18e43330334bba2c9cd9ee988d1fc91f1c680b67bd49a69399199f825762a1e4e2c09ac4a6401e2ce396d2858b2bdba3deea850fc3d3f5c2df9bd2a054318f72af4a2fe31e3bf20dc519e8", 0xa9, 0x4000, &(0x7f000088f000-0x10)={0x2, 0x1, @dev={0xac, 0x14, 0x0, 0x10}}, 0x10) [ 86.952274] binder: 11516:11519 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 86.966626] QAT: Invalid ioctl [ 86.977692] binder_alloc: binder_alloc_mmap_handler: 11515 20000000-20002000 already mapped failed -16 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @random="0690dda14d48", [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:34 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x4, &(0x7f000092f000-0xc)={@empty, @loopback=0x7f000001, 0xfffffffffffffffd}, 0xc) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000a1000-0xb)='/dev/audio\x00', 0x10800, 0x0) getpeername$packet(r1, &(0x7f0000567000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000512000-0x4)=0x14) [ 86.999194] binder: BINDER_SET_CONTEXT_MGR already set [ 87.014746] QAT: Invalid ioctl [ 87.016282] binder: 11515:11525 ioctl 40046207 0 returned -16 [ 87.026948] binder: 11516:11532 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 87.033919] binder: 11515:11534 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 87.042711] binder_alloc: 11515: binder_alloc_buf, no vma 2018/02/04 21:33:34 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000d1a000-0x12)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r0, &(0x7f0000058000-0x60)=[{{}, 0x0, 0x100000001}, {}], 0x30) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000db5000)={0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000165000)={{{@in=@dev, @in6=@mcast1}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000643000-0x4)=0xe8) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000dc9000)=[0x4, 0x14]) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000d01000)=0x7) 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000184000)='/dev/rtc\x00', 0x4400, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000f48000-0x14)={0x7ff, 0xffff, 0x4, 0x8, 0x3, 0x0, 0x0, 0x83, 0x7ff, 0x7f}) 2018/02/04 21:33:34 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000001000-0xf)='/dev/sequencer\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f000063f000)=0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r1, 0x29, 0x100000000000cb, &(0x7f0000a5e000), 0x4) ioctl$sock_inet_SIOCGIFPFLAGS(0xffffffffffffffff, 0x8935, &(0x7f0000901000)={@syzn={0x73, 0x79, 0x7a}, @ifru_addrs={0x2, 0xffffffffffffffff, @empty}}) 2018/02/04 21:33:34 executing program 6: mmap(&(0x7f0000a73000/0x3000)=nil, 0x3000, 0x3, 0x3f, 0xffffffffffffffff, 0x0) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f0000a76000-0x8)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000a76000-0x30)={0x0, 0x0, &(0x7f0000a4e000)=[], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00001b9000-0x9)='/dev/dsp\x00', 0x4000, 0x0) ppoll(&(0x7f00001b2000)=[], 0x200000000000005d, &(0x7f0000553000), &(0x7f0000f07000-0x8), 0x5) [ 87.048365] binder: 11515:11525 transaction failed 29189/-3, size 24-8 line 2957 [ 87.051854] QAT: Invalid ioctl 2018/02/04 21:33:34 executing program 4: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80005, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x3f, &(0x7f0000003000-0x97)=""/151, &(0x7f0000001000-0x4)=0x97) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_int(r0, 0x29, 0x77, &(0x7f0000001000-0x4), &(0x7f0000000000)=0xfffffffffffffdbb) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000001000)='/dev/dmmidi#\x00', 0x4, 0x0) ioctl$TUNDETACHFILTER(r1, 0x400854d6, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000002000-0x4)=0x2, 0xffffffffffffff94) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvfrom$ax25(r1, &(0x7f0000003000)=""/10, 0xa, 0x100, &(0x7f0000004000)={0x3, {"1135c4465aebe5"}, 0x1}, 0x10) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f0000006000-0x8c)={0xfffffffffffffeff, 0x1ff, 0xfff, 'queue1\x00', 0x7e}) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000004000-0xc)={0x7, 0x1, 0xb12f, 0x80000001}, 0xc) 2018/02/04 21:33:34 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndctrl(&(0x7f00002dc000)='/dev/snd/controlC#\x00', 0xff, 0x80802) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000f64000-0x10)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000625000)={0x0, 0x7}, &(0x7f0000aa4000)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f00009fa000-0x8)={r2, 0x4238}, &(0x7f0000ef9000-0x4)=0x8) r3 = dup2(r0, r0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000531000-0x20)={0x8, 0x4, 0x208, 0xb42, 0x3, 0x2, 0xffff, 0x7, 0x0}, &(0x7f0000ebb000-0x4)=0x20) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f000059f000)={r4, 0x20, 0x6, [0x8000, 0x3, 0x8001, 0x1ff, 0x100, 0x1]}, 0x14) fcntl$dupfd(r0, 0x406, r1) vmsplice(r0, &(0x7f0000089000)=[{&(0x7f00006dd000)="f61926f12434bd76d5bf5ce4baf8fee0d8849769e79c2e6f8038207289952cb82db30461ccbdc260b8d1c6450528afc7be6c9f702848c1e46b47475decb7b9fb0f419265b142c99c737a32a8e66e73a14d88a2d757", 0x55}], 0x1, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r5}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x40000000007ffff) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000c10000)={0x0}, &(0x7f0000959000)=0xc) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f0000b98000-0x8)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) 2018/02/04 21:33:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) syz_open_dev$mice(&(0x7f00007c2000)='/dev/input/mice\x00', 0x0, 0x220080) close(r0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000ea0000-0xa)='/dev/cuse\x00', 0x100, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, &(0x7f00000df000-0x4)=0x78) 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = syz_open_dev$admmidi(&(0x7f0000edc000-0xe)='/dev/admmidi#\x00', 0x6, 0x80000) setsockopt$inet_dccp_buf(r0, 0x21, 0x2, &(0x7f000015d000-0xa9)="00176de38a06fc7ff0e60d7fc7aa4087d9a88c8418a38fb8f1e92333198ee1efd0f0038256762f14e6911b95dca8e57f4bc7f1038981bea484627e25e72602a8fd4426d2b71471ed3782fc67c53ee8a067cf1bdb312f374e220be537f927913a46d10163c6b33efb071a79a56b1d7ed59a77962b9639d85d0d2ecd611cf1c5affdf9f5833a5324b2cfb71da64a3b2e27dab890cc93747abfc3416826056132677de6e689c921d535ea", 0xa9) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000e1c000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$inet_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000843000-0x31)="ef0609a69203c9bb5af10a17ca5a7af7f88c3041b8baad00ac3477ba24c9b8eeb6ee472b5fe48e04abce91cddf0f1e6108", 0x31) 2018/02/04 21:33:34 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000008000-0x10)={&(0x7f00000d1000)={0x18, 0x29, 0x829, 0xffffffffffffffff, 0xffffffffffffffff, {0x2}, [@nested={0x4, 0x0, []}]}, 0x18}, 0x1}, 0x0) [ 87.161094] binder: undelivered TRANSACTION_ERROR: 29189 [ 87.173597] binder: release 11515:11525 transaction 216 out, still active [ 87.180611] binder: undelivered TRANSACTION_COMPLETE [ 87.185771] binder: send failed reply for transaction 216, target dead [ 87.213159] binder: 11571:11580 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 87.219179] binder: BINDER_SET_CONTEXT_MGR already set [ 87.226275] binder: 11574:11579 ioctl 40046207 0 returned -16 [ 87.232665] binder_alloc: 11574: binder_alloc_buf, no vma [ 87.238251] binder: 11574:11583 transaction failed 29189/-3, size 24-8 line 2957 [ 87.251517] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:34 executing program 2: mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000006000-0xb)='asymmetric\x00', &(0x7f0000002000-0x5)={0x73, 0x79, 0x7a}, &(0x7f0000002000-0x12)="3a7472757374656475736572566578ad2800", 0x0) mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f000000c000-0x5)='maps\x00') ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$vcsa(&(0x7f000000a000)='/dev/vcsa#\x00', 0x5, 0x0) mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f000000a000)=@generic={0xe0000000, 0xfffffffffffffffe, 0xa368}) 2018/02/04 21:33:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x9, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000b97000-0xf7)={0x0, 0xef, "1c92e93a86e0d8868b21206ee91dddfca401c2ccf5f94eee10326b1a2ccbd2116df6d2a9a54f043bb2d7c380677581a034d13a965e4ede5f45f58d0c580d1f19148f95b809c350bc02fc61a1ace089dba5c4f578fcfe6d29a13b62b1c2f653cb42e4927455cffcce01285bd23abf6728cac2b9ce2d56ab2704327c32019d1ed3e9d6c0c8b8ef3723ba16669ad7e7bbd7d996fab524fd1d5c4fed5079b3dece947ec8d6fa3aefa951c28d72c6374cce7522a9af23dde9fa1961c4b6e99defc8d2995a0df59fdf68ff540f3ec8c95f9193164c9552a5d50fb47e6f552302b65d8096972f220bdf2876e20532bbfdc2b7"}, &(0x7f00004b9000-0x4)=0xf7) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00004af000)={r1, 0x0, 0x8}, 0x8) bind(r0, &(0x7f00008a2000-0x80)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0xffffffffffffffff, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x3a) 2018/02/04 21:33:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x1000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000e70000)='oom_adj\x00') sendfile(r0, r0, &(0x7f0000014000), 0xffff) 2018/02/04 21:33:34 executing program 4: mmap(&(0x7f0000000000/0xaeb000)=nil, 0xaeb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000aeb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f0000a26000-0x8)) syz_emit_ethernet(0x4e, &(0x7f0000aeb000)={@random="830f70e810de", @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x40, 0xffffffffffffffff, 0x0, 0x0, 0x2b, 0x0, @rand_addr, @multicast1=0xe0000001, {[@end]}}, @udp={0xffffffffffffffff, 0xffffffffffffffff, 0x28, 0x0, "2cfc37e64002467a02143f2ba4d6712f74e44a59d3aeb03ca5baa2fcb8a678e5"}}}}}, &(0x7f0000adb000-0xc)={0x0, 0x1, [0x0]}) 2018/02/04 21:33:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xbb}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00002f5000-0x8)={0x0, 0x9}, &(0x7f00008e9000)=0x8) setsockopt$netrom_NETROM_T1(r0, 0x103, 0x1, &(0x7f0000f20000)=0x8, 0x4) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000161000)={r1, 0x9}, &(0x7f0000ef3000-0x4)=0x8) 2018/02/04 21:33:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x1, 0x0) 2018/02/04 21:33:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000d39000)=0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x0, 0x0, &(0x7f0000c72000)=[@decrefs={0x40046307, 0x4}], 0xdc, 0x0, &(0x7f0000ea5000)}) mmap(&(0x7f0000e8b000/0x1000)=nil, 0x1000, 0x0, 0x40033, r0, 0x1e) 2018/02/04 21:33:34 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000034000)='/dev/rtc\x00', 0x2000, 0x0) ioctl$sock_netrom_SIOCADDRT(r1, 0x890b, &(0x7f0000724000-0x4)) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) getpeername$unix(r1, &(0x7f0000ecb000-0x8)=@abs, &(0x7f0000227000)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 87.257082] binder: release 11574:11579 transaction 221 out, still active [ 87.264085] binder: undelivered TRANSACTION_COMPLETE [ 87.269239] binder: send failed reply for transaction 221, target dead [ 87.280405] binder: 11589:11592 ioctl 40045402 20d39000 returned -22 [ 87.291770] binder: 11588:11597 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 87.307772] syz-executor7 (11603): /proc/11594/oom_adj is deprecated, please use /proc/11594/oom_score_adj instead. 2018/02/04 21:33:35 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000ad1000-0x10)='/dev/sequencer2\x00', 0x200000, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0xd, 0xa, 0x4000000000080, 0x1, 0x1, r0}, 0xff90) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000b9c000-0x1d)={r1, &(0x7f0000fca000)='X', &(0x7f0000002000)}, 0x20) ioctl(r1, 0x2, &(0x7f0000b8b000)="ee0fc21a6643d6c9f8c353ad4a00ec7bf7b5a3d472048b18dc6566d11536a6f3c53cdca91cfb372b0e16d9fecb947259e814aea656526eb4bdb9a5be31c5fbd4052713fb92a459971e41b8ef28cfd3c8b3cb23799caa5bfdd5580e26987666f13dad2a86ff789506bea7c0ff28c409d12aedc7a906b1e0ff09ab48fa8e0006d44007453cfc4f15") r2 = syz_open_dev$mice(&(0x7f0000f44000-0x10)='/dev/input/mice\x00', 0x0, 0x3298c0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000dde000-0x20)={0x4, 0x5, 0x8200, 0x5, 0x3, 0x4, 0x1, 0x10001, 0x0}, &(0x7f0000012000)=0x20) setsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000d52000-0x8)=@assoc_value={r3, 0x4}, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f000051e000)={r1, &(0x7f0000334000)="404cb86f94b3de5b9bf6d5a1f1dfd351a40758ce80cb1b24b8bb6042ec94dbab4b348acdf3e45cc185cc3544b5ebc1ff6f2c7200a18088d7a94fe21cfe2c1b767d7236f5f7ebe510413b4aaf18898ab97da2a076fac5090e141098df7ad21881541656e0ce39d6c27e40e1ef67bed3619cd7d1e94b78777c6eba51c5932e792695f63a52e193a797c0", &(0x7f00009d7000)="1b4b747811c57c7f0000002a03cfadebe32564ab1a91fb7fcd95da3f8708ef2e535c2d230d1d3f73cb79df346409bb047afb464b6ab34c90d4b3514909ba4b836769593455bcee8071341aa3fa424200df000080110000f8a9432856401e3d1aec000000000000007f2518c0cef5ca283ace775bec861eddb7cad309"}, 0x20) 2018/02/04 21:33:35 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "85035d", 0x10, 0x21, 0xffffffffffffffff, @dev={0xfe, 0x80, [], 0xffffffffffffffff, 0xfffffffffffffffd}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:35 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f0000af9000/0x3000)=nil, 0x3000, 0x2000008, 0x18010, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000865000-0x18)={r1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006bf000)={0xfffffffffffffee0, 0x0, &(0x7f00003ba000-0x44)=[@reply={0x40406301, {0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x18, 0x28, &(0x7f0000e18000-0x18)=[@flat={0x73622a85, 0x100, r2, 0x1}], &(0x7f0000cd7000-0x28)=[0x28, 0x78, 0x78, 0x30, 0x28]}}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:35 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x9e, &(0x7f0000811000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "c8fba2", 0x68, 0x40000000003a, 0x0, @empty, @mcast2={0xff, 0x2, [], 0x1}, {[], @icmpv6=@time_exceed={0x3, 0x0, 0x0, 0x0, [], {0x0, 0x6, "a99b88", 0x0, 0x29, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, @loopback={0x0, 0x1}, [@routing={0xeb33f5acdadffe2e, 0x6, 0x0, 0x0, 0x0, [@empty, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, @mcast1={0xff, 0x1, [], 0x1}]}]}}}}}}}, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000387000-0xb)='/dev/audio\x00', 0x80000, 0x0) ioctl$TIOCLINUX6(r0, 0x541c, &(0x7f000079e000)={0x6, 0x401}) 2018/02/04 21:33:35 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000e63000-0x8)={0x0, 0x0}) close(r1) sendfile(r1, r0, &(0x7f0000cca000-0x4), 0xffffffffffffff22) vmsplice(r0, &(0x7f0000a92000)=[], 0x0, 0x0) socket$inet6(0xa, 0x2, 0x7) 2018/02/04 21:33:35 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 2018/02/04 21:33:35 executing program 4: mmap(&(0x7f0000000000/0x29000)=nil, 0x29000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) mmap(&(0x7f0000029000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r0, &(0x7f0000010000)={&(0x7f0000029000)={0x10, 0x0, 0x0, 0x1000004}, 0xc, &(0x7f0000016000-0x10)={&(0x7f0000011000-0x18)={0x14, 0x1e, 0xafb, 0x1, 0x2, {0x5}, []}, 0x14}, 0x1}, 0x0) r1 = getpgid(0xffffffffffffffff) r2 = geteuid() mmap(&(0x7f0000029000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0186405, &(0x7f000002a000-0x20)={0x6fb2, 0x6, r1, 0x8, r2, 0xeb, 0x7, 0xfffffffffffffff9}) mmap(&(0x7f0000029000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$amidi(&(0x7f0000025000)='/dev/amidi#\x00', 0x1ff, 0x200) ioctl$KVM_SET_SIGNAL_MASK(r3, 0x4004ae8b, &(0x7f0000023000-0x72)={0x6e, "7101dd3cb6ded766de3d741e0ef60dd2857cf73cff886a3293afae8c3f0a04b477c4ef7b6286a6d3a4ac488a609295b74705d5a7ed2a57287765961a1f11063f5b04bddbd98a76d881ff72dc8800f8abad18949765c7268da97dd1f03e6800869fd037db0e6853d3f33f871ca0e8"}) mmap(&(0x7f000002a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f000002b000)=0x0) mmap(&(0x7f000002a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f000002a000)={@mcast1, 0x0}, &(0x7f000002a000)=0x14) mmap(&(0x7f000002c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r6 = bpf$OBJ_GET_PROG(0x7, &(0x7f000002d000-0x10)={&(0x7f000001f000)='./file0\x00'}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000012000-0x48)={0x5, 0x5, &(0x7f000002b000-0x28)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0xffffffff}, [@jmp={0x5, 0x1, 0x0, 0x7, 0x0, 0x30, 0xffffffffffffffff}], {0x95}}, &(0x7f000002a000)='syzkaller\x00', 0x18, 0x7a, &(0x7f000002a000)=""/122, 0x41000, 0x1, [], r5}, 0x48) sendmsg$nl_netfilter(r0, &(0x7f000000a000-0x1a)={&(0x7f0000015000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f000002a000-0x8)={&(0x7f0000020000)={0x2dc, 0x13, 0x5, 0x400, 0x7, 0x3, {0x7, 0x0, 0x2}, [@typed={0x10, 0x79, @u64=0x8d40}, @nested={0x2b8, 0x77, [@typed={0xc, 0x44, @ipv4=@local={0xac, 0x14, 0x0, 0xaa}}, @generic="991b5cb469eb8baa25aa2535b0fb81f3e91e8b21f8", @generic="e2360b6db91cad82b5aa9be6bb", @typed={0xc, 0x8e, @pid=r1}, @typed={0xb0, 0x34, @binary="bee4e2d0882e394ad9ba4c0ac4ad747ac34054c87166c16dd9b0a23c596f0411b45f76596b2cbc95ba55aeabb1d00952087579f6c4f5eb53aa5f2d375dbb1c95aaceb45de48f609add8f7030ced89de1a40870f6c3f0d020bd2f114a4f46bd10e02415b236cb898647c9494685618bbf440982cd25cd8fcdbe1273c5950121bb06698cc81572d76aec6254f621b196b195be1c2e7117e75614fb9b7cb732d08703537891b4c729df"}, @typed={0xc, 0x4e, @ipv4=@multicast2=0xe0000002}, @generic="965ce2af36b42d1e5536dc0608ce6c70382be9499b9fd2bc22fe4aa9c068ecb277a1981f3475a4cd80302bbd5b4db53315345b07de12383c9da86c57a0314fffdf78d18f188ef7e55a67592c272f90a5a0ca5cc4361bc6587194d428f1e9f34cd8297fa565142d8a68ded013358443e7dbab71d93478ec21939fe1b01cc6953aa0c518a1499a5f1303ed8e8f317a22c930f556a7313aa174b992e6f0f5c5bf53fe", @generic="01f33bbfec6ec673d22e68a55d9badeba7629b5ef95ec41553ba467f919c0cd0e424064daf06ddfa51908eb942220729b63787c3898fb082fde3eaab663f08bf46bc45616229b48fe1584f79d8cf44fcb649fb73fe8da4fd6b42cdf8dc70a298bcdd6700010ccb5063f1f836c1cfa13bee98d81b2d910e3de4970a8f55f5df3300814963a1c978ccc6dbf6f3d3e19be7d334137a07e5cc702de4167b431054a968b9333f65d17b8ecae4f486a7b1ddfe1bdd0c374d994ee3ba07c4e7098e0eca9673d69ece862def85a653dfd8824f2acb9bc4280c5cc7ef9f567cb017e88ea7e5a13208ce15548c4c038192da42574dffc8445bcb56", @typed={0xc, 0x59, @ipv4=@empty}, @typed={0x18, 0x7b, @ipv6=@empty}]}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x1}, 0x20040000) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getgroups(0x3, &(0x7f000002e000-0xc)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000029000-0xc)={0x0, 0x0, 0x0}, &(0x7f000002d000)=0xc) sendmsg$unix(r3, &(0x7f0000013000-0x1c)={&(0x7f0000029000-0x8)=@abs={0x1, 0x0, 0x2}, 0x8, &(0x7f000001e000-0x40)=[{&(0x7f000002e000-0x1000)="12919e523ce505ab6e5d1635a3c9e91eb951d3475a84c54fab8b6529f37c6785efbbb6cef2f126d72bb2ccd1c115e6f6c94e642cac1b5875b8b2ea702a25a9480853d0cda1381c5926ec5c43a12cc937d9b222aa12e9aaed4de92efb3911083d9c19ff09719894895b6316c6b53380e9d3e2a7fdf0c12ba9d77b06e4c3a62c13758aa625bb1423ddde32913948e83bfb90c19ddff7ce12ee43a6e1712912d2d0e4a45202e5f8778646ab9c1264b30a6af2b559887732a66e29d78ae3396a8a25037fd904cab69f30e104bbf58b19f645bb5219acd4d0985d6ede1f708b4c25f6e7273a4f2eb6bf023606baa38c232724fe3a61578d39ef3a5d74eeefda9e225fafb5edc78a2751e3b78d299b6cf4d6f859079462b833cf67b1924a78c26ed94305786fd897f7e314b109f9827841910ef54fdbb8fb52bdbc2ca31de0093b2371dad3b76fe6e4cc3ae4687d974796f56dee7d1e123a91ca126f5a835adc5cf422d45f3c063473fd5c37494b9c25d968b964141612fc4942fef18b5cb2e0e521d85b2cac276d9345cb1840c0601cddca6968ff1c8b98ac81ddfabd024274b5ddf9979323a88bc93eefe6f245a396aca728e9e487ddccd7e004fe3edaa2a3c9e099321724cb89556f5d4c013e6820ad89981c11515f81c2f39fb84c374ea43aa63650bf079071c34cfae414b1c41cd3d686897ddf8254035ead2d8d2e3209223d4735047abc5c4a14c8c4d44c70ef4d7aab5fa7619bdf1fbfb6aade1bd2193de51560598e3332ef0eded005663db8498b7a2ca579afe5114a7be9d6eff64f4b8c8aa012163ac1e7f84498e37eb0aad098894c37b6eebf9ed2c618c718d4e91d6f07fe8cd05af73f3d387086902724c67bae73a8a6978afac3a9e79c723f198c5e58741be3080422216eb1be5c1dc8c6dceb27c0595942c509fd7e03b0ea85c526d2bc38ccbec4b405a7c95700a36e3eecb7abba3d369235b78cd915ed7fb59eea4342e9eef87661603b6815058fd623b3b47bd914158db5fe46d853e5010f4dc0ff23c3360d74a59fd2d149857f37e03536f8ed9fff5f83b290a0c586dbd7efa4ba2adb7fc47bcc8aa458c9a093e6138d30fd8f8cf1ef02b83ea04eb785da79727e2a39ab2b527e4fa0bb65d3a6ec0f83a0687a066304cb4d7cbdef75f28add4073a166f5a766a4148081a47a7c19776f8ac4016aa373b02156b986d2584ecd2f473e39fe401610818954426284c9bf15c80f92ee888dc7a7efcbbaff5395fd0a8026e2813e8e6e0e75b2e01feb80aa9a54a850d3de5bc1df4e12ce9f6659eb37b6bfde303f3d0f00ed66fb9af8817b321450db4b074f8ec675024db2dd006260c116e8c072aa8f92eed524b112581e584f5858fbea42b85f52c6c4c8e675f8fb0ee1280082a8d280168799b301dfd9b729fe3f4eceb9f5829a8fd48cfa3514d9cdc91b962ac89e739982e6691d877e178d9fb1b84b9b5bd089e3326c435cc6adc048215b16465f60043fdfb7d83364118f8f7c982ded451e07ecf2b477e09346d3606f0b772650c531916eb492c66063c9f080e94aabc452420eafd7849f57bfa48f3ebec6ee8879e62b05f6c1a5c9788fee9fd5dd60d5c72c676f147bc2afd575229dc621789ca677f432f8b79d217736269f926650d8e9f84ca2d76e360d353b66be8a95c554067731907f4937f27583ed75cdefde10d519b57fd08415f08330a0203543468dc737fb9375d6a37c10d469bd7f4a6d6d38798b4864cb9fb776cd6a3b61ff0d6327111023e290ac52e322cf3a814348b1d0fe1a388339c705ab7462cbfd1383be9c4cf28f77fa3821cb85870752285f802a4cae6f651ebc72c259768daa2eadfc96389ee9c242670f7b29995d37e8cb45a5395824e0c725f4633452c6890dd28d17f0517272ec5816c93ec0ff6f6afbd9e066f7174a8b816a1b8da46f4464163669aa0caf42bd982c88bd341b30aec9a6c61a34e28bd13a1847a2c89acb275caf7682923b15018b45503df02801caecc61963676a248295dd94199d1b46f80b65596a9dc61ef0e6a598f93dd162fe45e6aabffe03e9ce166639b4bdecb6e4ff5f9a295b17039a442bb892c38fa9c20aee7c93f1fbe60ad3aefd37b7eafc0db97be3ea5aaa33e476390c1e1d3e1abcc1edb239e0af893c7ce408a301ff7abf52499f37fab43104b4f91afc4fadd24da249349f9aa46d785d99e3e26d4779fcb7f16e00706082be3d14c11bb27277ece70c4e5dfd67d0383b621e5c519ae0dfbb4c5c2dd20b26c0a0dc1d6273a19542025427a6c4dd6ca70032e3935a562a38096e72624c6135d10999f8ba3e5dbbe0bfe7bf4ddd78f39f8445ecd0df8f31770d29ab06f9ecbabe364ba7d71e61c7b86c7bb7637547b3f694d118b0adfba0281ab2f8aad21bfceae3f8a7849a8666f2bd5da7681a754abd48a64a2738fb975087bfccd6c5f5c58f978ff5275492c916bac78c02997093c54919a1db3089b1215fb06571c5eab3832c4be424d649514ce6a2742f8c31196af2ab7573dda8d3df11c865e3ca60f9c02ef168f619ceee58cf286254b6cb3946f4372aba1c84f119da69802f320f7a10f46e6e4ca0ec92e76aef6bfa48d42b2176b3e12b56147285500f1e5e80dff77d8a1e85ed96d3de28918b4a76655544edc64c51802e71b418019fa019363cd8a5c9ccb76b9bad7e89b834bb20d2b280f143ccf36e48e98c68dc55205e37a0bb5aae006e862d1677fdbcb363032bdab3e0b29980fa9ea86e9946846b09d5e7330b0d5e10d9b01c669c01fb18efc21ca77e54fe864cf4dfea7c282708b3185c33e2e9d0637e4369aa60f74eda01b850c6ffa8df31bec21fba26c6304a1e3dae711f0b9956910331539ee87814ccdbe96d4861c064823f1d425cb1400d11f5ab2200108ba5b24440a719c6bb8863e7b42e0f2767a626e2d0b2eeb86a52be6cba657d72adcaed4ac547fb0757fd722b181a4ebef2a525379cfa4b624dd9c6a47cb9a15b82d2ff6a71d033720249ff0e0a1c746193c286ed1093317230c2452b975af9e7e048a02d01bf5662353e3bbda3b4353eacaf25b215a9367b27342b805570bd0505e7a5e1bfd674752bb21dc507d8f6bdcd5cc0200df5324918e0360e529a54bdd0fcf49b33eb70ee6d2a2fe7418f333ef0f26b30da546f0b745e6550f7eeb1184cb9c5a9afbfa963e874e52b0bfbb828d6a0420d75e0b78aa254d3ee730ffc4b50b7501f89d826a27d93bf65f0a505f1244a048da4596e50e022e6e8d8d451400845fe08a61000ba59a9278740686ba65ab2ddaedb912ed892924d58ad44c69e1d8ffab9ace76cb6446ceb2e0080af961388fb76fce7a6ac6dc8c25dde9c469aa3167c6e88e9e1edd77c66f7bee7ac4cd1f5b0a73d50e1fcd7e6135f07cb4a65ca89dc54dc696259d585791064dd4f31119b64241f1a99c0e265714a38b4a9a3acf94f1144fc1325e7217d00ac77e770e7303eb953442683948933fdbd84631542baf393fe3687be948e468c533f60a00e502a65504bec0f8f87616bbfe75900f65b8d18af640da3c6953017d0e8327d0bbb01ae36189cff8347ab85e766aab8965cce5985729d6beea680ada153c296cc4a56f88d231eab0d8668a798fcb26401fdfb20f3415b6a69cfe5029057284fc75439ddf3223827c20cc183ba23523b0ad9f646583c887cb2944a9e1faceca5d0db511973d3ad9d0062a99aa01f8b49eda48c2dca9acf1ec13aa4acca26fd06ff25569ab1e59b21fbe972111abef737f1833af04e56169d843acec88d17f3b20cf16cac07ca21ccab93f13376e150fcfcfee52a6c1b22f1bd5591896487739b48d130ec0c905f61ffadc6faba4dd26943e69aaf8a87b729cd93983e1931e6f6d8c9a8042630a9b781d9b9dee64d2740e9ae7e2b24a6ae224eca450520f42606af1b0ea2c2e5e034d8f21685888dee3764b09cc184ab8dc7b2a10cb35edd237715567ddc4fb8bcb54c24b4d248f6119393c0e689e3fd118cd53c6eaa37cc3aa3566d2ed675634dcfc8ce20dcf0416f75098cfde99d9d86209ba738cc7f724c29dc4de76b2710c62ad18682beae1cf83c5d21fadaf29a752b30bfc7993fa610af94f131318639ebb041a7237c801b67054bfe2efcaab19ff4ca2270b37a856551eacf3215817d2fa92fd2937b0c53b6104106aa18947481663997c2f1b325786384f775e11112c890ba80b36f26ab2217b1c540b9d5ed7e36dd66a585e1669aa35ff38ed8ff6c838e0fe1f2a0096497b180b41e846d89897e3dfaea1dbb357f38dc4ed39d46be669188bf157db9c998d3fffe2c539fd50bc75656f3c2fc6ffed568a36af006ab2f2151e59eca37c1f3663208ea7c12d677504493b00812a9961fe3bd2636d5d00da11337a82d9190cc30ffe385dd3b83071364f9e6f1c523bf7a310b3a3401399c0967472d20332a2ae285aaa66cdec47cb4d05134241170b3c487b31a88fe104582b298676096f20a12ad8f122572e2a3548026aab3d3a96b2e5985dc211ee2d861018ba62ad7cdc16f2ae0168b510afae23d7a70b328f8f987ec92201deb411181c8e23163113f6e66081124407ce13189ca5f2d7d9623b2213d085ff19e710e79204f77bf43d89e8c2799e4dd2e160a07c9dea97fb7fc17a4a2ec61254f8f5635122f2d60ff0c327b37c1783fb869b024e6194979052d65e1a52feb39e3fe360a751d50ae10cfd942bc0352f577bdd4fcb5e923b8fc1eb8cb2fda0d11acbb8ef82afe71975639ea80ce62e94bdc83f35c6b583cc822b8967b4b0e8648c21bb7df067a7e6e7fb35a242bceccbfdf8f004eab74fa8cfd56a13f390386f5259a79c8d885237c1a230446856d3dfd860f9d1bbf20439e2cd096617fdb668888bfb16b23a0039af4431f75bb576e79bea50374093a58259c23f69dbd124c3d9c1834cb68c0381fcf203556a8e76d13b8606d4141907c710922ef03573942ab7967917330eddbae99fe29fe1f6b0409a33d65d99b9003f245a92a885c59af665a5dbf39da5c59b6d36e0d58aa4c04f59ad0f58fccd520e186776fb773aca38a5280f96aa599896f25274417a6e5e9c026613514701aa23215aa7338364adb5261fa4be4dda78a2d1d94cf387f4d5f7b9b363acbf2141c2dcdd571c6cfa200300a43147b1c80d6f692ba8b957a7861251ecde30e36f93c7bdd7e89c2c795bed36a0eb15234493f324df0bdd448247f99cc9ceabe5b898e3526b142e704aba312ce94b0b052674dd52ef801964405b8a10b8fd316640991c8beb3bd5080f58c70b35baf6bbc365a8b50c7067c48637f2a0218cc051d9de44a9082e5bc09c26f6c23fee31fdaa8f1126414349c926a5fb58d1dbc119adaa0af57052d8383fb8c23ec7c9f676541bbdabf0719556872e50170543ffdb44b0f81aeccf5faebcb6af036ab51be72fd383220f5de77c897ec1f6c8409c4c9d2172093d749811f05d7873234da5564e8dae60ab3369bd21a2709686b0215c28627422a34387124e073ae0af26b4cfa1f751b39ff51a88847e2b999ba68fb9565fadc24f89b30c565b1442455d8592b87a74c4bb7c045c5198a35913e0b663c58023b5006bcedae55362c555a9415bccd20e56e1031114aedf78096c1f01c098f306f8dc5734ca4cb4d7bbdc36fd990e378117c18d7e81e4db56bffb4a95adfb7c357e2f1073f7fce59a4c57ce0a58b4019fe6d94c96b2a47c0f57bc119a23f1e461de3fa75b477f9f3e7743f89dfb29d7595f2777be8daf1744bc8eff0a8a1bd6758fdb5a4d667b5b0", 0x1000}, {&(0x7f000002d000)="bded6adfa2e4239ee159de2351a3ed934eef6f42540ff836b10a436687fef73ab1a580b11ebdd568ed240f7ac4980e75e667da208f343b93f48180826728a5dd711c3cfab0378ce2bd29d50d7e008237211b00fc93a8b6c4552bd2343a93250d951fd51f03690f4215ae26d7a659694973cdb9bcf7bfeff690a06cec30dd23e80dc6851fd01f3e3b3a0dd1d1628f258629d8faedbbe0d600b34a1e01c3ab3d0d9cdf86c22a185bee", 0xa8}, {&(0x7f000002e000-0x6c)="49a1d1a5d3cd5f558f06db9e7edd211f7ab106dea41fea1148a0c54f64fe682541b03a3c2f1a763fafb07ccd17cd5a8f892c716c0a8cf37515e490baba309afe764855ede944663349b0c7fbde676128a6775aaddffb49b71f0331ec39e6e0b299e6ab3d45a137fb6287a12d", 0x6c}, {&(0x7f000002d000)="34c3c73b3f01d35788ab8ba010bfd083440f91145255d8b74b4058647a47fbf663", 0x21}, {&(0x7f000001d000-0xa1)="419a27a88aa405d983f1d6a7255928819debc7a63178ae28190cb8d0bef4355a4d21f1711f7e5c424b3fb94457efdfac3f69f74deb2f47ed36580c80afcd314eb3c3702e5ac211b7aad45733f2e66f3408af540891631caebcdbc3cddb20a69ff433ed0c895e489504b7bb2ba7d37297bbaabac5482153774a16c121fafd2c7a1aab0d4f4ba0b80913b25e85174236a65b3a17058d74a59a2abd7fd5c5f6095000", 0xa1}, {&(0x7f000002e000-0xbb)="0e4ef0507a497afc3afc813b8931348608ab58c2e522e6d16155e24c2199e64993d361dc50d13a64a2532ca92743b0bb938ba52f7a8c377d5f9fa58f2bf3cb74214741c33bd702e6825de5cdcc3d238493f7340f0c23c22f8ae8485032341b4ad9c510ebe70ca0311ffa3f4fcb7ef15ab65b9d96f750e24793603fd0ea4513d28c4b6bb0a6630de4a59ca230e9a7d0899fa9d33db17e0995605e5e26ccb5d8535768fbf01af696350c6e43f8abc14f44923a12fcfd116302ac2fb9", 0xbb}, {&(0x7f000002d000)="f2bb3adc4605fd3ba79b87dca3d1df8a1bca3e4be1393cf348b7bf13ca085ed0794ff06f2a6a6dcae537116afc46db4124f6448f826e2508bbc62b5a5540c882766b8d4ca55cefcf033ebbc527e17511d90f119c8e87e65a82fd26999677f63a7774f4f9938bf5b331b7e4e927c017c36ab34d13e22e755a4eb39bcc6f76a7af23b8cc5569b7bb52f49f4f56", 0x8c}, {&(0x7f0000010000)="ceb1d16e35a7e28fd9f873c95e87f7541e926d7d65fa0c0695bd31f8172e1282ac016c874694eb9c7bd61a4281b8b8d73a69f483413495837f8ec3c77117a664978e6c9f736d9f4de678f32bdc7448e049702c174d42935cea3915aa672519529b535f5eef8dae3776a695eb8250c729c78311b9215739e59f97f65f19599977a6ff740b9a3a3b5789c88cf9fb222d21d65a8382a3d018e932", 0x99}], 0x8, &(0x7f000002a000)=[@cred={0x18, 0x1, 0x2, r4, r2, r8}, @cred={0x18, 0x1, 0x2, r4, r2, r9}, @rights={0x1c, 0x1, 0x1, [r0, r6, r7, r6]}], 0x4c, 0xc0}, 0xc000) 2018/02/04 21:33:35 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f000047c000-0x13)='/dev/snd/controlC#\x00', 0x5, 0x2000) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f00001ca000-0xc)={0x4, r0}) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000c53000)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r0, 0xc1105518, &(0x7f0000ebc000-0x10c)={{0x10001, 0x0, 0xfffffffffffffeff, 0x6, "77d2e940e26bd2c8783baeeb59ccb7212f19bcc5046976dd450bbd1cd08b1e3b5104f9d0c2c197e6c3122c33", 0x3}, 0x0, 0x0, 0x6, r2, 0xb99, 0x3ff, "49d69f32a54d69ffab805c6e3bbbf89520be24162424777846f60dc5d86befb1581c0d6c0a628737f08e404bd6c18d9edc8d17a630f9e7a1a70e320b450bcbab", &(0x7f00007f6000-0xf)="65746830293a766d6e6574305d9d00", 0xf, [], [0x2c14, 0x8, 0x100000000, 0x4]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000c48000-0x14)={0x2, 0x4, 0x84, 0xf}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000c68000)={r3, &(0x7f0000451000), &(0x7f00007f8000), 0x1}, 0x290) [ 87.335316] binder: 11589:11592 ioctl 40045402 20d39000 returned -22 [ 87.357165] binder: BINDER_SET_CONTEXT_MGR already set [ 87.366270] binder: 11588:11597 ioctl 40046207 0 returned -16 [ 87.367169] binder: 11588:11615 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:35 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() ptrace$setopts(0x4206, r0, 0xdc, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) 2018/02/04 21:33:35 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000108000-0xd)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) r1 = syz_open_dev$usbmon(&(0x7f00002fb000-0xd)='/dev/usbmon#\x00', 0x3, 0xc0200) setsockopt$RDS_RECVERR(r1, 0x114, 0x5, &(0x7f0000e48000-0x4), 0x4) 2018/02/04 21:33:35 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f000089a000-0x16)='/selinux/checkreqprot\x00', 0x230002, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f00006da000)={0x0, @in={{0x2, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}}}, 0x4335, 0x1, 0x2, 0x4e7, 0x101}, &(0x7f000005a000-0x4)=0xa0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000bfa000-0x20)={0xf3b4, 0x7, 0x0, 0x7, 0x6948, 0x20, 0x0, 0xa86, r1}, &(0x7f0000f99000-0x4)=0x20) r2 = socket$inet_sctp(0x2, 0x5, 0x84) capset(&(0x7f0000000000)={0x19980330}, &(0x7f00004b9000-0x18)) getsockopt$inet_buf(r2, 0x0, 0x61, &(0x7f0000605000)=""/40, &(0x7f000010d000-0x4)=0xe) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000533000)) 2018/02/04 21:33:35 executing program 7: mmap(&(0x7f0000001000/0xffe000)=nil, 0xffe000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f00005dd000)=@abs={0x1}, 0x8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0x0}) r2 = mmap$binder(&(0x7f0000cb2000/0x4000)=nil, 0x4000, 0x0, 0x110, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00005b6000)={0x80, 0x0, &(0x7f000022c000)=[@decrefs={0x40046307}, @free_buffer={0x40086303, r2}, @decrefs={0x40046307, 0x4}, @increfs={0x40046304, 0x4}, @increfs={0x40046304, 0x2}, @request_death={0x400c630e, 0x4, 0x1}, @transaction={0x40406300, {0x4, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x40, 0x30, &(0x7f0000001000-0x40)=[@fda={0x66646185, 0x3, 0x1, 0x40}, @fda={0x66646185, 0x9, 0x3, 0x2c}], &(0x7f0000000000)=[0x28, 0x0, 0x78, 0x78, 0x38, 0x48]}}], 0x4f, 0x0, &(0x7f0000ac2000-0x4f)="ff0916ce4801d8f66ae7975ab1548b4bc5f15b8b52d2897dbddd3f6953042c135b435689e43f2e5863f3404eb0cba672b1462f5f9b6d06313d39eb05ad54e0a9d36428bfe995a625a3f092b0e94c0f"}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000001000-0xa)='/dev/vcs#\x00', 0x8001, 0x200040) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x17, &(0x7f000074d000)=0x5, 0x4) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000001000-0x45)=""/69) listen(r0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000788000), 0x4) 2018/02/04 21:33:35 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) r0 = gettid() getpgid(r0) r1 = socket$bt_hci(0x1f, 0x3, 0x1) openat$selinux_context(0xffffffffffffff9c, &(0x7f00005f5000-0x11)='/selinux/context\x00', 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f000058b000-0x10)=@generic="03684bf151977b23aaae996e017fba94", 0x10) [ 87.420209] binder: BINDER_SET_CONTEXT_MGR already set [ 87.441014] binder: 11626:11628 ioctl 40046207 0 returned -16 2018/02/04 21:33:35 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000cdb000)={@syzn={0x73, 0x79, 0x7a, 0x0}, &(0x7f00008ab000-0x14)=@ethtool_wolinfo={0xa, 0x0, 0x0, "22c8fa674307"}}) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00009f7000-0xf)='/dev/sequencer\x00', 0x480, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f000061d000-0x20)={0x6, 0x8, 0x8000, 0x100000000, 0xb544, 0x993, 0x1481, 0x350a, 0x0}, &(0x7f00003eb000-0x4)=0x20) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000b00000)={r2, 0x3}, &(0x7f0000001000-0x4)=0x6) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000ad9000)={0x28, 0x0, 0x0, @reserved=0x1}, 0x10, 0x80000) 2018/02/04 21:33:35 executing program 2: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x80007, 0xa0050, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000b17000/0x4000)=nil, 0x4000, 0x0, 0xbd, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, &(0x7f00009ed000-0x8), 0x5, 0x2) 2018/02/04 21:33:35 executing program 0: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00006d9000)=0x0) r1 = getpgid(0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000bfc000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r2 = open(&(0x7f0000278000-0x8)='./file0\x00', 0x101000, 0xc) kcmp(r0, r1, 0x5, r2, r2) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sndtimer(&(0x7f0000d2e000-0xf)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000001000)={{0x100000001}}) pwritev(r3, &(0x7f00009d2000-0x10)=[{&(0x7f0000f5c000-0x28)="dae86beddf0a2968f590fddf17c06ed6478bbecdb5f804b4c5ad6f8f6f58db1366c2889f036b2e85", 0x28}, {&(0x7f0000cc3000)="6378eca71e5f405200b499efc60005d1ccc490e1cee252f1673e4ea226a6ad0fea3919a8abb67898be942e3fa1d51f048efd40aead5f1857", 0x38}], 0x2, 0x0) fcntl$setown(r3, 0x8, r0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f0000aac000-0x50)={0x0, 0x0, 0x0, 0x0, 0x2}) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000884000-0x10)='/selinux/status\x00', 0x0, 0x0) [ 87.489722] binder: 11644:11647 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 87.494873] binder_alloc: binder_alloc_mmap_handler: 11626 20000000-20002000 already mapped failed -16 [ 87.507317] binder: BINDER_SET_CONTEXT_MGR already set [ 87.525076] binder: 11626:11628 ioctl 40046207 0 returned -16 2018/02/04 21:33:35 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000a66000)={0x2, 0x0, @rand_addr=0x7fffffff}, 0x10) listen(r0, 0x3) r1 = accept4(r0, 0x0, &(0x7f0000b6e000), 0x0) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000fb4000-0x1000)=""/4096, &(0x7f0000330000)=0x1000) 2018/02/04 21:33:35 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x6, 0x7ff) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000ecb000-0xc)={0x0, 0x2, 0x20}, &(0x7f0000d94000-0x4)=0xc) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000619000)={r1, @in={{0x2, 0x3, @loopback=0x7f000001}}, 0x8, 0x301d, 0xfff, 0xf37e, 0x4}, &(0x7f0000a97000)=0xa0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = getpgrp(0xffffffffffffffff) sched_setscheduler(r2, 0x1, &(0x7f0000977000-0x4)=0x1) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000064000)=0x4340, 0x4) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000787000-0x4)=0x200, 0x4) [ 87.541449] binder: 11644:11657 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 87.545420] binder: 11626:11641 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 87.574719] binder: release 11626:11628 transaction 227 out, still active [ 87.581815] binder: undelivered TRANSACTION_COMPLETE 2018/02/04 21:33:35 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000002000)={@generic="6b0b9e0000400700000000000000082b", @ifru_settings={0x0, 0x4b, @te1=&(0x7f000000c000-0x10)}}) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000e78000-0xc)='/dev/autofs\x00', 0x406200, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00006df000)={0x0}, &(0x7f0000146000-0x4)=0xc) fcntl$setownex(r0, 0xf, &(0x7f00004fa000)={0x0, r1}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000003000-0x9)='/dev/rtc\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r2, 0x4028700f, &(0x7f0000002000-0x4)) r3 = getpid() fcntl$lock(r2, 0x7, &(0x7f0000b9c000-0x10)={0x1, 0x5, 0x5, 0xb60, r3}) 2018/02/04 21:33:35 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x4, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000210000)=0x2, 0x4) writev(r0, &(0x7f0000da7000)=[{&(0x7f000027b000)="723151e3", 0x4}, {&(0x7f00009ab000)="fc7a48f1736ed58d6584b046c2aace", 0xf}, {&(0x7f0000a62000+0xcd4)="c777812474c9a20ecadd581961b01de11424e3051f85f1b10d4d897f902d603502ea9c39e1a07b3901def092d6d8973ae1430a599ce08f0e3f489dc855e2e098cc7f", 0x42}], 0x3) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000ae9000)=@req3={0x1000, 0x5, 0x0, 0x0, 0x0, 0x4000}, 0x1c) 2018/02/04 21:33:35 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$mice(&(0x7f0000498000-0x10)='/dev/input/mice\x00', 0x0, 0x30002) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:35 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000001000-0x8)={0x20071026}, &(0x7f0000000000)) r0 = socket(0x1000000010, 0x802, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00001ea000-0x10)=@common='vcan0\x00', 0x10) r1 = dup3(r0, r0, 0x80000) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00004bb000-0x18)={r1, &(0x7f000022a000-0xe8)="d43bbaa940fb3714671f178b2d59ef108f5adee4b8e8c2c1879c4a1507c3d5e16e16eac2168100b538155b177e97bba35c2ec4a6f0c6fd98340318f31ec82ac5073c3a9359ef106c2963842d25a1b71e37fdf844ec14c912c80fa796b1256b9974a359e5b0c7e2283a81d37f59e11c8e1862e616e44db00e227986c0720059d115bab0a8017da308a00cfbdf62f9546711c241c03340c404ef0b914e42897d25e6482d32b31a61f69a4441ce6e66153fd869c715c6f08d65525a0fe6c5e6df6ff006f62c37098b456f4b90f4cde5d1b07deeeaa78e14990a853ef191e377c638064baa0ad8199153", &(0x7f0000e82000)=""/82}, 0x18) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000985000)={{0xa, 0x2, 0x9, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0xa4}, {0xa, 0x3, 0x6, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x8}, 0x9ddc5cb, [0x8001, 0x0, 0x5, 0x3, 0x3f, 0x1, 0x0, 0x100000000]}, 0x5c) 2018/02/04 21:33:35 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000de9000)='/dev/admmidi#\x00', 0x1ff, 0x0) getsockopt$inet6_dccp_buf(r1, 0x21, 0xd, &(0x7f0000c15000-0x37)=""/55, &(0x7f0000dd0000)=0x37) mincore(&(0x7f0000cf4000/0x2000)=nil, 0x2000, &(0x7f0000e71000-0x3)=""/3) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:35 executing program 0: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0x80dc5521, &(0x7f0000fed000-0x1b)=""/27) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r1) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f00006bc000), 0xfffffd1f) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f000039d000-0x1c)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r3, 0x0) sendto$inet6(r1, &(0x7f000037c000), 0x0, 0x20000004, &(0x7f0000b23000)={0xa, 0x2, 0x0, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x0, 0xbb}}}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000d4d000-0x10)=@syzn={0x73, 0x79, 0x7a, 0x0}, 0xff9d) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f000023d000-0x8)) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f0000c44000)={0x7b, 0x0, [0x5, 0x2, 0x81, 0x401]}) sendto(r1, &(0x7f0000f1e000-0xdd), 0xd3819432a973de7a, 0x0, &(0x7f000044e000-0x10)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}, 0x10) 2018/02/04 21:33:35 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f000050d000-0x50)={@common='bcsf0\x00', @ifru_addrs=@llc={0x1a, 0x1f, 0x7ff, 0x8000, 0x4, 0x10000, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000a76000-0x10)={0x0, 0x0, 0xfff}) ioctl$DRM_IOCTL_GEM_CLOSE(r0, 0x40086409, &(0x7f0000d38000-0x8)={r1}) r2 = syz_open_dev$vcsn(&(0x7f0000985000)='/dev/vcs#\x00', 0x1, 0x404000) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00001dd000-0x540)=@security={'security\x00', 0xe, 0x4, 0x4e4, 0xffffffff, 0x304, 0x304, 0xcc, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000a07000), {{{[], 0x0, 0xa8, 0xcc}, {0x24, '\x00', 0x0, 0x304}}, [{{@uncond, 0x0, 0x110, 0x238, 0x0, {}, [@common=@dst={0x48, 'dst\x00', 0x0, {0x6, 0x1, 0x1, [0x1, 0x3, 0x7, 0x0, 0x100000001, 0x81, 0x1, 0x2f, 0xfffffffffffffeff, 0x1, 0x6, 0xc1, 0x1000, 0x5, 0x3f, 0x8], 0x7}}, @common=@unspec=@connlabel={0x24, 'connlabel\x00', 0x0, {0x6, 0x1}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x36d8, 'system_u:object_r:modules_dep_t:s0\x00'}}}, {{@uncond, 0x0, 0xd4, 0x100, 0x0, {}, [@common=@frag={0x30, 'frag\x00', 0x0, {0x48, 0xd4b, 0x1, 0x20, 0x3}}]}, @common=@unspec=@NFQUEUE2={0x10, 'NFQUEUE\x00', 0x2, {0x5, 0xfff, 0x2}}}, {{@ipv6={@empty, @loopback={0x0, 0x1}, [0x0, 0xffffffff, 0xff000000, 0xffffffff], [0xffffffff, 0xff, 0xffffff00, 0xff000000], @common='syzkaller1\x00', @common='sit0\x00', {}, {0xff}, 0xbf, 0x1, 0x1, 0xc}, 0x0, 0xa4, 0xe0, 0x0, {}, []}, @common=@unspec=@RATEEST={0x38, 'RATEEST\x00', 0x0, {'syz1\x00', 0x6, 0xc00, 0xc000000}}}]}}, 0x540) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000b6e000-0x38)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000328000-0x98)={0x2, 0x400000000000003, 0x0, 0x2, 0x13, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @empty}}, @sadb_address={0x5, 0x8, 0x2, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x6}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}]}, 0x98}, 0x1}, 0x0) 2018/02/04 21:33:35 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0xca7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000e8a000)}, 0x0, 0x0, 0x8000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f00000a5000), &(0x7f0000002000-0x4), &(0x7f0000001000), &(0x7f0000911000)) r0 = getpid() migrate_pages(r0, 0x10001, &(0x7f0000928000-0x8)=0x10000, &(0x7f000083a000)=0x5) [ 87.587158] binder: send failed reply for transaction 227, target dead 2018/02/04 21:33:35 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b"}, 0xc) listen(r0, 0x10001) [ 87.648874] binder: 11685:11688 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 87.680262] binder: BINDER_SET_CONTEXT_MGR already set [ 87.681940] binder_alloc: binder_alloc_mmap_handler: 11677 20000000-20002000 already mapped failed -16 2018/02/04 21:33:35 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000b79000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt(r1, 0x100000001, 0xd366, &(0x7f0000207000)="d185e70767e1449b7410cf6896cb15f0c296a84184b2d3a81f52455b74b5f07800180fa30c271b1ee1acabf8e0fa5f6e97b423fde3b06e68154ab319ddcd1f1e2c417cf2bb5bd6351ac631a17dd4e70b021ee5e6cac8c5507d1d1424eaa6ec31f10533f10cd33732bec9115fba2121e7f1b23b4d6555d4932b9f81457bbd76bbdc741713fffbf501e83177274bed", 0x8e) r2 = syz_open_pts(r0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000303000-0xa)='/dev/ptmx\x00', 0x0, 0x0) dup3(r2, r0, 0x0) unshare(0x400) pselect6(0x40, &(0x7f0000f34000-0x40)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a66000-0x8), 0x8}) sysfs$3(0x3) 2018/02/04 21:33:35 executing program 3: r0 = syz_open_dev$adsp(&(0x7f0000d52000-0xb)='/dev/adsp#\x00', 0x80000001, 0x200000) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0086426, &(0x7f00004b2000-0x8)={0x3, &(0x7f0000000000)=[{0x0}, {}, {}]}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_DMA(r0, 0xc0286429, &(0x7f0000001000-0x28)={r1, 0x3, &(0x7f0000001000-0xc)=[0x7, 0x9, 0x6], &(0x7f0000000000)=[0x8, 0x8, 0x800, 0x7, 0x7, 0x2, 0x4fc], 0x0, 0x6, 0x5, &(0x7f0000519000)=[0x531, 0x2, 0x4, 0x7, 0x51cca97b, 0xcbe3], &(0x7f00001d1000-0x20)=[0x9, 0x6, 0x100000000, 0x1, 0x49, 0x14c000000, 0x100, 0xd8d]}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000c2f000)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) prctl$seccomp(0x16, 0x1, &(0x7f00000fe000)={0x0, &(0x7f000014d000)=[]}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f000095e000)={r0, 0x0, 0x1000, 0xc8, &(0x7f0000c04000-0x1000)="7205f98a5a802b9dfd9dbfb39e66e2cf33325c1993168abf333d223c1d61b32a4ddb1225741e5dcd7604115cc108962dceffd225bd1cc5731a7eb64a734a873ca9ea7c2a4a286978aa079185b37442ce7b7237c1416fc190b9f9c64730dc3d48f329c7392f257c4b47a3f15aca29fcbff7f68b1a1ede0159df214b815357672986198ac44ac4ecb758bd868acca7ff1c38e4a82374ff3f65bab9fa012c9c3ccb2810b34f3082881f5efe98f2c85c268a3832c2d5c626cd483779aa8146a85bb52f85b35cc4aa5fb87e0c3a39cc2f19581e1c5f0718d9fa03bacaaadfe9ab2ff87b12e9fa574b1b3a54448dd2b9bda7deeafff23d52fcb13fa7fb854efd0dcaaae4284da9edd368643e63c3a4aec14bf504a0662e8d441d657f9d19f8b57c5674a50cc997fbd621e45c13cc307c65ff7b802fbbabf2f44e56ee157ae6e94a6880fa4d5f4d15b62acab2cc013e2ea808e0dfffefdee5dc7fc6ed0518cb631e96133c8237659b14e64c8dafe8ebf6bb31d5b215f14ef8e9f3aa667fdced1669416476bd4daf28e89aa15d5415561f42ce50fa5452f2687d35eeef287cbaff5ed8aae8d756f7d187988de17de0637addfaac1de7d475e237c93b16940de79b9f66235fa330a6fd704c28ee9da376637e4c44c0f02f687746cf605a1a332337aeaf0078973e7e8c1f1e04662c87cc1834ddf426e6267e9d39943a9e59fbe466e56822c75637c33b1209522241dc4c823f6469ba539e43f7f2aaa4866b55bfb84346c504d5199d251ece972c78e3c52c9efbee15aef0a6dda8c6e1c1e80adf09f24034d77bba40db0d2780392f47ab5879cde0b0c2260ed174d5089ba56d7500a51c7be5d88a495f117a7c64acb9b63146edca45999cca7c26d41989afec064caae57fb0c53a666c55b669ae77db9ef6ad97106449e30acbee5cb41f139e89a0a67f783b767f9c1ad1f6e0f581ae302f412c541c1f98986692175186a8c4103fb726edd5e420039a5f8210df08efd710985e5d19eabe4e84feca2b4a391ff6cecba8d25e4bb47a2d64fd271ee1a4ffcb37cbe8e521bbb37ecb84d8be602db46955ff0505da3657012659f239374bc3408c6fa055892cfeea095a41cbcdc223f4ddf493ee6db062ee56aa28b0c1a522eed19c65e163dd317620218861d757cd715b977701ffa948f1f8e21b264fbac49db0d12b33c9b90d3d8d4dcf7cbe7d44b92324b208fd6c14e13ad9136c5f491b374b9b201b4c07178e7d76f91a7da46e3288ba93d60f3098a19d0b302d56e0686c4c2565af6c702d5abbaca57e295dc5e85e2d925dc396f9c1f6b80e802152cd31a9865f782a5564789a97e3e50d4c114ec55569d7538434ad4cdfa5016f93bbcb718dd903c63319ec8e09e990bcf5054152fdd41b6799e6371e9f2780608f3e399c1ba227b03d1cf86352ec509b9ba45ea3e2b3bf3c188d3a165866569ec4a79163011decd94f188ecb616f87471ee763a6b0ce438530296e363249df6e4426a14022b4841ed628a8bdb70543e3e4dcd19ed214fd20e26950942587b5e9a470014e50bd5e277d468185338174223321a905d399816b8df51f46df7010580b00831d8cdf06a64163078bde607fc11e025f7d119ff634e92c355c14a371fd43d10d2e77d041c7b60d40677fcc193836ea5aac80fce069ac4c3a813be5d4c6d4b63fb53edd5484d2686d97fe53b3ee9653724e246c370274b475f317fb8f9fc47d573c909b02741e015b81666954ed75e065b0f03d9e3d2c9f6fa2f7b8606b5aecb3d862611dfe7265d493d3bf3b1fe930e4b9155719a64d58eeee43476dfecbcae68bf8fed357d47f205168df0e1aaf035fb851d6010ddcea7810dc4177761e2f80c104cab802d4b42738617c82fe6512f1491381ff3898038ca6e5d5e6e8e3b0149c86b836b8d36035d56de3e8e29d0ec501545598947f7f6cda786db8c0e573ad18a52822ae6977fe7a88ab3dd37cffdd78b07b4cb6092fbab2b48e2224e40dd4fbe3f202d3665f4c56e5757bc9cbb42ca4a578cfea0fa8062382a61bd4fcd39b2bd8b3c69a77ead98851b8a4520a8eda636747dbc099b4a247ab6bb3fd0acd9f0e6e40b83f1a0231eced3179340df70612cf67ab330cbf9e66b294bf3556e12c8b169fa90e6a865b1b4776e2be31434ae06ac025b4f7335b8ca154e08eec1bd96b188e816e0bc6f285d22855b90f1a903bf4cf52578c81cbfff76a4ea1d67a75ec91549d3427c87981f96cfd6d7c5f817d961f3152e80bd3c760e2dd123c9faf0cec3a323d559066df923571828c4254f65045f44f450d768e3bc381ac8a2e72c61e412fe8ad0d4acd4affb4d6a8491a5ee7e9ae53d7d8ad31c4671a81f91d40002d359923dfb2ed71b7f7710601b5aba710e013e43db7f471de9a5e1f39cc037c6203a04d30902d3aa4f7c84ff5a5d86ec45a1f538f9731b9f86111af528eab67426eed1d24a03f80a72a2dd100694bb0ad6475a16b4f5e468f5f2fbc051b257ee3112e61404d261e33cbccf51fb08ead88f709565ba50896011c3cb77570f989bebf44f71c65ca5ae0554276e15f69fed75091f52280b90a8161c81937675721d7f7437058e70332684b58c3823c2b66292f92c9d4976b703a5ad858592f38e4dfb41da3b7bd9ea6869b01c7422158c56305e07f95437fa92700343d4d72cd4cf5239dc8ce665fdf6d49de31b0e9e6c49d204f0cd3251e260fc175d206280a1e28a0eb8207ff100eae47668094ea6754812c6d32276c58d3479ee055b71551325f4798e644738c6254c77cfc2effce58d2fa981fcc9d6ba5a75cb7aec3a3be7e97e70888ca8e12b96535348daf30075ce28f25f74ddf52f40fc94f11ded4652ea3b038db01b8a643bb0a28fa7031bfcaf6b2fc3d094770a9c44f9fc8c8badc66604e918140342d594fa56e47454fd461d0997fddabbfac75c594534c44816ed83e908fabf7546da73bfa96d5103e7a2688822a5030f74eb6c62881aea4aec74206d33efd502fb2b3e61c19099ca410a2a4046815d7124a40fb6629eee31c8d7153e573eb4588c951d27cba4458ddaec11c487b2a4a9a65564abcebb5ab26d577193a5477d54ca717920c2ff23287a5a03d5af2d48edbc670f18b59a21f43f7538fb369c3c28d4ceb09b8206c970b0ba2775396def4bb01c725d674062aa0c5ed9901e3462d176bb5a55b335ff7dd01a568453adf6177bfd6207fb72daaf03034917cb304a93a5109ec81d050c68a7c760fb6957692f52985dd1a2a62c773ae21ce97002dce378115a08c9e946ea129a1c080a2211871ee25ba6054c0d6f0b617cfbeb7a47deb4054a0f26553b690311b3db332fbfb569afc066bb69bf036bc5d38b7e46b9d57168281921da15f335b5039102999a358c6b4cf22d48f7a952ece61e9fc857aa26c2b963ddc0b4d4c1a65c1e4db966cff934ab39a96f2abafff86b960b9d4114ecccea2a27f6df2d78cffa7ac04290e40bde1726a6588226b6c85555bfea9912c824c0cf2529cc478085a587032ff07423773ec3df56ddf645801c5151b6444549b6f10040724f01165630de90eb66b4b3d7a771b2e398801fc2a4554c842de71866d1d87ff4b181244b161ffaeda71010e98a7ccd6886517bcdbbda79ddae91e577e4c5a16596195cb811c67b7cdca39dd2872583b61372c20c088c9096caf2a2a535befed04f0dd4c99a6f4b50483cfe04f1eef0344281cbfd5cc758f33b3a19956072f6526cdb001b31034f5eeb20d00dbd1215be65b3b99bc9ecb9169cdd0b115593e6919df4ef7ff68e1c7a844271732bfea8a218cbb2559f55090d3ebdaa6ce444970a73026d68809e3b0e9cc600493f62450241cb91993d2e5a95459c1f3a3fe8c74012d320d1089bd70d5bcdc6d7db236e035b952e95c40cc5c7788d0940af0a6814d4b8e267449413f66ffaaaae52bfcb9b34ac6897e9e6260e3031263d087a60d60c12ea23a853828561ea4e277f877291f8f0f65d364cbc27168bded1751c8396e9371ba342e53869195eae67d55c06141fa27826582ffade4e435ef8283a5b8323f39d28905c3a86ae46e004bd2121d98f42011dd1559f95e3fd4d9ccd1ef3fc9cfa492ce8c61ec2229dc26777132912d9a7cd1d04b1061c3253422a16870b6c98784dc5a3d41eca9dabcf66b75aeff3f0a9565c6bd1f864494847bb824253d41b1bed7620d274b8b2985d6ad39fae561dded830e3fed4e4d40e2e3862614c5b057780a53a3fb7e4cac1f75c3c6d21bee975b016ffa8642eb78290703bb8f412e82d3b7aa411c62c9771b1a47a586982dfd4a14dfd4021551b4cc784d87ab69ab8bd7c5302ba28b6f23c0f4d53bec2f2fcb2db3f79583e1ba83a0f1ef6a4b13ee97976abe4496cac9b3a030d955473518d2ec727f494ab8cae53159f6825de551535f8b904f90b6192f21af669db1df40343c6418ddcd0687dc6bdc1dd2d25d35aa38d273ddc3346a604d6d8199a777a5e18b7f4f76293cd541815a73d1888bf3c266fded3702dd2bfd035c94faa3d2eef6a845652346ad9bd3040f515b62b2ef1d562f0cbb73240a1474d49aa72769665d7194a4d89d5bfe2dc3dcdedc9f20b311dfa0934234dc015b41beb4a781fa21ebf135a91e34654c1d5d34ce0130ebfa3c8e5a6a50c12f8712905bc6ee46b1ceeaa72dacfbd1ef4da31dea5e91162ec953d3d21dc385ebe2b1b95f6f71d8cf8665a56a9816d4f6e4301764f261afee5c62d93e3db506599e96f01da4254a81cc4081f4ab8aa00e539947aa2080d69580a6f960bbc189b1b874901684f23c113017dcde29f2b074ba2c92f2370cab12a16ed676e9500624242cbfe3d495fcf1ec45100c363e9f359c284e65be49d2160b169bc0aea3fcbbd2bf27ffb03333ca851a45cc80ede5e6c161ec86e03ab2d51227c8314a29ccb0920ad450e26378faa6102f344466b4d263deee41a589e7f1380bf03f2006c4bf84db543a4e106dccbb2fe3afeba4a4f802357ee326255e4b82a6c84c73ea0ade3f0813c9aa7d016ff690a2551889d705c30c8e487feb2c88638dc20a3bd4465d18d379ca245876770cb6d7e2110b11d32cc5943f8683378827ff70f90e949421a304a5db2ac57d9e85b8634838c3f8f1d2c79ef4d933677903a0f72b35c7ed69856eb48f50a7190492cbbbd935bed7da6584edde9e2f5ce89c07dd0d09cb7e1f977a20682d233bdbdecf22ce0c6d31c0a7c41dae4d20a8eb8984afcf50cd0969e93c5828ba067febe9f7891b0af85cc6a103191e810d18841de5a5d61b11a3ff16e3115324921af30a4e8ce00e182f538dfde6f122b4c1aea5dfe2a211089a1f32b14c70db4d018cd2c48b3fb5494299010636c70cd69c618f212cd1e6ee82cff5059213ddc9f84c412aeb2e6fb998a6b1441864240c2ff08c4cbfae118baee11a38e028efa75592e5d42166e2d82f458adbaf58a7c3792989eb576b2446e7132e6e8349e7087d58741935191743f9e13f003974dd5ab177da1312cd99f9f38003622265e21fe43563abcea42607b63a0ca359122066d6e258669dd89cbaa9b98c1fe45c5076ffe34e42727623dec26350afde13cadd11983db80d5f8412c7cf5797e2c1d398a1752b0a795a59f0db5c0330e679a8919b0091e25845dc93a9143b32199e10bd1e489cfac4cfc8cc855d2ba8d6485fd0a4bb62e0c47530153c54804ce1bb871fa5aef3b5ec19e0b13d364781160bb9ad630ca36e8539e3b10514592805e6fb3fa0227cd5edacbeccd44430e28c734e8f9f0a74095c35573c6a", &(0x7f0000d0d000-0xc8)=""/200, 0x7fffffff, 0x100000001}, 0x28) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000c47000)={0x7f, {{0x2, 0x0, @rand_addr=0x77f}}, 0x1, 0x3, [{{0x2, 0x2, @rand_addr=0x5}}, {{0x2, 0x3, @multicast2=0xe0000002}}, {{0x2, 0x2, @empty}}]}, 0x230) 2018/02/04 21:33:35 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000575000-0x10)={0x1, &(0x7f00000cf000)=[{0x74, 0x0, 0x0, 0x2000004000001}]}, 0x8) bind$inet6(r0, &(0x7f0000a04000)={0xa, 0x3, 0x98f4, @loopback={0x0, 0x1}, 0x1}, 0x1c) [ 87.688129] binder: 11677:11681 ioctl 40046207 0 returned -16 2018/02/04 21:33:35 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000ac9000-0x9)='/dev/kvm\x00', 0x0, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000c45000-0xb)='/dev/mixer\x00', 0x2400, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x3c) [ 87.725569] binder_alloc: 11677: binder_alloc_buf, no vma [ 87.731223] binder: 11677:11701 transaction failed 29189/-3, size 24-8 line 2957 [ 87.789304] audit: type=1326 audit(1517780015.511:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=11702 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4ec79 code=0x7ffc0000 [ 87.803275] binder: undelivered TRANSACTION_ERROR: 29189 [ 87.814060] audit: type=1326 audit(1517780015.511:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=11702 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4ec79 code=0x7ffc0000 [ 87.825391] binder: release 11677:11681 transaction 231 out, still active [ 87.850969] binder: undelivered TRANSACTION_COMPLETE [ 87.856115] binder: send failed reply for transaction 231, target dead [ 87.887740] kauditd_printk_skb: 20 callbacks suppressed [ 87.887748] audit: type=1326 audit(1517780015.609:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=11702 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf7f4ec79 code=0x7ffc0000 2018/02/04 21:33:35 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f000037f000)='/dev/audio\x00', 0x80, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000e91000-0x8)=0x6) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000502000-0xc)={0x0, 0x78, &(0x7f000000f000-0x78)=[@in={0x2, 0x1, @multicast1=0xe0000001}, @in6={0xa, 0x3, 0x571c, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x4}, @in={0x2, 0x3, @dev={0xac, 0x14, 0x0, 0xa}}, @in6={0xa, 0x0, 0x8, @mcast2={0xff, 0x2, [], 0x1}, 0xe6}, @in={0x2, 0x3, @broadcast=0xffffffff}, @in={0x2, 0x2, @broadcast=0xffffffff}]}, &(0x7f00000d9000)=0xc) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000cb1000)=@assoc_value={r1, 0x8}, &(0x7f0000c1a000-0x4)=0x8) openat$dsp(0xffffffffffffff9c, &(0x7f00009d2000)='/dev/dsp\x00', 0x3, 0x0) 2018/02/04 21:33:35 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x9, 0x5, 0x2000001) bind(r0, &(0x7f0000fb8000)=@generic={0x20000000001e, "01030000000000ff00000000ff03000009bf79df21d60c7bc8790405c7bad62e0a53a632ed4938f50006fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb3151314a8ef1f183bea5bdb9c8ead2000077aeb81c90001d6d5e980ee590c8b9f70dc136cb184a"}, 0x80) getsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000bc4000-0xc)={@empty, @empty, 0x0}, &(0x7f0000be6000)=0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000bb5000)={0x0, 0x0}, &(0x7f0000f34000-0x4)=0xc) sendmsg$nl_route(r0, &(0x7f0000bae000-0x1c)={&(0x7f00008bc000)={0x10, 0x0, 0x0, 0x5000000}, 0xc, &(0x7f0000ae6000)={&(0x7f000059d000-0x6c)=@ipv4_delroute={0x6c, 0x19, 0x200, 0x4, 0x1, {0x2, 0x0, 0x20, 0x0, 0xff, 0x3}, [@RTA_METRICS={0x28, 0x8, "64c365821d998a78fce94468930e435e9e5a70e16a860cba94f0f2427858564ab420a661"}, @RTA_OIF={0x8, 0x4, r1}, @RTA_FLOW={0x8, 0xb, 0x9}, @RTA_DST={0x8, 0x1, @multicast1=0xe0000001}, @RTA_FLOW={0x8, 0xb, 0x8}, @RTA_UID={0x8, 0x19, r2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r3 = socket(0x10, 0x2, 0x0) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000183000)='/dev/qat_adf_ctl\x00', 0x101000, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r4, 0xc1205531, &(0x7f0000dfb000)={0x3, 0x7, 0xfff, 0x200, [], [], [], 0x0, 0xffffffffffffffd3, 0x80000001, 0x1, "d9bbaa45766031323373bda65d073eea"}) bind(r3, &(0x7f0000d81000-0x80)=@generic={0x1e, "0103000000000000000000000000000009a979f321b30c7bc8790405c7bad62e0a43a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb31f1314a8ef151622ca5bdb9c8ead2000077aeb81c90001d6d7c980ee590c8b9f70dc136cb184a"}, 0x80) sendmsg(r0, &(0x7f0000f37000-0x38)={&(0x7f0000fdc000-0x80)=@generic={0x10000000001e, "02010000000020df0000000000000000805bf86c57020002000000f1fffff400000000000000000000010300000000e4ff064b3fdf3a000000080000000000000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ece000206000000090000fd00000900000000000b0000db000004da36"}, 0x80, &(0x7f000091d000)=[], 0x0, &(0x7f0000d19000)=[]}, 0x0) 2018/02/04 21:33:35 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000201000)={0x0, 0x1, 0x200}, &(0x7f0000f21000-0x4)=0x10) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000000)={r1, 0x7}, 0x8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_NR(r0, 0x4008ae73, &(0x7f00004b9000)={0x8a0c, 0x7}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ifreq(r2, 0x10000089f0, &(0x7f0000a7d000-0x50)={@common='bridge0\x00', @ifru_data=&(0x7f000011f000-0x20)="1200000000000000000305fffe00000300000000000000000449faf4e2002023"}) 2018/02/04 21:33:35 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f00000dd000-0xa)='/dev/dsp#\x00', 0x9, 0x10200) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000c05000-0x4)=0x7fff, 0x4) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:35 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00009bd000-0x8)='./file0\x00', 0x20000, 0xc) ioctl$TCSETSF(r0, 0x5404, &(0x7f000049a000)={0x3, 0x8000, 0x0, 0x3, 0x8000, 0x6, 0x8001, 0x6, 0x4, 0x7, 0x6}) r1 = syz_open_dev$dspn(&(0x7f0000005000-0xa)='/dev/dsp#\x00', 0x1, 0x0) readv(r1, &(0x7f000079c000)=[{&(0x7f0000830000)=""/4096, 0x1000}], 0x1) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000007000-0x8)) mmap$binder(&(0x7f000044e000/0x4000)=nil, 0x4000, 0x1, 0x12, r1, 0x0) 2018/02/04 21:33:35 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000330000-0x9)='/dev/vcs\x00', 0x400600, 0x0) ioctl$KVM_GET_MSRS(r1, 0xc008ae88, &(0x7f0000815000)={0x6, 0x0, [{}, {}, {}, {}, {}, {}]}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$dspn(&(0x7f00009ce000-0xa)='/dev/dsp#\x00', 0x68, 0x10000) ioctl$KVM_CHECK_EXTENSION_VM(r2, 0xae03, 0x2) r3 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r3}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:35 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00001ce000)='./bus\x00', 0x0) mount(&(0x7f000023c000)='./bus\x00', &(0x7f0000022000-0x6)='./bus\x00', &(0x7f0000f6e000-0x6)='ramfs\x00', 0x800001, &(0x7f000023c000)) r0 = openat(0xffffffffffffff9c, &(0x7f0000041000)='./bus\x00', 0x0, 0x0) fanotify_mark(r0, 0x91, 0x1, r0, &(0x7f00006bf000)='./bus\x00') renameat2(r0, &(0x7f00007a9000-0x8)='./bus\x00', r0, &(0x7f0000e61000)='./file0\x00', 0x0) 2018/02/04 21:33:35 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000006000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000005000)={0x6, 0xffffffffffffffff}) truncate(&(0x7f0000c7d000)='./file0\x00', 0xffffffff) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000005000)=""/20) 2018/02/04 21:33:35 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000001000)='/proc/self/net/pfkey\x00', 0x1, 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x10001, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) readv(r0, &(0x7f0000003000-0x10)=[{&(0x7f0000001000-0x21)=""/33, 0x21}, {&(0x7f0000002000)=""/187, 0xbb}], 0x2) ioctl$TIOCLINUX2(r0, 0x541c, &(0x7f0000001000-0xc)={0x2, 0xffff, 0x7, 0x97d, 0x1f, 0xfffffffffffffff8}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg(r0, &(0x7f0000d17000-0x1c)={&(0x7f0000ad1000)=@in={0x2, 0xffffffffffffffff, @empty}, 0x10, &(0x7f0000e3f000-0x10)=[], 0x0, &(0x7f0000774000-0xb8)=[{0xc, 0x10f}], 0xc}, 0x0) [ 87.917779] audit: type=1326 audit(1517780015.609:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=11702 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4ec79 code=0x7ffc0000 [ 87.942458] audit: type=1326 audit(1517780015.609:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=11702 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f4ec79 code=0x7ffc0000 2018/02/04 21:33:35 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000f94000)="6e6574f60300000000440ff1c84fe6a059d6807d8f6988f5e2e33e7c458d8d1619e61d581d1dda464f1f0d80d1a42f9665932dfc1fab3e8cfd14d0d93f980900dda355a40199f2fc75d6ed9c3c9afa20f4379ff2ce1a2153d29fd7816b774ce451eb91d20c2cced3d470bd793cd15062e7d71d7f84a294fc9dddbe197bc9fe37f47691884d1b8e385660548fc3999b3000b57180e5c9bc9fee975b2ad1418c06d5e41be1238e7eaa8e6daec47ee8f8d4ef94aa4278f8") r1 = syz_open_procfs(0x0, &(0x7f00006ad000)='attr/sockcreate\x00') ioctl$KDDISABIO(r0, 0x4b37) sendfile(r1, r0, &(0x7f0000bae000), 0x40000100) 2018/02/04 21:33:35 executing program 0: r0 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000902000-0x12)={@generic="30589101ff78a7bcf3bff0d257669bc5"}) [ 87.983821] binder: 11731:11735 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.007502] binder: 11731:11741 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.021269] QAT: Invalid ioctl [ 88.031271] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/04 21:33:35 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000ae1000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f000027c000)={{0x80}, "706f7274310000004000000000000000000000d600fffffff0000000000000000000eda4000000000000000700", 0xbfffffffffffffff, 0x2}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ppoll(&(0x7f000086d000-0x28)=[{r0}], 0x1, &(0x7f0000875000), &(0x7f00004b0000-0x8), 0x8) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f000053a000)=@assoc_value, &(0x7f000088c000-0x4)=0x8) 2018/02/04 21:33:35 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000008000-0x8e), 0x1}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000453000)=0xe56c, 0x2) 2018/02/04 21:33:35 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000939000-0xc)={@multicast1=0xe0000001, @local={0xac, 0x14, 0x0, 0xaa}}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x25, &(0x7f0000dcd000-0xc)={@multicast1=0xe0000001, @local={0xac, 0x14, 0x0, 0xaa}}, 0xc) r1 = dup2(r0, r0) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000e3b000)=""/4096) 2018/02/04 21:33:35 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$tun(&(0x7f0000001000-0xd)='/dev/net/tun\x00', 0x0, 0x90000) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000002000-0xc)='/dev/amidi#\x00', 0x5, 0x2000) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000003000-0x4)='tls\x00', 0x4) setsockopt$inet_tcp_buf(r0, 0x6, 0x16, &(0x7f0000001000-0xb4)="4200489e6844807e20c8198c3d3aef971c30e7c59a39570f7057c68ae8d41e67f67cc744efb438a2db9e5735f465f9e5e3939661fc4942f5358c13928c22dee2d6d3426f0c997c7c067afbced740ae56675abbfc8e538dae27cba083df80e8744d7009a6132422b1c0f650f6869c84c78f163772b15c156a42ec5d40e558da373d04761b5df08fe4896482f1dab487c0e8a49e30f15d43311dc1e3ace3e0631d1ce0e1c9c380b285be6b726d6e6a5d2cb994d706", 0xb4) set_robust_list(&(0x7f0000001000-0x1)={&(0x7f0000902000/0x3000)=nil, 0x7, &(0x7f000092b000/0x4000)=nil}, 0xc) perf_event_open(&(0x7f000002f000-0x78)={0x2, 0x78, 0x82, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2b66958e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) [ 88.037451] binder: 11729:11733 ioctl 40046207 0 returned -16 [ 88.049931] binder_alloc: 11729: binder_alloc_buf, no vma [ 88.055657] binder: 11729:11745 transaction failed 29189/-3, size 24-8 line 2957 [ 88.061808] QAT: Invalid ioctl [ 88.073135] binder: 11729:11752 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:35 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000001000)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000261000)='/selinux/load\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x9d7000)=nil, 0x9d7000, 0x0, 0x4d072, 0xffffffffffffffff, 0x0) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000d54000-0x11)='/selinux/relabel\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000817000)=0x7) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f00002c7000)='/dev/cuse\x00', 0x200800, 0x0) connect$vsock_stream(r2, &(0x7f0000e82000)={0x28, 0x0, 0x2710, @reserved=0x1}, 0x10) write$selinux_load(r1, &(0x7f00007ac000-0xf9)={0xf97cff8c, 0x8, 'SE Linux', "a9f51ea299a8242311200496bf5a520976e15bc942c58fbc9632f9a20b24104ce19112ef0f3d344e42161e7ccd7e45999b1cf08c103b8a99a909239691384bedf4e500e38b7dfc2b63434d6f5e4dcfd57e630fbaacb1a89332c15c2463b106813d167719b09286c3a9a66725bc64c90860eea171629b6a6d931f2e201388ab76d774ece5e130cedb40f8c6ca9ce9a225aa37d175b6a8da6d83ebbfcf41bb1a91c11c63acd0b19461cbfa2583293692e889106b34e15de12054ddea4afbf4f7ab8bd4d4fbcc22ac6d4241d8329bb2ba6daa4b70e33075cf718a244ab38d234c4a859593e37d8cebf2e4"}, 0xf9) 2018/02/04 21:33:35 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) alarm(0x7) r0 = syz_open_dev$dspn(&(0x7f0000b6e000-0xa)='/dev/dsp#\x00', 0xbe9, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0086426, &(0x7f000069b000-0x8)={0x2, &(0x7f000090d000-0x10)=[{0x0}, {}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4008641c, &(0x7f0000909000)={r1, &(0x7f0000e1c000-0xea)=""/234}) [ 88.093917] binder: BINDER_SET_CONTEXT_MGR already set [ 88.113000] binder: 11757:11758 ioctl 40046207 0 returned -16 [ 88.124092] binder_alloc: 11729: binder_alloc_buf, no vma [ 88.129771] binder: 11757:11768 transaction failed 29189/-3, size 40-8 line 2957 [ 88.138090] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:35 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) prctl$getname(0x10, &(0x7f0000000000)=""/48) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000b7f000)='/selinux/policy\x00', 0x0, 0x0) write$sndseq(r2, &(0x7f0000e71000-0x70)=[{0x3, 0x7, 0x1, 0xffffffffffffffff, @tick=0x5, {0x7, 0x9}, {0xfaa, 0x7}, @quote={{0x9, 0xfffffffffffffc01}, 0x2e, &(0x7f0000fea000-0x1c)={0x81, 0x0, 0x4, 0x1000, @tick=0xc68, {0x7, 0xfff}, {0x8, 0x10000}, @quote={{0xea2, 0x1}, 0x0, &(0x7f0000024000-0x1c)={0x1ff, 0x4, 0x4, 0x6000000000, @time={0x0, 0x1c9c380}, {0x1c00000, 0xaf9}, {0x7ff, 0x9}, @control={0x6, 0x3, 0x401}}}}}}, {0xff, 0x80000001, 0x7, 0x2a6, @tick=0x5, {0x7, 0x2}, {0x83, 0x1}, @addr={0xcb, 0x4}}, {0xffff, 0xffffffff, 0xffffffffffffffc0, 0x1, @tick=0x8000, {0xfffffffffffffff7, 0x3f}, {0xd925, 0x7fffffff}, @quote={{0x0, 0x6}, 0x10000}}, {0x10000, 0x101, 0x800, 0x5, @tick=0x3, {0x100000000, 0x1}, {0x4, 0x9}, @queue={0x10000, {0x0, 0x9}}}], 0x70) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:35 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000001000-0x11)='/dev/vga_arbiter\x00', 0x80000, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = accept4$llc(0xffffffffffffff9c, &(0x7f0000001000-0x10)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000504000)=0x10, 0x80000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_GET_UNIQUE(r0, 0xc0086401, &(0x7f0000001000)={0x7b, &(0x7f0000000000)=""/123}) connect$l2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x0, @rand_addr=0x6}, 0x0, 0x1, 0x1, 0x4}}, 0x26) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f000056a000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @dev={0xfe, 0x80}, 0xee55}, 0x1c) bind$inet6(r2, &(0x7f0000711000-0x1c)={0xa, 0x1, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x2a, &(0x7f00003dd000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x11, 0x0, @empty, @empty, {[]}}, @udp={0xffffffffffffffff, 0x1, 0x8}}}}}, 0x0) 2018/02/04 21:33:35 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000237000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000e03000-0xd)='/dev/usbmon#\x00', 0x3, 0x8000) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f00009cc000)={0x0, @in6={{0xa, 0x3, 0x3, @dev={0xfe, 0x80, [], 0x0, 0x13}, 0x2}}}, &(0x7f0000c8f000-0x4)=0x8c) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000540000-0x1a)={r2, 0x200, 0x9, [0x3, 0x44a, 0x4fb9, 0x0, 0x0, 0x3, 0x2, 0x5, 0x0]}, 0x1a) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f000096e000)={r2, @in6={{0xa, 0x3, 0x8, @mcast2={0xff, 0x2, [], 0x1}, 0xfff}}, 0x1000, 0x9}, 0x98) syz_open_dev$sg(&(0x7f0000790000-0x9)='/dev/sg#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76), 0x1}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) rmdir(&(0x7f00008af000-0x8)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000ed000)={0x44, 0x0, &(0x7f000043d000-0x6c)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000040b000-0x50)=[], &(0x7f0000c04000)=[0x0]}}], 0xfffffffffffffdc0, 0x0, &(0x7f00007c7000-0xe2)}) [ 88.143897] binder: release 11729:11733 transaction 236 out, still active [ 88.150940] binder: undelivered TRANSACTION_COMPLETE [ 88.156097] binder: send failed reply for transaction 236, target dead 2018/02/04 21:33:35 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1, 0x200080006, 0x9b8) write(r0, &(0x7f0000c85000)="1f00000032000ff2050005000000010000000441060002000000000000007e", 0x1f) r1 = syz_open_dev$mouse(&(0x7f000089e000-0x12)='/dev/input/mouse#\x00', 0x100000001, 0x210080) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0e05403, &(0x7f0000c03000-0xe0)={{0x2, 0x1, 0x8000, 0x0, 0x80}, 0xffff, 0xc06, 'id0\x00', 'timer0\x00', 0x0, 0xeb0, 0xad, 0x2}) fcntl$setstatus(r0, 0x4, 0x6000) 2018/02/04 21:33:35 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000710000-0x1d)={0xa, 0x0, 0x0, @empty}, 0x1c) sendto$inet6(r0, &(0x7f0000e2a000)="8c", 0x1, 0x0, &(0x7f000042f000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = syz_open_dev$amidi(&(0x7f0000766000-0xc)='/dev/amidi#\x00', 0x6, 0x101000) clock_gettime(0x0, &(0x7f00008c5000)={0x0, 0x0}) utimensat(r1, &(0x7f00006ce000-0x8)='./file0\x00', &(0x7f0000498000)={{r2, r3/1000+30000}}, 0x100) setsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000de7000-0x14)={0x0, 0x4}, 0x14) [ 88.190614] binder: 11757:11758 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.195837] binder: BINDER_SET_CONTEXT_MGR already set [ 88.213139] binder: 11779:11781 ioctl 40046207 0 returned -16 [ 88.216868] binder_alloc: binder_alloc_mmap_handler: 11775 20000000-20002000 already mapped failed -16 [ 88.235653] binder: BINDER_SET_CONTEXT_MGR already set [ 88.241366] binder_alloc: binder_alloc_mmap_handler: 11757 20000000-20002000 already mapped failed -16 [ 88.244789] binder_alloc: 11775: binder_alloc_buf, no vma [ 88.255109] binder: 11775:11780 ioctl 40046207 0 returned -16 [ 88.256535] binder: 11779:11781 transaction failed 29189/-3, size 40-8 line 2957 [ 88.270385] binder: BINDER_SET_CONTEXT_MGR already set [ 88.276495] binder_alloc: 11775: binder_alloc_buf, no vma [ 88.282132] binder: 11757:11768 transaction failed 29189/-3, size 40-8 line 2957 [ 88.291244] binder_alloc: binder_alloc_mmap_handler: 11779 20000000-20002000 already mapped failed -16 [ 88.291327] binder: 11757:11758 ioctl 40046207 0 returned -16 [ 88.303880] binder: BINDER_SET_CONTEXT_MGR already set [ 88.312363] binder: 11757:11792 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.323578] binder: release 11775:11780 transaction 242 out, still active [ 88.326516] binder: 11779:11781 ioctl 40046207 0 returned -16 [ 88.330597] binder: undelivered TRANSACTION_COMPLETE 2018/02/04 21:33:36 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00008a0000-0x9)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f00008e6000)='/dev/vcs#\x00', 0x6, 0x0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000f8e000)={0x9, 0xce4, 0x0, 0x6, 0x0, 0x7, 0x26, 0x3, 0x5, 0x1, 0x9, 0x118c}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x10000000) fcntl$F_SET_RW_HINT(r3, 0x40c, &(0x7f0000bbc000)=0x5) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f0000148000)={0x0, 0x0, [0x0, 0x6, 0x1, 0x2]}) 2018/02/04 21:33:36 executing program 2: mmap(&(0x7f0000ae1000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000ae1000)='/dev/cuse\x00', 0x0, 0x0) setsockopt$ax25_int(r0, 0x101, 0xe, &(0x7f0000ae1000)=0x3ff, 0x4) mmap(&(0x7f0000000000/0xfd0000)=nil, 0xfd0000, 0x1, 0x32, 0xffffffffffffffff, 0x0) name_to_handle_at(r0, &(0x7f0000908000)='./file0\x00', &(0x7f0000e77000)={0x8}, &(0x7f0000fd1000), 0x1400) 2018/02/04 21:33:36 executing program 4: openat$autofs(0xffffffffffffff9c, &(0x7f0000e3f000)='/dev/autofs\x00', 0x80, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00005c3000-0x58)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x800000000000018) r2 = socket(0x0, 0x8000a, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000af9000-0x14)={0x2, 0x5, 0x8, 0x7f, 0x10000}, 0x14) sendmsg$alg(r1, &(0x7f0000b1e000-0x1c)={0x0, 0x0, &(0x7f0000c07000-0x40)=[], 0x0, &(0x7f0000483000)=[]}, 0x0) 2018/02/04 21:33:36 executing program 3: mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt(r0, 0x0, 0x42, &(0x7f0000006000)=""/1, &(0x7f0000006000)=0x1) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000007000)='/dev/dmmidi#\x00', 0x10000, 0xac0) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000006000)) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bind$can_raw(r1, &(0x7f0000007000)={0x1d}, 0x10) 2018/02/04 21:33:36 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000008000)={&(0x7f000007f000-0xc)={0x10, 0x34000, 0x0, 0x4410008}, 0xc, &(0x7f00003be000-0x8)={&(0x7f00009fb000)={0x14, 0x23, 0x829, 0xffffffffffffffff, 0xffffffffffffffff, {0xb}, []}, 0x14}, 0x1}, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000eb3000-0xb)='/dev/hwrng\x00', 0x10000, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f00009fa000-0x4)={0x1e, 0x7}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f000074d000-0x11)='/selinux/enforce\x00', 0x200000, 0x0) rt_sigaction(0x15, &(0x7f0000e99000)={0x1, {0x1}, 0x4, 0x100}, 0x0, 0x8, &(0x7f000074f000)) ioctl$KVM_GET_MSRS(r2, 0xc008ae88, &(0x7f000031c000)={0x5, 0x0, [{}, {}, {}, {}, {}]}) 2018/02/04 21:33:36 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000cb4000-0x8)='./file0\x00', 0x0) r0 = open(&(0x7f0000625000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000644000-0x8)='./file0\x00', 0x0) r1 = open$dir(&(0x7f00004db000-0x8)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$nfc_llcp(r1, &(0x7f0000abe000-0x58)={0x27, 0x2, 0xfffffffffffffeff, 0x7, 0xf33, 0x8, "d40364ee85e02efb469fa177c58651fee0bcc3bbc5d68c28cd0bea68063922316e91409f393d62fe44f2c6e6e5f8bca11c93317e6e043380ba3a27a50ca6c0"}, 0x58) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000a7a000)) r2 = openat(r1, &(0x7f00006ea000-0x8)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000c95000)='./file0\x00', &(0x7f00000e4000)='./file0\x00', &(0x7f00009b9000)="0500de00667300", 0x1004, &(0x7f00006b8000)) symlinkat(&(0x7f0000020000-0x9)='./file0/file0\x00', r2, &(0x7f0000020000-0x8)='./file0\x00') renameat2(r0, &(0x7f000068e000)='./file0\x00', r2, &(0x7f0000284000)='./file0/file0/file0/file0\x00', 0x0) renameat(r2, &(0x7f0000fdd000-0x1a)='./file0/file0/file0/file0\x00', 0xffffffffffffffff, &(0x7f0000b52000-0xe)='./file0/file0\x00') 2018/02/04 21:33:36 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000f82000)={0x0, 0x0}) ioctl$sock_bt_cmtp_CMTPCONNADD(r2, 0x400443c8, &(0x7f00008c8000-0x8)={r2, 0x3}) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000fdb000-0x10)={0x0, 0x8, 0x4, [0xfffffffffffffff8, 0xffffffffffffffff, 0x1, 0x9]}, &(0x7f0000dc1000)=0x10) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f00008cf000)={r3, 0x8}, 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$sg(&(0x7f000027a000)='/dev/sg#\x00', 0x7fff, 0x200) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r4, 0x8008ae9d, &(0x7f000060c000)=""/107) syncfs(r2) r5 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) readahead(r0, 0x7f, 0x1000) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f000076e000)) lremovexattr(&(0x7f00001ff000-0x8)='./file0\x00', &(0x7f000015c000)=@random={'btrfs.', '/dev/sg#\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0xfffffffffffffef6, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r5}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:36 executing program 6: r0 = syz_open_dev$mouse(&(0x7f00005e9000-0x12)='/dev/input/mouse#\x00', 0x7fffffff, 0x200) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f00008b7000)=@assoc_value={0x0, 0x5}, &(0x7f0000711000)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000d38000-0x6)={r1, 0x6}, &(0x7f000040b000)=0x6) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00003d1000-0x30)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x1, 0x0, &(0x7f0000667000)="1d"}) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f00003c0000)=0x49) [ 88.341592] binder: send failed reply for transaction 242, target dead [ 88.360872] binder: undelivered TRANSACTION_ERROR: 29189 [ 88.366433] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:36 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f000008d000)='/dev/vcsa#\x00', 0xffffffffffff2cff, 0x208281) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f0000000000), 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000119000)="efc55830c18566aacb0761e98e86ac4df284f7e1b70a86cda07038789dc516b0f4c4bcce2dcde2581283fd664da50f1a17df13b6c1e66db548e7c7ebe3560d40947f941c9e7146bf90c46baabdd709d7e82e1f25170ec0864aad4a2e29b9ceebd2a7cfab33b252b9a77760", 0x6b) openat$autofs(0xffffffffffffff9c, &(0x7f00008e0000)='/dev/autofs\x00', 0x48000, 0x0) bind$inet(r1, &(0x7f0000df1000)={0x2, 0x0, @loopback=0x7f000001}, 0x10) getsockname$ipx(r0, &(0x7f0000ce5000-0x8), &(0x7f0000541000)=0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x200000000000a, &(0x7f0000425000)=0x1004, 0x4) fcntl$getflags(r1, 0x40a) sendto$inet(r1, &(0x7f0000de2000-0x1), 0x71, 0x20008045, &(0x7f000057f000)={0x2, 0x0, @loopback=0x7f000001}, 0x10) setsockopt$inet_tcp_buf(r1, 0x6, 0xa, &(0x7f000071d000)="1f000000", 0x4) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000e87000)=0x976, 0x2) [ 88.400453] binder: 11803:11809 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.411517] binder_alloc: 11800: binder_alloc_buf size -240 failed, no address space [ 88.420010] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) 2018/02/04 21:33:36 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f00009be000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r0, 0x40bc5311, &(0x7f000063e000)={0x0, 0x0, 'client0\x00', 0x0, "0f77430a6a4dfcf9", "21266363676aa55c845a5a906d8e28e803db9c08cc9c1778803a51775c77cda3"}) 2018/02/04 21:33:36 executing program 6: r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000f95000)={0x3, r0, 0x1}) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000e35000-0x1)) 2018/02/04 21:33:36 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000012000-0xb)='/dev/audio\x00', 0x408800, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$VHOST_GET_VRING_ENDIAN(r0, 0x4008af14, &(0x7f0000001000-0x8)={0x3, 0x9}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000013000)={r0, 0x0, 0x1, 0x5, &(0x7f0000013000)=[0x0, 0x0, 0x0, 0x0], 0x4}, 0x20) getsockopt$inet_tcp_int(r1, 0x6, 0x100000000000000c, &(0x7f0000014000-0x4), &(0x7f0000014000-0x4)=0x4) [ 88.420073] binder: 11800:11810 transaction failed 29201/-28, size 24--266 line 2957 2018/02/04 21:33:36 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x3) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000a52000-0x348)=@filter={'filter\x00', 0xe, 0x4, 0x2b4, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000), {{{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@ip={@multicast1=0xe0000001, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0x0, 0x0, @common='bcsh0\x00', @common='dummy0\x00'}, 0x0, 0x70, 0xa0, 0x0, {}, []}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@ttl={0x24, 'ttl\x00'}, @common=@unspec=@realm={0x2c, 'realm\x00'}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2}}, {{@ip={@rand_addr, @broadcast=0xffffffff, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @generic="05df19db18153787adb78e5959c5635b"}, 0x0, 0x70, 0x98, 0x0, {}, []}, @common=@unspec=@TCPMSS={0x24, 'TCPMSS\x00'}}]}}, 0x310) 2018/02/04 21:33:36 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000626000-0xc)='/dev/rfkill\x00', 0x4000, 0x0) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000d60000)={0x5, [0x800, 0xfeed, 0x22820178, 0xfffffffffffff4b5, 0x4]}, &(0x7f000098c000-0x4)=0xe) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0xfffffcca, 0x0, &(0x7f0000ea5000)}) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000fe4000)) 2018/02/04 21:33:36 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 88.445282] binder: 11800:11819 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 88.463826] binder: 11803:11809 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.496652] binder: BINDER_SET_CONTEXT_MGR already set [ 88.496769] binder: 11800:11810 ioctl 40046207 0 returned -16 [ 88.513710] binder_alloc: 11800: binder_alloc_buf, no vma [ 88.513739] binder: 11800:11810 transaction failed 29189/-3, size 24--266 line 2957 [ 88.522439] binder: undelivered TRANSACTION_ERROR: 29189 [ 88.522649] binder: undelivered TRANSACTION_ERROR: 29201 [ 88.587128] binder: 11845:11852 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.598782] binder: 11853:11856 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.641354] binder: 11845:11857 ioctl 541b 20fe4000 returned -22 [ 88.653732] binder: 11853:11856 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.665551] binder_alloc: binder_alloc_mmap_handler: 11845 20000000-20002000 already mapped failed -16 [ 88.676413] binder: BINDER_SET_CONTEXT_MGR already set [ 88.681860] binder: 11845:11857 ioctl 40046207 0 returned -16 2018/02/04 21:33:36 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f000068e000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f00000e4000-0x4)=0x14) syz_open_dev$binder(&(0x7f0000123000-0xd)='/dev/binder#\x00', 0x0, 0x800) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000e84000)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f000022e000)='/dev/vcs\x00', 0x20000, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000c64000-0x10)={r2, 0x28, &(0x7f0000731000)}, 0x10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f000007d000-0xc)={0x0, 0x0}, &(0x7f0000599000)=0xc) truncate(&(0x7f0000938000-0x8)='./file0\x00', 0x2) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f000084f000)='/selinux/status\x00', 0x0, 0x0) setsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000116000-0xe8)={{{@in=@remote={0xac, 0x14, 0x0, 0xbb}, @in6=@ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, 0x0, 0x8, 0x0, 0x0, 0xa, 0x80, 0x80, 0x3a, r0, r3}, {0x0, 0x1, 0x400, 0x1, 0x1, 0x80000001, 0x3f, 0x10001}, {0x200, 0x2b83d83, 0x6, 0x397}, 0x0, 0x0, 0x2, 0x1, 0x3, 0x3}, {{@in6=@empty, 0x0, 0xff}, 0x0, @in6=@mcast2={0xff, 0x2, [], 0x1}, 0x4, 0x0, 0x2, 0x1, 0x2, 0x0, 0x1}}, 0xe8) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x4) pause() getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00005a7000)={0x0, @in6={{0xa, 0x0, 0x9, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x1}}, 0x6b, 0xa6ef, 0x1, 0x4, 0x40}, &(0x7f0000c99000)=0xa0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f00006a7000-0x14)={0x0, 0xfffffffffffffe00, 0x100, 0x583696e0, 0x1f, 0x7}, &(0x7f0000c9c000)=0x14) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000265000-0x8)={0x0, 0x9}, &(0x7f000022f000-0x4)=0x8) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r5, 0x84, 0x6, &(0x7f000085e000-0x8c)={0x0, @in={{0x2, 0x3, @rand_addr=0x20000000000000}}}, &(0x7f0000bf0000)=0x8c) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000d10000-0x5)=@assoc_value={0x0, 0x9}, &(0x7f0000f9c000-0x4)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f00006da000-0x4)=@assoc_id=0x0, &(0x7f0000161000)=0x4) sendmsg$inet_sctp(r2, &(0x7f0000fe6000)={&(0x7f0000973000-0x1c)=@in6={0xa, 0x2, 0x8, @remote={0xfe, 0x80, [], 0x0, 0xbb}}, 0x1c, &(0x7f0000070000-0x10)=[{&(0x7f00000b2000)="71c8e11d6eded5facc3a515212613534175f35eb93a8f5f504bc9b2d3792e2269850114de4904014b5818b4fef27db8ec0b5f3182729f787ff458d4a59bc19b6f03dddaa2b8e4d7ba06277ccb607764eb193b1674dd96451f6ddebe02d308d2f1b27697c9f3e043e576d3c37f052478bbd54ee45147244bc999d804d57e2071aba704efd9c6064996df2ae6fc84afd0e9066936567a4e12e5cada85ed17f4e5c72bca9b5bc94b2efc6826e4d1a58591da379561dc3e452aab85a898e055bce82ff8549f781be0079e5e45b58236cdf04f2a15557db232fd228e0644f08d5e8bc4195f27e56e3ed674caa63e7c523b8daf973ac63c7f4798d0cea9413fcddab0d88c3e58bc3327759e94f64a85b183ca18d19c63274a9793435228aecca23702180b704ccadc3508d120872513754bd4db4bfab091fed6a61ce9ab007df7d2b01ca948b056af4fe87dbd878b0c5839326f8bc53c4e8003ce0e40a6c13f4d4aab560584549815d7925be22df6452ea227d99383f795b43039d205ef98601d13ed5b22db9d5e751d048c603042140167b12c25b8a30861e6704d449f95f902f22acf60e9c4cd1bb954af095efe7b7759a5b4c19897b23b812526b8e90b6a62da596c7bc0303ad8b94131ecad5490d291a89d274b3e453ea4cc3cb6a7073737961d9837c48d523efcfa7afb45e2e4e92f6d8eb2cc60ab71e33f6e4367de609b4071f35219cd5cf114b1a7f0909a2f789c11adfc0727683a160a37485c2a8e3b86ed7bdd5e1c7fc96e5aa14d34b9648f63d57a5a32407496304b7ea4df16e41a4b0b8c22529745052b655e79e876bb6a218f9eb0d146884d00f655f20a9d5333c8705efdadac2a3bdfa081a365d7f752908c1159643d9f177537de15a4f16f73411bacdaa86230a9b58b81eabaee8aedc60ff8ba545e1ffded8cf8e534d5edd5acd6b50a005b6bed39907674b16b067077dd43fa776ea25360c8b28dc761c1845a5b683b69629b927f769bfa8c68109edb962ebb5021775f2472eb09e182d2b1543d4f921714f45b784bab579da39bd7087f24017e1af7a051e2b5557122fad9def699495e2829e6a0dfa795383983f63d1ab998c3e60ba21bc047509970efec60cc0a028b7f335831b4588cfdee514c2bc6179132dbceb2c690d8b7823536b30b37fed98217beb36ca51614d34b692f97eaa2c6f89f068c9dfc23f7cb2834862afa1bcd198d89afc2af9b4c3c905ee70dd141fb50c4f6b1cf2302aa52328a2e54a88791962f19c4104658553ac876bb582c57978b4a51074fd2653cfb38d66dade2a9316abb0d5fd65b4a7060413e17181c528a465edb6fab37e12d35e0a8411bdde2c85f1f7479f5bcbad0741c8073ac23eefc22ff26dbcc417c8b92fc75248c26c90a58be969453a0d32b5c05943a728052f8451f86eacbc5804afd96b68e01d7d01dd63b36a104f0fc1443fc9a548f83b821e10053ab1bc78890a0a29c6e5f998679c8feceb4f34dbcf4b52a537184fde35530d0add8247e6b0f843515f769c40ddc1e950abbbd318c1e9a771e662089facb3a2d8991e2daf87df343e6a9919b3cbc8445802b4e45ecb491fa90d097c8f612e481b7afb9f9e7f776bacbd5c489bea007d09e550c70604763b6b1fe03df02b9d21ab54a1f9efb276c2ed2b1b6e45eba3ed04f7c6cae5c5da3a6a2f7fd3c937a87e3080e562c5d451dc38506976709f036608abb103ceb57052d4348cd3d275705ee26e9a1c3c26fd1d39fd19f58fe975e5398dc575e3c376a2dda4b3474e12d6868ac74214c86180139db3111378a6353a0fcb07b424a31a5f4072e6b45c2577c789e9779b77eb3761580f4aff7cf11947ca2d311a7c214f8b13177f47e44e69b404de327ee57ae7787eba7bec48ffa6a352c2623cfc608b3101c2e668dd57bf706455cae72870d419540fd5cb9d348e364143a719a6020b7874a13c44b2400a28ff79bfb9596863571d6f19ca1db719227d9f9540276e5d5c806e79bdc1af18bd69354f5e537f28caa79cd25f2b884d180ce21ff25b3de72d54e7a9c59ab4749455ced7880a61775e83ccdf208f9ad080192caadf17889d57caa82e7e9625ac52d2259de22e74d999f5ba7f154cecd761fa2473ffa290d28489ee7fde6f089d1bf6ae8becc8b2770308b883dddb64be865c872df6bccf6694f50e34d73c1d0b23f10a7f86c6f70225e3522fc5e0e2166e0e284543497e2dff6893d189ee3e210bb586f148e2355017de5cdaecd889d9521e491840b19a3a40bc26e2811ccd509f11fe7eba40ab39f79ae1df6469babb73db74a5d9a86cb09ebf9d07104ebc459470f3ff20a2b00c353e599bd4ac4fcff6144eae9a89a5ba088f35bef8ff70c42400ffe67bf120b1afbbf60bba9a83986869240867203d2799b00aa5710bde2b26b22b0fce7a3b712597ee005d9163f9cc960ab336545380206b8c496f82bee2ecfa14cc495e8ef4491426f1c96996a3b53823eda4e7a4b045b8d5f76f41e90e83b59b1e63b11953c0afa45dc4ca12f5a212bc7870b1a2ede133878b4d1584e3ee0641eaf2ca0eab9ee45e85a4763f8414cea30d4e3c374ad7597025023a5040f9dda9458269469c66fd8288617264245a997afbd40c59d82dbc91a428feae10631a605ee1a231add7f4cd395b275207606a19b2a35e5a0b7a6a81953c8ae082445c53101dc5dfcd08ad099c830267040fc1a20e7c41f23c204dbea180221503d3d547cd9414711d39c30b2207f8a51417e6623ce3db7d52b271a25fe9115af4fdbe330b31d8f5577ba985d542a69a146d695945b5d086b3e6c7d333b39d9b8cf84656c30d9eb7aa9d90855667269be0608c8f55f4b7bceb74b88ee3b27881540ceb878240240f6e58e18a3522f78e021a66d48e79a09846a8a7596af8783ea64b71ea4582d1290070ae13a81be8e604fc1bb121027b6865754712dc1cca2392563a6c853cc216d04091d88671ee12b13a1e51a8e8123ccb25557c60f769107f1a092466c386835de0e5406f808dbc356ceb47571ab008c6a3e629a476783375f86bea9f799a6180efcc9a46761ea14f916da296599cf2df369b7f938bc22373b996b3ebf1b2910a1a7c27aa790afc67211ded877e2e4eb2da60a58c3ed549452515651d7c8f1574ed945107c8a4cccdd072640cb49e89941619b09623ffec2e8560697ae866dcbbf13f62a8df026d92a047f5f04cb259c03ad34f7d56d8ebc0e060730b4615696ba76bc4487e3611e9bd31f4efa37d4ba91f6286fc410122b4b54675a209b512bede96a8b7fb5b720b3d55242099d6524a6cfdf8822adacbd3ff11e7fa7f916fb1799c38dc45b36ed9ca7927106ce0725b88158948c75afd9667d63cb55a0266fd7acab2412a095fb392d68295186674649168718d850470ab3caed63a21295ca6aa016ccd1bb6fd47449c7938dcb0e538da5ff29c81c65f9b2d3ab32400a03959ddb824e005efe67e0d339187f74a8abfc7ab2150a8281a6081827bcf2ab0dc26a6a79a01b390dca9af3ec8087bd79a90de6f298e92a926112a238281d2946c91411fb534988b03fbf0286ee6bbdaa2fd08afe0e2cbf4064067e8148905bdd0928345f55776fbec02a7439c56e7c4681cdd4acaad59d82a0fa8f03d25c798d5c752a437c9a3dc16901e0f8c2b738f68f886b2ca5b5597e86a51931932be5180f0daf2545fa9c6ba2b5f8e66dcb23b7ce36a0780eb55c7077ac452fb67347c4fcb3d134bab3f565d17fc3b65b655f3480ea5d434aaba69b0ab257c1b05664167e413a4108d756b086dc6edcfd9b58a8ed1eebdde88983f485381b021b5fbf28125c9b2e6638b937899b97fe39b373d6b5fae5a191b49166e0087329a550e7aa76ba5071ba1dd655d864cc9d9967f32767f0ccf4c107ae605d5159ade42a3dd57895d78b69fad33f9b87eccbadc1dc474a22dc1b241f7bbffbc92a3135f984de5bd7a305a5aecc85c285e557092b7536faaf328d2332cbf4011180d6018e5fc3855b02f52925126a6fa810cfdf1c3502cebe0033b5bc88f0a9bf0878974924f4a5938e85ba95ec22989b2478466e41711bbc32a6faa3795869b8cd29aadf11ca7244e2e4ffe2166b1c4acb9419ee580256e2dc4108dad620b125e72de6e6b68b127a54d8c30062c74ee004a9cb5dbb98bd3e10b273b67403f087eaee84f6a243b086e2699243b071813cda8c18e966e4e093b52fbaebe882adf70f5343d9d9d3ae629619b4425a9c900d70ac7b2bc82df38d31795a0a54d1099342203fbc0dbd92181789d68c6772e4a718ed3baf3891531e94f1537660cce27f232f0ba7c571e515b51a1b830dd390df0242b0ba9230cac699b8003820728deaada249a43947916528d2a85c40969f04fe115dcef7f8d17c5dabde43c7737d01e048ecf852fe26e0b9638d3e7cc8bfbc35e6d444f354d530919cb269e64039171c6d08924b4aa9401b981e6a623972ede282981715a38846e18dba9d74c7659b4e9de0937ba477713658db369c3f22921ea9e51fdd36137da6fa9e1c7ef97c6811a7c5a065ca966c6356ad101226c9f97e48a9a8ae708a510ee12eeeb4281dd65c910f50ae5398b1d87fe3b041ba0261bd5ab8a30e6acdfba5e0c55add654ef7df30f2ef42367f2dde4a40a0caebad68604fbb8854eadc7de600136a70ecbaffa9344cead74afdee4cfb2a0cbdea688a6d5ce28f8e7b6ccab756cebcf9edec13f8b793985518eb2b4843c5e68df8d74a88471a4ccb91486e69e9da46ccade7e8b2e23b9b94709ea907b7a6b183530b69cd8e0ac94f9d2102fbdd72f8fe6891d9ed7bd069134f2c7846473b8effa8c61e7e15988dc945f9dbdd3edaea5e734b03b3f410e7eaab0e9b4c1ab2ccf7d46f766b2daa25a64a6277b4ec05643745fe3b1ab5f30a1482d9920351907a4f178490d0581617217186d9035dfa16688bdf87231917cb6320b57d360ec34559c062d96a768f6763053664f2d14ac9d102efe99f94317f2e20e522d478e138222c4553919a8eae77ff748fd041f0b4b4bb638856e5366ddc1571bee78843c3dc0229858bb21da3cfb7eea31df7d7128f5be167ddb136bc532cde02e46b99294999fb5cb073d35bc658a62c94925e2ac7879c297ab7f3180a6da95ff8307641c9a14500d5ee81642ce79f23aa5b2e177e75c22e88d935c03b24b2e61d176070dc8f37a41c9e267299ee15b630467f5bf17d9373c0c7c9c1c56abb12ae759b1b70ed88491511b318e0bc175c472a5e8a4074e64fbf48160d23dd2b1beb321a723ce6f23411ff0ae65ee9b37b2ec5cb76ca783ea10de8fa5161cab1927121c86c5feb69c219bb203d7efb77a70af09c480cbf6bb1775b19fb1bda766cbdde07d6f903a50e9374b41eb531ae8c2d729560219e94670b574af4791e6bd7e67d6212db8eb4d1d1009dd4de56767090166707fbf9e876169b12cbf76879b72301a828dc91cd9ec296543527212883e3a9c6768e9881ca9da363259235767466d533190674fffc6936405802d6db9f601baaf72e74a0fe3512d968bf2ad5ec2ed457ebf1e6f03f8b6b58b44b97ff6a3cebc45a6eb8a3305bb0368b9b75195df9f63cfd54d8c81bbadb0495631dd9150c88cc57b968d63b2b50ad47897f651f03fddbd1ed4bdeb3cdca0165aa54d026e95e3b08eacec0dfbff2581e257b6209b26a44bb2f8096acb6a676b3a75ba68ed14c0c16dfaaef2db62aa30ad87d96b3c1bdbd942c6c35c6ef1180b0357e523b48c3423f1cf74ecfb4867ec8918ed3a1ddbdfcd477a", 0x1000}, {&(0x7f00001fa000-0x16)="e6c75fff76f35e093caaebb15d7faf8dc010593c3bc7", 0x16}], 0x2, &(0x7f0000daf000)=[@sndrcv={0x2c, 0x84, 0x1, {0x1, 0x6, 0x800a, 0x6, 0xfffffffffffffff8, 0x548c000000, 0x2, 0x101, r6}}, @init={0x14, 0x84, 0x0, {0x6, 0x7, 0x85, 0x1}}, @sndinfo={0x1c, 0x84, 0x2, {0xfffffffffffff801, 0x8207, 0x2e, 0x1, r7}}, @sndinfo={0x1c, 0x84, 0x2, {0x8001, 0x4, 0xf8e, 0x6, r8}}, @init={0x14, 0x84, 0x0, {0x9, 0x0, 0x0, 0x1}}, @sndrcv={0x2c, 0x84, 0x1, {0x2, 0x0, 0x4, 0x64b7722, 0xffffffffffff7fff, 0x1, 0x3, 0xfffffffffffffbff, r9}}, @sndinfo={0x1c, 0x84, 0x2, {0x6, 0x0, 0xff, 0xb8, r10}}, @sndrcv={0x2c, 0x84, 0x1, {0x8, 0x4, 0x202, 0x1, 0x9, 0x7, 0x7ff, 0xfff, r11}}, @sndrcv={0x2c, 0x84, 0x1, {0x3c, 0x2, 0x8001, 0x0, 0x47dc, 0x7, 0x80000000, 0xffff}}], 0x18c, 0x800}, 0x4) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r5, 0x8008ae9d, &(0x7f00008ad000-0x41)=""/65) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000516000)) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000e8b000)) 2018/02/04 21:33:36 executing program 0: socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f00000de000-0x8)) mmap(&(0x7f0000000000/0xff2000)=nil, 0xff2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f000003b000-0x12)='/dev/snd/midiC#D#\x00', 0x1, 0x20000) mmap(&(0x7f0000ff2000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000ff3000-0x4)=0x1f, 0x4) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000fe2000)={@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0x0, 0x0, 0x20000000002, 0x1}, 0x20) mmap(&(0x7f0000ff3000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000833000-0x10)={0x0, 0x3f, 0xfffffffffffff001, 0x7}, &(0x7f0000ff3000)=0x10) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000009000-0xc)={r2, 0xed, 0x30}, &(0x7f0000f52000-0x4)=0xc) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f00009cb000-0x20)={@generic="e35302faaad9ec74b36bf29f7fa057f7", @ifru_addrs={0x2, 0x2, @local={0xac, 0x14, 0x0, 0xaa}}}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000012000-0x20)={@loopback={0x0, 0x1}, 0x0, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000fe6000)={@local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, 0x0, 0x2}, 0x20) setsockopt$netlink_NETLINK_RX_RING(r1, 0x10e, 0x6, &(0x7f00007f3000)={0x7, 0x4, 0x80000001, 0xf0}, 0x10) 2018/02/04 21:33:36 executing program 3: clone(0x0, &(0x7f000029f000-0x1), &(0x7f0000000000+0x1fb), &(0x7f0000000000), &(0x7f0000001000-0x1)) setpriority(0x1, 0x0, 0x0) r0 = creat(&(0x7f0000534000-0x6)='./file0\x00', 0x8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000001000-0x8)=0x9, 0x8) 2018/02/04 21:33:36 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000d06000)='/dev/sequencer\x00', 0x4801, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f00006d1000-0x48)=[@in6={0xa, 0x0, 0x4, @ipv4={[], [0xff, 0xff], @rand_addr=0x1970}, 0xffffffff}, @in6={0xa, 0x0, 0x4, @loopback={0x0, 0x1}, 0xe90}, @in={0x2, 0x3, @dev={0xac, 0x14, 0x0, 0xe}}], 0x48) r1 = socket$inet_sctp(0x2, 0x5, 0x84) mmap(&(0x7f0000000000/0xe62000)=nil, 0xe62000, 0x1000004, 0x32, 0xffffffffffffffff, 0x0) write$selinux_load(r0, &(0x7f0000da8000)={0xf97cff8c, 0x8, 'SE Linux', "3a8fbf1b8cb1f704107c"}, 0x1a) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000fa5000), &(0x7f00003c4000-0x4)=0x8) 2018/02/04 21:33:36 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) sendto$inet(r1, &(0x7f0000fe4000)="05dbd449ffab78302fffdab1e216dd6562d0f1fe4c912d5ce21d26a7561346ad8d2771ddf9800ec49f96291cbea1e025eede8dbae38e28829e0a4cbe6444f01f2cfd34cc70a365430af28dc5addd1c0bc92dc3c6c8bd35226ffd876c52be3c3be3322d3a18e22462a25ee91a8f63591a2a4393a7ae234a0467d5d5580d4419", 0x7f, 0x4000000, &(0x7f0000e15000)={0x2, 0x2, @multicast2=0xe0000002}, 0x10) r2 = dup3(r0, r0, 0x80000) accept4$vsock_stream(r2, &(0x7f0000b4d000-0x10)={0x28, 0x0, 0xffffffff, @any=0xffffffff}, 0x10, 0x80000) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000a03000)=@filter={'filter\x00', 0xe, 0x4, 0x394, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000), {{{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@ip={@multicast1=0xe0000001, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0x0, 0x0, @common='bcsh0\x00', @common='dummy0\x00'}, 0x0, 0x70, 0xa0, 0x0, {}, []}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1}}, {{@uncond, 0x0, 0x188, 0x1b0, 0x0, {}, [@common=@ttl={0x24, 'ttl\x00'}, @common=@unspec=@recent0={0xf4, 'recent\x00', 0x0, {0x0, 0xd5, 0x2, 0x0, 'syz0\x00'}}]}, @common=@unspec=@SET1={0x28, 'SET\x00', 0x1}}, {{@ip={@rand_addr, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @generic="05df19db18153787adb78e5959c5635b"}, 0x0, 0x70, 0xb0, 0x0, {}, []}, @common=@unspec=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "ba17638f3d8ac8ba91ea223f44c74da27f00efdc77823596242842b1764c"}}}]}}, 0x3f0) 2018/02/04 21:33:36 executing program 7: socketpair$ax25(0x3, 0x7, 0xcf, &(0x7f0000bb6000-0x8)={0x0}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000002000-0x9)='/dev/sg#\x00', 0x1, 0x200100) tee(r0, r1, 0x2d3d, 0x5) mmap(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair(0xe, 0xe, 0x9, &(0x7f0000010000-0x8)={0x0, 0x0}) mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000003000)={r3, r3}) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r3, 0xc0485510, &(0x7f000000f000)={0x1, 0x6, 0x81, 0x5, &(0x7f000000f000)=[{}, {}, {}, {}, {}, {}]}) r4 = socket$inet(0x2, 0x806, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x1000000000000001, 0x31, &(0x7f0000002000)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000), {{{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@ip={@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0x0, 0x0, @generic="24fe55d8ac7075e023e0824d7ad39d7e", @common='nr0\x00'}, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@ip={@rand_addr, @rand_addr, 0x0, 0x0, @common='bpq0\x00', @common='irlan0\x00'}, 0x0, 0x70, 0x98, 0x0, {}, []}, @common=@unspec=@TCPMSS={0x28, 'TCPMSS\x00'}}, {{@ip={@broadcast=0xffffffff, @multicast2=0xe0000002, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @syzn={0x73, 0x79, 0x7a}}, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}]}}, 0x2c0) 2018/02/04 21:33:36 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000082000-0x10)='/dev/sequencer2\x00', 0x630000, 0x0) connect$llc(r0, &(0x7f0000e4a000)={0x1a, 0x19, 0x4, 0x1, 0xffffffff86ff18d9, 0x7fffffff80000000, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x10) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000050000-0x50)={{0x3, 0x2}, {0x10001, 0x19e}, 0x100000001, 0x4}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f000066e000)=""/176) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000aec000)=0x5, 0x4) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) 2018/02/04 21:33:36 executing program 6: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000001000-0x10)='/selinux/access\x00', 0x2, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f000038f000-0xe)='/selinux/load\x00', 0x2, 0x0) dup2(r0, r1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 88.683637] binder_alloc: 11845: binder_alloc_buf, no vma [ 88.687838] binder: 11845:11859 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.693338] binder: 11845:11858 transaction failed 29189/-3, size 24-8 line 2957 [ 88.711789] binder: undelivered TRANSACTION_ERROR: 29189 [ 88.717299] binder: release 11845:11852 transaction 251 out, still active [ 88.724278] binder: unexpected work type, 4, not freed [ 88.729572] binder: undelivered TRANSACTION_COMPLETE [ 88.734751] binder: send failed reply for transaction 251, target dead 2018/02/04 21:33:36 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f000064a000)='net/if_inet6\x00') r1 = syz_open_procfs(0x0, &(0x7f00008a5000)='coredump_filter\x00') sendfile(r1, r0, &(0x7f00005ed000)=0x2, 0x400000ff) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000be6000-0x4)=0xffffffffffffde93, 0x0) setsockopt$inet6_dccp_int(r1, 0x21, 0x3, &(0x7f0000430000-0x4)=0x1, 0x4) 2018/02/04 21:33:36 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) r2 = dup3(r0, r0, 0x80000) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f00001d3000/0x18000)=nil, &(0x7f0000e0e000)=[@text64={0x40, &(0x7f000085a000+0xf5f)="48b80b800000000000000f23d00f21f835100000070f23f8b8010000000f01d9440f20c0350e000000440f22c02e660f013e480f616a0df20f2324b9b00600000f32b9800000c00f3235008000000f30b9e30b0000b84dc9c251ba000000000f30b9850300000f32", 0x68}], 0x1, 0x1, &(0x7f0000a01000)=[@flags={0x3, 0x80000}], 0x1) close(r2) r3 = memfd_create(&(0x7f0000b3a000)='\x00', 0x1) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000561000+0xab)={0x1, r0}) syz_open_procfs(0x0, &(0x7f0000237000)='net/ip6_flowlabel\x00') [ 88.738806] binder: 11864:11865 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.761957] binder: BINDER_SET_CONTEXT_MGR already set [ 88.782945] binder: 11863:11873 ioctl 40046207 0 returned -16 2018/02/04 21:33:36 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x20000000000000a, 0x800, 0x5) setsockopt$ipx_IPX_TYPE(r0, 0x100, 0x1, &(0x7f0000e1b000-0x4)=0xfff, 0x4) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000128000)={@multicast2=0xe0000002, @empty}, 0xc) 2018/02/04 21:33:36 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fsetxattr(r0, &(0x7f0000001000-0xd)=@known='security.evm\x00', &(0x7f0000002000-0x1)='\x00', 0x1, 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000000)={0x0, {{0x2, 0xffffffffffffffff, @rand_addr}}, 0x0, 0x0, []}, 0xfffffffffffffca9) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000003000-0x4)=0x2, 0x4) r2 = syz_open_dev$midi(&(0x7f0000002000-0xb)='/dev/midi#\x00', 0x0, 0x101000) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000001000-0x4)) 2018/02/04 21:33:36 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dspn(&(0x7f0000bd4000)='/dev/dsp#\x00', 0x1, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000001000)={&(0x7f000000e000)={0x2, 0xa, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/04 21:33:36 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f000063b000-0x10)='/dev/snd/pcmC#D#c\x00', 0x3, 0x100) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000267000)={{{@in6=@ipv4={[], [], @multicast1}, @in=@multicast2, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@empty}}, &(0x7f0000b22000)=0xe8) bind$packet(r0, &(0x7f00009ab000-0x14)={0x11, 0x0, r1, 0x1, 0x8, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0x11}}, 0x14) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000004000-0x368)=@filter={'filter\x00', 0xe, 0x4, 0x2a4, 0xffffffff, 0x234, 0x234, 0x234, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f00008b9000-0x40), {{{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0x94}}, [{{@uncond, 0x0, 0x70, 0xfefb, 0x0, {}, []}, @common=@unspec=@SET2={0x30, 'SET\x00', 0x2}}, {{@uncond, 0x0, 0x94, 0xb8, 0x0, {}, [@common=@ttl={0x24, 'ttl\x00'}]}, @common=@unspec=@CLASSIFY={0xffffffffffffff5d, 'CLASSIFY\x00'}}, {{@ip={@dev={0xac, 0x14}, @multicast1=0xe0000001, 0x0, 0x0, @common='ip6gretap0\x00', @syzn={0x73, 0x79, 0x7a}}, 0x0, 0x90, 0xfffffe65, 0x0, {}, [@common=@socket0={0x20, 'socket\x00'}]}, @REJECT={0x24, 'REJECT\x00'}}]}}, 0x300) 2018/02/04 21:33:36 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f000011d000)='/dev/ppp\x00', 0x40, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r1, 0xc0485510, &(0x7f00000f8000-0x48)={0x9, 0x4, 0x1, 0xcf, &(0x7f0000b67000)=[{}, {}, {}, {}]}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f000065e000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$KIOCSOUND(r2, 0x4b2f, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r2, 0xc008551a, &(0x7f00000c5000-0x14)={0x0, 0xc, [0x8, 0x7, 0x7]}) ioctl$TIOCLINUX3(r0, 0x541c, &(0x7f0000c8d000-0x1)=0x3) [ 88.801475] binder: 11864:11882 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.823242] binder_alloc: binder_alloc_mmap_handler: 11863 20000000-20002000 already mapped failed -16 2018/02/04 21:33:36 executing program 7: mmap(&(0x7f0000000000/0xfe6000)=nil, 0xfe6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x100000006, 0x0, @dev={0xac, 0x14}, @remote={0xac, 0x14, 0x0, 0xbb}, {[@timestamp={0x44, 0x4, 0x5, 0x0, 0x0, []}]}}, @tcp={{0xffffffffffffffff, 0xffffffffffffffff, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, {[]}}}}}}}, &(0x7f0000754000)={0x0, 0x0, []}) [ 88.852183] binder: BINDER_SET_CONTEXT_MGR already set [ 88.862154] binder: 11863:11899 ioctl 40046207 0 returned -16 [ 88.879242] binder_alloc: 11863: binder_alloc_buf, no vma [ 88.884887] binder: 11863:11886 transaction failed 29189/-3, size 24-8 line 2957 [ 88.896889] binder: 11903:11905 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.903977] binder: 11863:11873 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 88.910504] binder: 11903:11905 ioctl 541c 20c8cfff returned -22 [ 88.926091] binder: BINDER_SET_CONTEXT_MGR already set [ 88.941239] binder: 11863:11910 ioctl 40046207 0 returned -16 2018/02/04 21:33:36 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001000-0x9)='/dev/rtc\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) connect$ipx(r0, &(0x7f0000000000)={0x4, 0xe72e, 0x30, "808bdb104409", 0x7}, 0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000e97000)="330336bf07d9d863f97a91c49bc2bf3ca1627528f2f443", 0x17) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000a0c000-0x11)='/dev/vga_arbiter\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000630000)={0x0, 0x9, 0x0, 0x0, 0x81}, &(0x7f000017e000)=0x18) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000844000)={r2, 0x8}, 0x6) pselect6(0x40, &(0x7f0000e78000-0x40)={0x3ffffc}, &(0x7f0000768000), &(0x7f00007fc000-0x40), &(0x7f0000c99000-0x8)={0x0, 0x989680}, &(0x7f0000f14000)={&(0x7f00001da000), 0x8}) 2018/02/04 21:33:36 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000fb1000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r1, &(0x7f0000747000-0x10)=[{&(0x7f0000012000-0x1)="b1", 0x1}], 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x4000) readv(r0, &(0x7f0000e81000)=[{&(0x7f0000fcd000-0xb0)=""/176, 0xb0}], 0x1) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00004e5000)={0x0}, &(0x7f0000ddc000)=0xfe3a) r3 = getpgrp(r2) kcmp(r2, r3, 0x3, r0, r1) 2018/02/04 21:33:36 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000a57000)='./file0\x00', 0x0) rmdir(&(0x7f000042c000)='./file0\x00') listxattr(&(0x7f00006ec000)='./file0\x00', &(0x7f0000e12000-0x80)=""/128, 0x80) bind$nfc_llcp(r0, &(0x7f000049c000-0x58)={0x27, 0x7, 0x9, 0x2, 0xff, 0x9, "7500cc1bfe940f0891444c12f01e84b4f8b66fd40f5280491faebace5748e0845c2a62a393301f7faf3971bf936eef59531601e4ceca3609de33994fd33b6a"}, 0x58) 2018/02/04 21:33:36 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) remap_file_pages(&(0x7f0000855000/0x2000)=nil, 0x2000, 0x0, 0xffff, 0x100) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f00006dc000-0x8)) bind$inet(r0, &(0x7f0000dca000-0x10)={0x2, 0x0, @multicast2=0xe0000002}, 0x10) connect$inet(r0, &(0x7f0000adb000)={0x2, 0x0, @loopback=0x7f000001}, 0x10) r1 = add_key(&(0x7f000053b000)='dns_resolver\x00', &(0x7f0000116000)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000604000)="6ecc9b311e4ce2e8098502f0dabbf649db299371fdf232bef2eb95499f132a3cdc78b4b72c418cf9cb5e95a07f7e3f6af62dda5028521ad896d2c382eb87329f39ef058a5b7487453de341d536e000199b993d50db28b37b5d305ed84c928e8b0c684a41261bc947bb457ae024f490d10501426d47265d56f365364a8f1706a6f43dd880374a618d7738cd73b65771768300f99e20e0650ebc497ae16d9f3cd54146900f3d5ad5e3e486289b34b0687bddfe930fe43dc247132f", 0xba, 0xfffffffffffffffd) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000d70000-0x6)) r2 = add_key(&(0x7f000095b000-0x6)='.dead\x00', &(0x7f0000e8a000-0x5)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$instantiate(0xc, r1, &(0x7f0000864000)="b0d99628179a246706be1b234dece092b5e79ebbbca339a1b769cd208c3e4c9c3ef051b70623229301046a18c5e2d7f6c3f751ef8db2eaaf7a557789609e0f4ad3f871d3faaadec116d3271d08b0626a87d2ff4009099153345bacda7a65da8a04ebfa7bf2ada869372d677bacba08cf7270cfee8fbde99f57f43952a31bbacd74d3da1227f1f059de65e804f95cf557d83a20eaedd7a4f1487d2435f1383ff4b5923a8fb5f5be7ac88762a193a32f8aeec966fab0e019bb71ceddca8c6514d59afdc3a708e2531e039861d47880ce868d930a9238fec2ffc9d0095e9c8ecb85b3bf487242f3d346279cc96d6cd871fa797f86fdd47af977f7817900e1b3df2bca811884b2e17aca668b273024e514e02987c03f87d2d4fc14de486b9b6177610b6d24bb10defdf17913645a4b3f5c0aaab21fd5049a40c84800d2372ad0c6ee79c5b755b04f3e12351ccc848d40bfe17948c8e1ffe99397f46ec18718049072e5e68da7ac9c19429571d136ae8aadbb2087ea3e32c047fa3725ae0075788baf7568c7de84d6fbbe86a4b8a544f71cbd6d7313909eae96b9b398d4b59f2b7a4139c044a6edddb15fe892594ec86236322673842525fe94d1a40464db564bcf7016e795c490505f97fbdbc40aa5dd8d66f07393966b8bcdda51a3d251d902db420ed2d1edd30e34a2ffe26ba29bed6af3382f1d78d01a3f65d5b2a831b8aeff8dc4c13bcb78b49eee08c9867a424efb058821757dbafc7192d00c7f6509a41d5f42b7fff80cfb892c6e8a614864398258c71a296d35f14b9d2e4f55aaea5b7db6df8d97a6fd9fcef131c3ddd0ca3ab504b0c1d9e7cef3451c9208727f94230270ba1071df7b24509a5610910e74f896465a83a14a4be53ed1ac63925d75fb26ecac713ef061555448fea23e74e24d6f4ea6c65754916e867513fe2e18435342efb5de470e3b7c6fad8ddab5dc650295021338014eaf7e30e6ba956cd4b3a3ed3a1d21ee77d3cd67cbff0c7f10965e1b41e1e6d6258179f0b78c352e68255faa0239ca86bb875ce4ab403aa7cbadce59b37d2ebdbec577ff7d2024185ddbdbe11f8573bfd36e8e9508ed37543cd5e739ee562bbcebac91700fbce59413e0562496034cc87e600d1b752a32e0f7e5d72baaf34c4937f7cffa52fd77e8fed72fbf3518108c6c6109387239f8bdc2835c56f636668b6c20f717c672aac4bf84aa657f85c9458cc948bdaba7ba389664a8032cf77b4ff8b2502165799f7b2d6feb5aa2b47e3eb12848d7b8e511bdde9dd206d09ecb47428ba11e9c48d0d96844a83be8145e1b08a3d081bc92df83bb590335bc387ebf47f7cf14641b4e62cde0f5757ae8a1e0adeac8c1c6588ccc1b5e615f0dc1075f21371ac89ff1ae0cf589210d90aaa8c55afc7d38775b45da7360411d17764d5b24691e16984314ef47f628109374c1d5aa9b77d7e80f7972e0bf110d08920a99e4d10260390c5112aa88a45850d6ecf04c3c0c296beb80f039f06ebd140997e234092de86d18fd83bafac019397dc43a1d452c71fa35681a84ec4123f86536895d87a16e0d25e22a767082e91bb872320420bfe51f8ff825060d7fb0eea0fb4600893ada8db8261f413b820845e3f6735cf43c7d8fefdbe7e066f14421bcdeeb74a373e606083abba8391a89e55e367244e25a924f6026a1a4a3f9aceba9ed45eafbe9ec14c4045e17df5b73f0ccaa5d3b6b48696b74ad5cd6c6773ccffd8aec2c9228996e29eaea4117844d0b7ffff8c0768c62c6412f23ee42f870b45702fd57c982f24b75895e1dc7a231d2f6bd5c96a1d9cca373f9f154498c2b24cc750f8429cc5e927d7c4d2684ac4b2b2981816cb239ce60468c62a808a3e63937ac1171c62cc3b6a11ae915999b71f7de8f526a91eed928a7c0c83188547497683a82009545a9921e4dc6f55fce61a96b2409f7ec1ca95b45791eff5eaa704046745dde9591cea105230c055d3115b33a6979a70da5b005c0991e0519662dfb922c2d6b2bee8f7a07d8d9bf0f26275c32494a4d7ddbe61ffec5fc3e049011c04beaa2923bf92104fa24e5254e087932b5ef790e32b89593cefc9bc3c0e2876b6b1ca3108c8cade20af0daccc2211af04d3c3c14756ae17e7fe6c888141e55ecd6c64284629528ab971b9768977de08412720aa1284a3e842bf945b820fc5e6a50b5045365b53de7f1d5c7d24abf0613c5ad23fa4deb93b61e4998ac88e3ba0d3389a2b9867ad9bf0e5282ebca163490e1fd060deffea41ffc7b8d4957b6b3e7453ab4bc88a7861d3d9607bf5a99e8e9593de41e786c2db80b912e85066dd6f3b30408dbfa4c56b6ad5724a6a3b6fa462c36c09aeabffdba22f55dfd731a461e4b1d9e83d4f612c802445318c5329faabfcd4a73989de9c5e2215dc601331e8c92bba6d1eeece90b01293c6dc1eeabc9327deec3512119b1fd1f2af3a5fef71a2efbef02490c464dbaed3ed646c8286b62df79974d091c9dbdf2d041be0643d7ce39b1e0885b70e9b93a8f02a39d03b323490b24def4e488d138c03b6244698a72575c068a145e02898910241394ed2b14aef1709ccf20b2954eab8d4a868e049eb1dab523e659bca0098bb030d6ee3a0c2b4a1945e9401bee3141c4e33aca8b92de54d08fe14919a95a9954eb8889a9a4a1d15595544af9162feb514c85bdb45f68c10eebd6feab3559b8b2325298ff753571bb14c8ad9c420f002c4a8aef32f33da886c7ae759ed40b0bf799e41125ae9e883071ae1fba88cb75dc6d3aca08e442cedfb8412f0712a916bd9462dc8ab09cb292ee97482e8520289a17312ef13e905c845420c31fd50a258725bab23284a7a3fda7f91207e6d9f2573c73c3bb98904aa586dc83237697b1e067e563752019862ebb6e7a6fafb5799392b45d4f9dc5db471efff9dfadb75e0e43db771e79eb668fbf1fa82cff244dd0079b005848b7bf7dfc49b22aa26f1b6dae6476db40dac64f200465d8a36991a0ce85c3c5014fb0acaf6d94d736869ad942c4bfdcfe9c7f7d1acd667413ee12b9514af2d95fa9f4370bd33c3ccfdd0135105399826282630ef97e8c1df4cd054095ed5fcb8918eef835ed87bcefc5facb437f1ad12ff94b97856bcd721a625562ad4ccc565f625a10d7f8cb5c51908bcf7555232345c960464ce5fa3b99412f1d2a6a56908eb977acdf444df586a9c7cc5012785b27ff2a474352dbe515320799a26bd9fe4f232a77f3bac2144b3af2b88adc1d8289e203e2426fa26644d35db3138571f630c6eb741ba57a7c98eb223b813d7e8fcd8c882d6838b0f7ffd8aa030d3bf6a51a69eeb09c056d631a3dfa939830066237c14f0c8618e66f1d72b0d974f23b4515f2ba4eaa90ee1f13326b343dd139e60e0c738ea194f66610f6c1fc1dac4f31345ba30a9279d0effe2313264e3e760788511991062b85d28a7a6b4bbb9f5737343c3787f5523b2d27807d361784276cf7d33233e1760876ed3189de060d0bacb084cada78ce8576ccb3b740eb36f671f730b8f06521f2e18b3ce1d754320a828c07d74c1d4a902f9551f36170c26accc500748c758ce1900587d6125640446b98cf85f2f5b9f1b0f12129a07eb490889cd7539c2612744adfc0175ff254e502c457c1bb247276b40f5b90f115f00f2292e259da0b64d3009cc1853a6cb02ebd202a10dd4e2b588601245fcfbdc06d7b4dbd6696a9ae0d543d0d9437065ceb9ef28266d5e90a3c5d07ce5218bfd8675c5f9b2076bd25ff9dd48cc6fde99b21d7abea54928e9a73a31d6e0505d895cbc91d9bea622a3ba6cf144bf41bc24e97bebf47ce15dab8562741a6e81ab0327b9812fa8b588c5b2bdf96b8204bbcda4928bba77fe1a1764e3ffd880acca3c6ea0a493002e5a8df439865df6d098bde10551aec67c3c3a25ec1bf8d71f22aedb56c04ef16d1cba96885fc9b91894fd08ef3e4b3f8aa7afd48d055ff52199170117465e3660a5dc22b0b134684d7ed4a0af0ebf7e82b94f16fc5db6a908cb416772acb259e0da11fad0ff63e78ba5c6c809edb0a8f381e595959a9638dd54ce50b55bc4a7154302a116db809bd023a97bebd9f77355a506bc2588e2fc51e1424de7481f565a9448b7080306581669e31ce97224b0f3c1c38a19888f7c7483b682bef633418bdcb3f92727bc7711340ce3be6320c4b8768979ec10c0fdf8d4bc9b1ce800e54552ec128739af27f5d0ceb78908acd4936e87a7a3e1102ed5e1df5c058352f36207598dd5e36be842879f3f71f65ec3a945e78cf42bc7805bb4802e598a6337d6eef4874e83c2ad82d918125e9a93c760b2306d78f067ad1a90d763c86c617e7da2083733601dfde59279d1dc2f92fbedfd9e238f8beca876f0de3bb0220a3e74e4c86d3fb02bd41e5bfbe990332a371bb58314f4261e9a0e97dc638459e509604c400e95fe17f75e4169150a425423c660e21da028ee2aa3bb6cb1f5b95f2135c6dc5b6a219a68eb872f926a3cc42b18a1cbb407fdbc1579756ae53617a7b251ba0ef383e590d3134f869254b19741267e923c59496db972fd3ae4a88a498a2f43575ecdbcea047e6e93767a351e6e33d5f6a1e2f42ed0a3e357348d72bab44065be8174ecbd800d6fa3ecc6c438ac2c5bbe93cfacd3cc45cbd44bc15ba504f65cf0548e38eb094c80adfc0a4df754858264670b68f244589600c1a38e3349502674ee56e4826c58d83579ff82d46f889506fc270be0cab821f12a766f2fb1466be1d7b9dd82bd3134d1e38d5ef8866aaf1ab48928874af6cd3742b9ef248743c65c1b74cdef373efb90cba1cf997fa10020dd03f5e339907552806b6888b4d9a293a2ded4913b99885c1bb0a527d1da84ddc8b920ca93243cfe924f2c86b5052a9c9cb36be547cb303d64c2f6b0ab44375fa49e1a2e7e37d1a04bfe1968ac84291fa917e9d54ded1c6926be900daf3f360f8ce7b0b94be5b0ac7ace999b69028c9d0eb4f94c453a86f040b6a223be7603efd819f4692203b3f252d30a05b478d044e5bb8c23e4f052bf92aee2105d8b8fd6ec654f36d3ddf91bbae40b333ca771a4eba0aa80e815275d89ca4052c6b7d7de18df7703585e28343b0d52864676e212ecef92f4234247516310c532d9073df8e5f3716dde71c1533b6df086df655f3659484bd61a240edf85ed4db695498433c51bdc6af9c8165f6928133e0711b937543d21e3d8cc1a472ea00e5466a277c6232ebb8d082c77b41c4dcad39cc6a2f20d78e4f4e8ff10168ec56953a26a983f80c2c205e3ef97a3b1ceb7f020f78435e592a6118cbfa0f6ba8e424d3f1d7646bfd2061488f949de5ed00dc143660b9179ae721994d3054316b782c4a41ace30950c710eb5baa56c36586e64857884f763bdaad77c719a5647147a4b3c331b1cae2f294596e23b37581ce87c4fa0d2ee94a95f53a532716f85fff2796712ae2387efcf8b34db7c5bdb0c84f4933c666943058d0710c7f214fb0f35fea2922575d289b35f39ef269312ceb5da3935f782872ede7aaa5f2fbd5d7965451c61c9c641c23a903ea024d08304209706cbce729aa99e48b3d1fd905eec0c72c69c28a56e602decabfabd34cd9ddfcfaad2944f7000a178ce4cfe5b416b36414e4bd1577b36002feba62662c06df9f0a778b6a3b44ea1f934df706345815827a121185149eb85efb1f202215213070716d1a11915947331ae0155558f0407efabc833d44a9a79153dc1c1a792434e37c9cea76af400e1c8c9f5f80a3f2d1909a8bcc829958ddc291f4e11d654608", 0x1000, r2) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00006c3000)='/dev/ppp\x00', 0x0, 0x0) setsockopt$netrom_NETROM_IDLE(r3, 0x103, 0x7, &(0x7f0000d79000-0x4)=0x3ff, 0x4) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000c1b000)={0x0, @in={{0x2, 0x2, @remote={0xac, 0x14, 0x0, 0xbb}}}, 0x8, 0x7, 0x9, 0xffffffffffff1837, 0x5}, &(0x7f00002e0000)=0xa0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00006b4000-0x8c)={r4, @in={{0x2, 0x0, @multicast1=0xe0000001}}}, &(0x7f00007e7000)=0x8c) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, &(0x7f0000f3f000-0x4)=0x8b58) 2018/02/04 21:33:36 executing program 6: r0 = syz_open_dev$vcsa(&(0x7f00004b4000)='/dev/vcsa#\x00', 0x7f, 0xc00) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f00009eb000)={@common='bridge0\x00', @ifru_settings={0x1, 0x0, @cisco=&(0x7f0000ab0000-0x8)}}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bind$llc(r0, &(0x7f0000001000-0x10)={0x1a, 0xc, 0x10001, 0x1, 0x3d5, 0x100000001, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xbb}}, 0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write(r0, &(0x7f000015d000-0xa4)="84cbf52ff43850b1bbb6e40c1fe572ef2e19e5fd1eca05fc9955d5444ad88f929fd8003608fcbde40ae5ec83765426758bd7c7258a701648ea22c0a910765451855ab6f347cc613aa19c8c1323ac9cb62b9fce92811b41fae4f472b4e2f06d75733fdc39756a8ca43d3a5bc2ad9f9e207d0d787b5531608cc242282bf71f6c19c4a65028730767c248244c253f615ba8aa2ef19109f52058be703398f826627a7c0ecb7b", 0xa4) r3 = geteuid() getresgid(&(0x7f0000b63000-0x4), &(0x7f00006ad000-0x4), &(0x7f0000640000-0x4)=0x0) syz_open_dev$vcsn(&(0x7f0000cfb000-0xa)='/dev/vcs#\x00', 0x5, 0x2000) fchown(r2, r3, r4) r5 = fcntl$getown(r1, 0x9) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f000015d000)=0x0) kcmp$KCMP_EPOLL_TFD(r5, r6, 0x7, r2, &(0x7f00006f7000)={r2, r0, 0x5}) r7 = openat(0xffffffffffffff9c, &(0x7f000007f000-0x8)='./file0\x00', 0x0, 0x80) getpeername$inet6(r7, &(0x7f0000b50000)={0x0, 0xffffffffffffffff, 0x0, @empty}, &(0x7f0000c37000-0x4)=0x1c) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:36 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000019d000/0x1000)=nil, 0x1000, 0x200000a, 0x1010, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:36 executing program 2: mmap(&(0x7f0000000000/0xf85000)=nil, 0xf85000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1000000010, 0x802, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000f79000)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) mmap(&(0x7f0000f85000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_ifreq(r0, 0x8948, &(0x7f0000f85000)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_mtu=0x22}) mmap(&(0x7f0000f86000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000f86000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$nl_route(r0, &(0x7f00001b9000-0x1c)={&(0x7f0000f86000)={0x10, 0x0, 0x0, 0x400042a0}, 0xc, &(0x7f00009e2000-0x8)={&(0x7f0000f87000-0x14)=@getstats={0x14, 0x5e, 0x100, 0x1, 0x1, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x40080}, 0x4c000) sendmsg$nl_route(r0, &(0x7f0000f73000-0x38)={&(0x7f00008d4000)={0x10}, 0xc, &(0x7f0000f76000-0x10)={&(0x7f0000747000)=@newlink={0x28, 0x10, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r1}, [@IFLA_TXQLEN={0x8, 0xd}]}, 0x28}, 0x1}, 0x0) mmap(&(0x7f0000f86000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000f87000-0x8)) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000429000-0x4)) bind$rds(r0, &(0x7f0000ebc000)={0x2, 0x1, @multicast2=0xe0000002}, 0x10) 2018/02/04 21:33:36 executing program 5: mmap(&(0x7f0000000000/0x1e000)=nil, 0x1e000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001d000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f000001e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f000001e000)={0x0, 0x0}) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000011000)='/proc/self/net/pfkey\x00', 0x40000, 0x0) mmap(&(0x7f000001f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TCGETA(r4, 0x5405, &(0x7f000001f000)) setitimer(0x1, &(0x7f0000007000)={{r2, r3/1000+30000}, {0x0, 0x2710}}, &(0x7f000001c000-0x10)) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000016000)={0x2, &(0x7f0000003000-0x18)=[{0x30}, {0x6}]}, 0x8) r5 = syz_open_dev$audion(&(0x7f0000015000-0xc)='/dev/audio#\x00', 0x100000000, 0x2) mmap(&(0x7f000001f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000001f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000001f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000001f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000001f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg(r1, &(0x7f000000c000)={&(0x7f000000a000-0x58)=@nfc_llcp={0x27, 0x3691, 0x1, 0x3, 0x611d, 0x2, "ac3d6eb899519d5d3f22af4ab499a589c4c68c10bad3794bbcf726eda9ea4bac7c5e51af5ce0fff8cd5a2473d35e3a990361bc36c33a78df5805b1d312e910", 0x81}, 0x58, &(0x7f0000020000-0x48)=[{&(0x7f000001f000)="84e4a7b80530db9618066b4ebbc02b7d7e3b93686c752f53bd2e6b28ad5860d1cd3175cd21e9595376278fe58e194c8f2ba0c1a16e2085e8fa47937fb678a294bd3bb4a9f6df94412072ef792fcea977131e5f0489203761e19dc8297cf52a76db244e9f7aaf30530d09a95be6cc4c9bfaaebc7bb2853999d8f96f7f934632d0c0ba8fec49402a411ef88092a0ee9acc2f246b36addd6b1c4f1ada9c22c0ad78df9badb0258db519774ea3395e8542cf67373059031fdfa10fddbd379b49dad585d1ac8ebc7669", 0xc7}, {&(0x7f000001d000)="08812724bda694d288e1cea39551c1a19273a5abc1166c9bbc46b241c707f568531a", 0x22}, {&(0x7f0000005000-0x7a)="59e3617b05418856032de656aaae3d60882de8bc43635d7de46e0b638dca0a6ebc62398471df0650fa062198a7fb810823d16cc70f7cf7bf3fff9b8868634f680fc14c5ba016575b4f33449853dc4f472c7398723101267f7fda9b29519626b464ccb8abb0c4c156f3886f3652793196ff196ca8244417546dcb", 0x7a}, {&(0x7f0000020000-0xb1)="6ef7572263afe920a5bb1e3e7b94ac1326add545110b5cb421c8fefa120cdeadf57a6bc8ae9c2340b2349efa164b6380412f142baedbbdd84c70605c123116810e6e9b1505f5ad27c4e3329ae0279c9fbd8b8baceec33de1a8bda428b4b3ccc6ffbbf66b8ea7ac33793ae5828a1f6bcb895dc1cabbbde8e7f8276e94efcb4c64918a684e35a6f3d82e34b2f202f1ce6827cbf52fea5e55122a1a542ca472def9da346b5774dcb5fbda2491bbae4263aff8", 0xb1}, {&(0x7f0000007000-0x2c)="b37f9cb6fd478550e6cdb49f2fbd766b5cf6b70c5ac0fb3cc18a01132209926351cf3ba738f56c66c660b168", 0x2c}, {&(0x7f000001e000-0xb9)="5b687d21f0d67ace6c69fd9442c8cb2ca5af499ab3d1b4c5fe6b8f9bfbe173827d1b234dfdb0993d7e90e1b176dad6790633d56bcea7346eb594cd5b2d0b53ef33d840a18fcf489356ec590009ce0e12bae2034872296ac385ca504b8d90788502c8668ad2ee556420881ecc6812fe5683abaf7e35dad6581a6f10c445c7bcad603c03d6f8756d5cb349fc21adad9f2cc61928804eb944d702363b2ce70bd7c3841be81c0cce67fa14b6171d68acf496128dbaf5c26a28ffc2", 0xb9}, {&(0x7f0000011000-0x3b)="124ac6642f022a438a8896abd595f3e1d8035b4bb57854d73537d94fcc5be6ed5412105ca8099bbd8289fb5171857d61c549d12b0bcc2bb61b6d63", 0x3b}, {&(0x7f000001f000)="fd22fde3a4a9c64e8e9925712e45361b2866cb0bebfa453730a5ee6f744919c532c647f09635d9d7976b339e17f2a0b28219a38cb04d18a9ffcbeb81c8cd3625ad4acc29471eee61e24e07fe5d548bd2c9ce0192", 0x54}, {&(0x7f000001f000)="600f9709c5ca25029b291855c1a3bf69ddf1727490a5e4e651eff449f29b9fc45c78ab817b5233a412a1e92b13e2eefc06f0b421d0a17bde755f3715e3d72262d61f11aabdd0ed516165143eccb23a85061662e908a4e32334e477fa4d234f7668b0cb1c1315d4b97a44279a1d5e0ae58a4dd7da980edae4cfeeee18e2cff143467f02397c41275b12e9ded5d5e41f6093f9a40b8944cde67c80a44b7455004e0cf24a8717785690f9fcc42efc9b94dde763927886a02ce56f524ea25583a2a182faf0994ee3411140b9227a4e4faa3db8586b829b27c9b57b300ecd417d028d76c628aa0a74e858bfddd99fc872d71abc21d47de5199d71cde640388f0d7e9fca1018efb8930ee73b47f0f269b183ef165ea3dad290f7cab1e4c4cc267569bed56c8c6e5603286202743cf1fa8cd81d543d29215b52cc3ad8e70cb8d24851a391d34be22d2391aeb6b600c7e42b6a794e301f1b78cce3a83464ad87673675bf4f5661f0798129e5ec9b6e4ae8a38870ff867c342f126c576429c35d74f3b724549b111da155bc3b21d2c5e78d502ba48c42a0b0e71b6eed753a6a2c8f19bb2297cf268b1660085201649cb119db4f14052410b2330c0f681db4f18698259a5608d3386472c2b377acd48151cc980d2b382ecf858c30bb446c8c6e9ace2585e2170724c669887cdbc5d8d91768ffff8c89c838ad286c393229eae8a6ca7e8d457e4b4a1f98a06e9a93cac9e5e2565b0c39ef824635eeaf364e0753dcedaee8b39504cd1823ec552a91f8d55a02004d0029090aa460f7b6aa7ba501ec3e1336d8e93fbff1ee91777985a51154d6c1aa33f199d2a836b8f65b7db848377c68d8cb88e63ae4e59ece7ed24cba6f2a27a052b0c2cbf2955e677ad4e0e461e58767e4e9aa08f78663b67ef84e54d63f62efbd1509bce2bf1c33319a58e8a8beb0b202c39ded5e80d56dcf53897937dec99ec138f9b82e2ff9843c36785fe9d46951b8c4d04023c808c589ad454e0ee5a20a25a4e0aed1724da782659bec6420bddb54aa3a674cc7b48bce2e4a61437eee8619dcbb13ad0a376ff85b6a244d6d684e0c7fd34f50267efc332eee18e5415e5b75a910c4d0bfc585ddece26c1f6884f7de062a89d12a76ffefef7081a12b97eba00c0087683feca1d15b9fc617d8048dc3c752b31519494f76885545c95f162ef2fabebda40b8c034560c6dda0625561744409888a3c44a031a26eaab2e90058ef292cc00c75dd6880639619e1e594e575bf3d3122f6bdc06aef10d2dfeebea5bb2113cc6449539d8f660506271f9006819060ebea0550cbe9e89b1fcdd329290132e3b8662b647da1340010e16d5488ee189ae931af59df71d7a5c2478d5cda513f41047035345f2ab370a2c2019cc75fc0b6fd4f262e88c8552a827ab44c6267964bea4f6835a101099977f15c39111de80246290e1289705df81b3d29bd7d53308f86835d35e719e71f75b10adcb56448e2743693723c32b16e3439b776b02f0cd6b01601e6bb6c7b5d0a50c7b17a03a831c7f0f1bcc767aa34b72e16d791178c0000db81527b796170fb0f48ec5cac3e44dd56447927970f29abbff7bd619a64c650bd78ec7aee38f64a9760d2b4edf3f644e4f8cb07fa7939f11be132940f7ecae29219ac683c0ff1fd11f224968ffbe005bbf6c1cc22347759dde8c9c4f71a620921a3fcab49a230d39c35acf4b2e76cc89e04fae34feeef703b090da739b1e48c7f9017d4b351bc06a8cff441c4fb47388bd3ecb358780847e225f159dc687d98bc6c596023203dd2412b674e260584aa6b24d505f48a82d056bafbfb4916a0307623934fbfe9bce2f0a77b76422371b24e8b22bf945e352e5a5415015944f6b3e7843af5a1cd9ed255f693cb5b6a742377ca8db4e9b7dda1883f4dca56bebcdfd12760b423d2ce81259764e311eadc50265a7d86aa677a563d6ea36205bd02159d1bca57137a7c481444ee9c68c4ed987a3378db6a5eba97762f4c72c0ee7b5e84d09a9d629a3f50c9206ff65b6132dffbdb6923f09155ba5c272017904db9851047fa062ce81218bb32493e0801a3ed4666432d4eb74ce3bc9c8e9b1edea8793e7b6d7a46e608d055cfee836676e207823d5081c4c4249bf56675b062d7c8ac82de717b195d7f2f67722c73ea3d53679e0d384348be400aa66b54688009bdead6cfa2773af59b643dab43e914e400d2e0cf02042765ac036f4d82ccb58328e1e883eb4c720501f82ff71c74c2104146d9160c024bcc4f1987a159fb61a654c48bad6c8ebd832fcffec2506ab25805e5ede4b0d1121bed0cabe215b714a0715fad5c41976ec9dd2b61192308aae83139a81057fc0982aeb6008bf51ea93f74049a60efe557c7680a5e27a94f1bf2b56b4f4098024796516e66a0b286825b620d604e57e284618d64024984cc55d42a0fc9896e91165694d20f7994e3a3cf52606532e031664401e4438e507b8f14238c72098367f37fd723b18764fe02305974202fa58d91b5c2358e19fc04ab43dc83a244ab93b091b75c173036248d4c47750a9ab982e57992dd4052600650edd25ceed0b2f2662965d76d4b527d9af8708063f8a4b656e36c54d3638e46c8fdbcb4b5d53743c57a4de31e2150f8dc3fa8feb332773023899e9144eeef7f00e651c0e861b261193f538589f9bd998153897b09813370bacefedeb4265858db8553c0ebd01cd6f6a4f73780761a7d4ca19b19bde206f9c9a75503ac945650881e62ecce2815d89d3569f149abf1ff0dd7d18693b0f5bcd415187605cb84c3715eac8967ded4014afeb8cad2a6ac8a8958e9c82b94e0820b939fa916fe16fca89067cd94de0e4a8f20dc78148f01116a0a73a85d0ca6e60132cfa044217dbf60340f54508a52961ee6701f5dae318d5165c8ecca9c4ad87cc2a9738e616f3f2530398ddb4dc80739325c4f79ceee7ee5f96710d75c4af9d86ef9baa75ccfb8f47d00f3bdb37a687b7a7f61ba4813f11d90a93f92265051a144aab4564a943a362fa6460bec76c0ef649445fc99577088bed027908bd8ed57b5a49131cde3d17e82266a4b0c855ad566d26d2c36f20edc04673c44d61d8fdbf79d272e9cebdc8d8de87430c9e451c519c1dca5058fb8f7dde2ed993bb7d25ccc0467b39a16a45813bdbf6b448108d8c222c3591b839864e2be5ae6a97643cb272a1ae4f6af5772bb9192d88291ea04ba49a0340c1dbf3c1d95012e83c46512f72b3a9fbddf1d041f76c3e9f60fed7d53a03641f6a7001bc24270a2a76cd7f8ac4b7369e17b86617c759276392e612e1094b9ed2245120e78919fbfbc7e2f4c3b17a0deca4a7d920986d9195bc33e79b092ab420b5ad1e94df1202262410b1e3eaf0d7ab74dbf34fa144c833dba01e258a1c2e48c6e21877ea5b0e1c46e5c398141d4985c9fa85e5b1abff8427d3e16bd8c11dc834a7dcaee028962f0c3db3e42bba5d0ba7cbb0b98b81c117b19e20a28dabb487f95c71c358c9ba7a8fa08db64aa05cb9585909e489ecb4e4c9cd012af528e61713497f8e18ec7409fb53cd6d6a0d6eab2735e1db8a3a92b027f6ce8c35faa90ff73fbf80dd54e74df7c5b915abef6348b5ca6de9e096429435c619b7ce975e691bdedf5d5a60a73deb3e30395c9a601c6ba195fc84baa4f77a8b6d6b1771e19156b05df4b44a02757bc3af4cdbaabb7031feda37545267ecd070e4f28b32b30dfdbb48805b1e4e6c041c5704951d6ccc0cbba06f8a141ab74f95ff28e5e0dbbac449e25fde6dee9ce1636c38bcc2f2354cc9452c10b80fea9cca78e96d0baa386da85a1c56bf21b423c56ad1078336dac3c3efacae1bf3ddc583e56bda375eee4ac9a4bb5d84a4362ccba26b4dc3005dcb9cbf7c27c97871e68e96c6fa9a69e22050d4e6f702e562739f486b640835b4442b2191f4bdad3c6fa8ba2a844cd0cddc0506284f4e77f48915b6485ea8e467cdc0089e182061859304174533664fcc4435384c08ca39fe115b82d9fe49c0ffc361600b395114ef5e68ba6255923c1845e1efc1e223154c5bb73de00cb5b14c96dddc170dd1d22b841c1f43e6deeb7d4c35b0b387773aa423319057b6353e90ffde0d4fec89adaf5aebe18117f92cc74c0e67d496943e8174cf10c3d01c7ee3733a61a9a905d18172f44475744b9526866da0ce461cb3c7dd819e3a537ae85ee046c8e279f854ddf81b5073fbcba3ec87d258beceb03227ee8767d05cb1e2d3ba4e1945f025b88fd63af13c776c1bd74fe414a9c735e5cf57aa26aad4441023eca6468692e6871d4664fb112c71d06a6c20da01ba9aeca96a138cd5e4e15888998cce91aa10563992a9b833f40330ddb43f836157d2aae12610ca51f5801f98154e29c228bdaef3cb127687f2e450e43932ef88f7ad5b10331bd6247fb44d535e37cd69fc74d34d332a3363dab5c5a88c465eb96be52fc9f13d31bb334a279137aa1fa159ca1b607a3ce96eff049e4a7fdf3b57a083c798ed9b154e2b78159878e20aec8f4b9bb91ce22a3835b1bdd5a3c12f25f3ab7b4d45124120102fcbd72560a50520bdf98438b284197d1678e61a38c723f0b85458ea4f1ff5815897a0982841e2d2e96781bdeda05db1387ca72dac9df7b3eeb2a9e34263be0f7991589085102551d7207299d08383b68e8c7ddc36c2ad45b4aabad2a1360294635c942e5bdd882dbe68b23d5f7f670d43df93423e482c165e46830545150606f460fc7a73bbbb3ad044816fcce7b4ec5f724ff8fa3510d50e202293038dda9028a8951f5ad4e44694e9bab8ed466a614082196854601cb874796c52e962821cbf2d837894d476d9cd7ab2de0872652173066bd67fe6286b83c82ccc0d16e7a8cff461abdfda64b8c573160197fd7ad057906b7a68a3ed1fa487f7605ac226edf70e44a37fd82d07d5d6ff695466280f0bad181ce6142c7c5b522cc5d91a4a5eaba778c41778a3adae67bf34cbc027febe2fd3bf0ffcd887117aec40dea1806a201befd18f5646fd8570359e37c7e80994a027c64153664205aefe04281ae70eaedd6cc495293c959a9292c6331521ce385fd476870a9c485fd65739a52fdc28e01789e16b844841deee1cbdf6719c6212dbb0e08f1d82e1109fac3b8677bc090c835ef63f70d8076c2b66879e14ba5c608304c5e95c9f7f234e43de35c32b5bb9c91ba626e61a2d0eae0c061b2d56954d8ce1c2fbf62c4984bea0d3986a77f5411b2ba9f0321ed61a87834f328509cc09a42da49b58c21203d5a621d7cc6d3f2dbafea347c2a051f2e1bb1193beaceca39f9a8b02394412279fc82c9b1fa97226acd4b22c876df697cbcc69af38094efce61747ff6f29376537454a5a09fba0044698c5b9fc8c1412ca87ce7b06e7422805cfb0f0a549e268d2c557ef57e817c57bc5886b4674144b99e7a0984187fd8794e7a58bb919f4e9f37cd1e638a68a55e8f80cb869ed85bfe18444e9f2d104959735368f5338370478c16f21a48116037b7c35f0b47f5a0193398cbf1a2e3a858a6f95b8dcc68ca2270e17bd90b91da904b15093717a4de7e57b935dacc06f2b5d0b59ee430c686391a3412b11245af63a07557ea7210c9e161e6dbb5d46c767810415ef11171cf63d2a96cd1d2522649eb388797f9f66fbce8e9368323dadb137135303548b14db5f44a48425db5c0a27182f6f7913018cea7dd0af00312c78927354a854f2f1beb487d97096e0c9435e91f7226417feaa7b38ed47c4ea43407fc10169971c209c0a3ae29091e4de506cb93f892da", 0x1000}], 0x9, &(0x7f0000001000-0x268)=[{0x104, 0x18c, 0x3, "6685fb0bad29033a4f058ff2e3f66c86ca92848a21e2754aa3997f80990f0fef09c3262f67a5d01208568c48cc640bda73a07092719ae25b62b41bd9957068508ff9751a7a618dd17f24ef4bef562511f34ed313cef6ef16d7d8b486b3fb9da144f1f10b339c5b086b53e76ee3694db46805fa9c2b7834736a72a9673019841ac3a41a4d57756535ac6774396b71873386cc4b8bb777985b579549cd518fec2b53facc466839de776dcdd3a491d8199b2d7655fc1eabb18e8ebea04159bc297c02dce163b16f57237944c7386b72b1d794203ba6e7a52ea6d60f32d5fe4762bd450ad10b9b4f417fe3f1308d409f90f12572bce913d8"}, {0x10c, 0x116, 0x5, "4bf8184d73967899d90899fb532fa9e5a9b32d20ef8b4218d29cc48586e4766dbffb1e382529dce2bab42ff41f485b503b9886aad79ddbc7506e0366979d6a8a9906c91f6610f2173918ba3bcf40d6b422ee0a03fa33fa3a061ff97cabdd8fa5c449c16d369d369c4da558a33b258b569cba8840913944e5b47cbebcdca166d994417ef715e43dd86c2a2ed1b5af25ba9d4d5c700cf03b1ebddba6c30205d43ca9a367472496495129a76d9f80e5f56d6a820d2fa6136f2b9448236cb8d4585f52b66288070f635a152f04168bb469850adde8b796381ee6cf34baa2b949dd4214a93d8c0d783acc78910e97cacef5b61fa52f40552e762b54f1192166"}, {0xc, 0x88, 0x2}, {0x4c, 0x89, 0x4f28, "76a94022003de380a35ec5d0f130c42a5d98d64ebbbb36abc8646115738af3b474cd10eab6c4468d900b6511df46b0b4f5eac1ce1b02fbf8726f66201c"}], 0x268, 0x1}, 0x40000) sendmsg$unix(r1, &(0x7f000000e000)={&(0x7f0000015000)=@file={0x0, './file0\x00'}, 0xa, &(0x7f0000017000)=[]}, 0x0) mmap(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(r5, 0x12, 0x3, &(0x7f0000021000-0x4)=0x14, 0x4) [ 88.959272] binder: 11903:11905 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 88.961188] binder: undelivered TRANSACTION_ERROR: 29189 [ 88.972697] binder: release 11863:11873 transaction 256 out, still active [ 88.977603] binder: 11903:11916 ioctl 541c 20c8cfff returned -22 [ 88.979705] binder: undelivered TRANSACTION_COMPLETE [ 88.990940] binder: send failed reply for transaction 256, target dead [ 89.053487] binder: 11924:11928 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 89.062555] binder_alloc: binder_alloc_mmap_handler: 11921 20000000-20002000 already mapped failed -16 [ 89.075062] binder: BINDER_SET_CONTEXT_MGR already set [ 89.093723] binder: 11921:11926 ioctl 40046207 0 returned -16 2018/02/04 21:33:36 executing program 4: mmap(&(0x7f0000000000/0xd000)=nil, 0xd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) accept4$packet(0xffffffffffffff9c, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f000000d000)=0x14, 0x80000) mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$midi(&(0x7f000000e000)='/dev/midi#\x00', 0xffff, 0x100) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f000000e000-0x18)={@loopback={0x0, 0x1}, 0x6, r1}) bpf$PROG_LOAD(0x5, &(0x7f000000d000-0x48)={0x0, 0x0, &(0x7f0000001000)=@raw=[], &(0x7f000000d000-0xa)='syzkaller\x00', 0x0, 0x15, &(0x7f000000c000)=""/21}, 0x48) 2018/02/04 21:33:36 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000ca4000)='/dev/vcs\x00', 0x40040, 0x0) recvmsg$netrom(r0, &(0x7f0000782000)={&(0x7f0000e66000-0x48)=@full={{0x3, {"8e5c0f157fedf8"}, 0x100000001}, [{"6bbbb6c5442b02"}, {"0d63c3ccec4884"}, {"297d98e6343c45"}, {"59c97601a0a473"}, {"3618a5e4d175ea"}, {"8c931488ad920b"}, {"29bbb37491589e"}, {"248e127eaf8b0a"}]}, 0x48, &(0x7f00000c1000-0x10)=[{&(0x7f0000a19000-0xb6)="913d411680701b03d0e14b466328e5bed0fb3aac6d605cdea4d48786b5d2dc7d2055823bada454306e6f5cfa873c765396b03863008b0750f5e8483f54ece3605100996dc3e759b49548d8cf97c3a3be1db2307299524ea877d0c744f20ab0786a2092c945fd0b71cc4900a0a5f2204ef91403985f175d2ca58c0130836682ae9c60ec049c1b852b90e604389958cc14e343eeb58d3ec806bbb5e1543f2f8c3f6af5ad1ce0d3007b2bfd247f52e36d8e5d3c7b8ff4e3", 0xb6}, {&(0x7f0000550000+0x1c6)="d1a3d30f48a9a277bf70b17374d2e0bc21f6b2cafc122822bbea4ec7a9c55ac1542cd684b390fbd2f86426b17b3e6f47d0e632b75ef6e700e59f00dd898a8017ee36e422f6776a44318ab592de0c851400f132bb2184ddc0b6d867c5e8064d02d7cd7a1561ea70878792f7721f87433e33eee9364d2f3dc086a421d9a2b5a7adab932f78e46d3c635dde19317c596dab97e38d2e3ad4ea090067557ecc0189bd387c5c9cf85dfa2890a3443bdc98298796ed9abba854a63548fdc7ccdaa50fbb42a44c61c569e978acdc9e7648f513895d4e3fa5b2ebbf89d59af0da725be62f5f", 0xe1}], 0x2, &(0x7f000044f000)=[{0x84, 0x119, 0x7, "db80801c8bf3378517a004aa9b497640c07e002504c8010f09872f00d20359c3e68a1f6abce94a664192daa050ff50a819e582990ba1ef1e95a150ffc6495db027dcc69c2ec6fb91cccc56e5651faf37f3d1ebd1a553751496ebd2a4fb294df9666b483fee795fcb5409fe4ab05b38b96a11fdfb63204a41"}, {0xac, 0x104, 0x100, "2c76c9e80a84b85dc082fdbffac2489a883f4b95562939064a4bf3f008fc4fe20c6a23bce78073699e991e6c7cea6a7a1b6b26601748ece61e3b2d97330a6888ec82e80f641fdf59736bbb112b9053d99c2d363c37a096f7b9f8e312fdcce903b32c935e9134677541af91a54b5882702e4f85224b2a7ef3023ddfeaa0b55fd1dac91f6afdd32cd653bac1499f42217d8c8d573d3725bc9325f8955e7ad91f"}, {0xbc, 0x10d, 0x1, "6f6345c882a5a5964dd04e9edaeaa7b534433f5da6244aa0c756d172d5d0dd3e303f0acc08afc7185ac420101fafc474c35c2bc7e8b5f242dca10bf5688fa6b444d2f07026dcfab2624b3f887500b114ad6e60dc25fb4bc30ce5a50324f0dbfc257d40dc160bc5def1075851559e8f77e0f4a6fba8e79b65c9d5156e176fea6d426a5a4d2dda979f493041fc80659c59baa2493da143e1e1532cad1a1fba60339d1808ba91fa805fa17053a253ce43"}, {0xf8, 0x10f, 0x4, "e3e54b2a2631dc514f6129c81de5a9edcc3ccb4a0370ea65905559eac6ac1b87ab0963fa509e363de4c845021615a6b89384691a710f6316efd58a1e455868fd4cf36861df87befe48f286fb34d5999f678c9edb2d57615b22cf9d1d967f08a8b67efd59adde247709beeac7cce3d655909d141728064ba91b8a4d243aba4fe0dcc015c94b0deb041ca9c80dbabb43ecab92256962aa0e07b97b909199e3fdc88dd1621651b1645687465ebe07ecb32a7b475423b72559d5a51ca3b33a8cda83d424a83b04af2718e878e77a8defdadd6b0041bc6b14ba3cd1c6956cc810fe15844bfbca16f892730c5a3a"}, {0x5c, 0x100, 0x100, "79a736ae59be714947acf40b0013504069b3ad97869f38450b26151ceb96761a22e54d9e43363341a1906e40a669e321dc664ffbd07456ec0d33cf98ef81367e3669474c513285fe250ad873dedd"}, {0x58, 0x109, 0x5, "7b94a09de2ea2159c29abbca32f53a28c8332ad3ce01e08bbefcadb4a53fcb6c1ba253d23471ff978dc8c42c6990c491eb4dd328bc7368d1ea4febeb3c08dab292f7870699533bc2e16c65"}], 0x398, 0x10}, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f00003de000)='/dev/vhost-net\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x2a, &(0x7f0000901000-0x1f)="62e76463a2aecc6acb9451fa93f3d36cafc80b52dfd02edabc6990e5d3d490e771afe6abacf8a38f1f2b5c3e9df94bacde", 0x31) setsockopt$inet_mreqn(r3, 0x0, 0x4, &(0x7f000092f000-0xc)={@empty, @multicast1=0xe0000001, 0xfffffffffffffffd}, 0xc) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r0) ioctl$VHOST_GET_VRING_BASE(r2, 0xc008af12, &(0x7f0000148000)) 2018/02/04 21:33:36 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f000031a000-0xb)='/dev/mixer\x00', 0x100, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000477000), &(0x7f0000644000-0x4)=0x4) r1 = socket$inet6(0xa, 0x80000002, 0xfffffffffffffffd) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f000016a000)=@dstopts={0x0, 0x0, [], []}, 0x8) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f00004cd000-0x4)) statfs(&(0x7f0000326000-0x8)='./file0\x00', &(0x7f0000e8a000)=""/108) [ 89.098721] binder_alloc: 11921: binder_alloc_buf, no vma [ 89.105288] binder: 11921:11941 transaction failed 29189/-3, size 24-8 line 2957 [ 89.113730] binder: 11921:11944 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:36 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x3, 0x40000000000000ff) syz_open_dev$sndmidi(&(0x7f000096f000)='/dev/snd/midiC#D#\x00', 0x401, 0x20082) bind$inet(r0, &(0x7f0000089000)={0x2, 0x3, @empty}, 0x10) sendto$inet(r0, &(0x7f0000355000-0x1e)="360000000000401901000b0700e3ffffffff7fb618850d13", 0x18, 0x0, &(0x7f0000f06000-0x10)={0x2, 0xffffffffffffffff, @empty}, 0x10) 2018/02/04 21:33:36 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) epoll_create1(0x0) socket$unix(0x1, 0x1, 0x0) inotify_init() unshare(0x8000400) pselect6(0x40, &(0x7f00000ac000-0x40)={0x3ffffd}, &(0x7f0000768000), &(0x7f00007fc000-0x40), &(0x7f0000f22000)={0x0, 0x989680}, &(0x7f0000f14000)={&(0x7f0000554000-0x8), 0x8}) mlockall(0x1) epoll_create1(0x80000) 2018/02/04 21:33:36 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000471000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r0, 0x4010aeac, &(0x7f00009a4000-0x10)={0x22f, 0x1000}) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00007cb000-0x9)='/dev/ppp\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000cf5000-0x4)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:36 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffff9c, 0xae41, 0x2) ioctl$KVM_RUN(r0, 0xae80, 0x0) clone(0x840000, &(0x7f0000689000)="f6f495a687c9e7bcf5eabcc4930d150777db98ea7c447d1118b5e25c571a359e794b64eca414d3f8f52045de8506cfba6e0a2620e383db616d5a86199b9d8f72d39f13cf2bdbc3baf58d8b044cc64a6adbc2455ac02962aac8d607c81aa31f3b96dfdb7173a1e385ef77e4ea905a3b0e43f764a3444b9498ff1cf6b38020570e1b5abffae9ffc3e2eeb30a53af1696250413d828f853a5aa4448a8ac3f6d62a812ec43897917d4719fae4ca12f0ea93e213b4aab19ea5267787fe21b1c8cb1fc80a23b547ececcf08cdbe98f0f137d39014d51f2e819f4850ae3055866eff0b6d09febe6b52a9117c18ef1a3cfda32e871e778063c3fcda573aba78cb08c060a51b6af89e37355dd96d7dbeeb9db597db85fb620fc6dcbc687b59690106deb12022405dce27c4f949dfc85c8106ecd9ab25e087a645775d5f7b083ac0b8ce66fc4e696915c286efbf5bb518d4df3b212ece6b099e4c99322b515aead196ef6badb49dd56ec197195c5a8ec5c210ae49e35536318b61c4875d9cb94fe63b48e1f8ae0e2db52855ab0259e7c775773f2e7a8a726419341dc8573e39427b8f51e6893fa67046b41d3ec1c6f7c5ecb9fef0b23ca474986de6cfe25350d3b64120760f6e0764578a1fd13b3d53c9dec4460b5342a14fe3db345b7e13a268fdf9064cde1787bc2a5fe04cf0a03adf1ec873de2ec2c2fb8263290ec3d4cc59f4de565fd083ac8e35cab04ffd0c80b83765dc2757e3fa04dfd048e244704973e7793f27dab53eaa7794b8310d976ea59956a9af69e70b2bd801193389346f58865a48deff51d362b2460c8367a3658de700c6e306266a05e4d543208b70a6f3e25037fa806828c3762cb86890d71da42ba2f756e9673345a9a692b894ba704437656a95ee99a3f072d89153d961faa1905336efd2ab101c55e2ee6c80bacb71714e7e5c587bc77511d57fbd213fee7e1ed0360fa2ad854282ecdeb9bc323389702ebda86eaff3bbaea6a635c750a209d969f204b585b83bb910d39fc30aa89bdbe43527c0ff324fdfd0095346aeb8dd6a675b568e0b9a174164ba94817b2b0ed5f4e304fce2fb6a9d0faa32f9b89edf5adf724873852e5e1cdaf137d7eb2e3270f28594318b9941f1cc9f51b003194a752f4cdf3cbfd45d3c06dd18df3dfcf514886206b96895767e8122855c784e9c563988dfed76d24736bf1063ce222c3086b7716c0e612f084d1a232c9e092f8281a7f803808bda288a52e910d3ea302eaafa54277939b5016d7eafdc985d17015b244f15cbcf214a45fa25f0ced19cbb5a6eca233e3c0425deecd2adc835c39050bc6f9d2ac38555b1bb179b1e7c1ab0150e4bd3b44082f40429f63b143b0805aa1e68a10d94d17f1d733df3d280a09845225bfab2c3a36d640ecbe5f9bad21e030b02bfb233635b83fda850817ff1345ccc5dd486347be0db6e938c5b894117b8c4e5a541916793c873df9c965a9c55108b4571a67af985d82cbc3c753bb50d06b70dd8e6d2cb8d1d26281d65526c07338b6c2ae6c47c0ebd2c43cdb91a1d0bbd885680c97c5427d9978ff65a18d2437abc89595389f51801e6ff0d605eda539652eed95ff8760ed8860c779cd78d16fbc0dfc2c8bf3641bd4293e6b8429fd9755499ce0e74558d1286b22900f7b59d5ba3f34e679f21e390527d9d94346f83cc1141c0599841f8fb221d5e1e6f39b5f088a6f0054386fb827a13a8623c1036631c55254af7862c9a96d29af5848f4f7b14a4473aa1955457aed71765cd2230eb7c122e95c2d00950427b5c90b52c435c71676b2b79b88530f3bac9807fee101492cbf0821b770ecdaa284fbe9f02b136767d5455354d164a6eb996fd385475bf12800b075eb6a2a6bbcc7f471dc780f14bdeced82922ab6d16896ecc2e2fd66e9ed1fa2680ebbd6377b0c548d418e2f0a09d5373c4e6e13773da89aef8f83d12fcf50cde81e801f3032ed6f89e915b562bf71054f94a67db77d7cc7aa611f24648901c829d1c62489a5b7314a537a461d75b432693eac41e351c0e915f940bd6d473e0b539d66892b0b63bcfc064e64b3d8d402188908f032e4eab674de1bb6de88c277bdf6c115e6b9ae792a25acb30c733de5efff8e39b4a736af80c95ea63ca2a60066bfbdb4e8d9f95e8f2888cafa5af406a99e8bee622e0338264558cffcc1e822ea0df7a30489ec935ab30031e60768031150f8b28c3e53c8ac694acdf9f178ae926b45a8978629c179dc099980b1d32ceaacc2ab17291b62a192bda9c03fb91023b84b6a915771aeebd528ca2bc73682e9261b72bf6f41c4e89fbd1b7e655dee4eb58af65071070d44b5e08b8686e9b77c817c02eaf3f9402adab980263f4edf32086679df3954d1ee6bd557db26386d0feabc99e9c68148d31b0f53cc86824cf8acbb46b9e2b762773930eb8603dd77aaa51e84f91be268a9a240b492a06ed48979779151fa5db72e464ed8c3dbb54e6a2212963e252433a228bc01fca953252b48d0b6a4d638462ada9f18e6708820f384f9c2dbc2b33da5886549de16608e8bc82e3e103810ea2cc1a4615a6bc13c5b5ac51e443f100f545e1931f7395b177b731aa21fb5eeac11a061fb183e6523c8e8b0c09608fc86949debc15ba39a2f5aeb41c7d3ccf327b565c785bf36f271abab0b5ba53df078adcdd772f6ebcf583a5913f614446b2ab514b2258353aab0421f1931e1eae0db938b11d2b386365fa3e7ace7bfb2e86a1ca2e9cd3e122dd0725cbe38e1762516b4ecd1be45fac9a07bcbc0f415f51a0f8a614b195ca1bdbe9b67bf3383617da6f1fa0b5fbbd6d0c6952bc44eb7e68a6b51bf58a27404a6bd6930f62f0ecdc108194d6ab361c4a3de2031469c3cf5566f861d6eda77b1dcbd63d889b40865c04e3f6b970d60247bdcbd590e24ce3f7eaf44f4ec1822b219781894b96122faee84c8477783e91de37e331c6facd7f3b93a35011126a5341e4a170aadce4a56656e756f469d9dbf3ecce3859c999990678cae1c67e61b4faa44cee6daa4f5d605196c0e35c446a859dc7ea24e10e492d14a2badffbd795eefe1a8330c9f35670c1794ffe2ac17fb023d1b88c8b0b80aab59b89d25928386b3210b6692c311da1489fdda4ca90df7225188bdc74f90532411ecddb6fd857c7db3c6973d806357ba03ae477dca7fb98f0c74265d10a58b6fc15cd28591e6a48e4d48112eae42b026b4450b3f7ee2c2e3d8c5cfa9d668629fb073efa545da9a32b3c9dccb3062bd3e2a8b96703a60f9fed4691f1e4296bfc7378770571e103e9c2681dcde0740b0a8285285a97fb99087a3f18f250b5b80b21ccb17203b5e9e6b4da046b3aed1fc265c62f1020ecff95a4a93e7c152a5829d8f4914882c0e26df3250dc48785b4dcd0c14136545fd7cde350dfc24eadc06c131da116f8f3008e5b43744c19350f5a126a945dff6f6d4766b55c2d62b5523141db7f6fbfaea7c1fca25cc485eb8b4913ff7a35e80351eb60d0d4d2d658f0402caefc55f0ce0ff69cdfc93186c8d80cbd2dec34fade955d4b80dd98d52c5cf827018606c001d296ad22b8e573ffa8566024d6da438181d043135f4f9ed602a1b43572fd87e901093553584088b4d8d79539c45adeb40a33aae7e8ad1e1257dccc88bd6b0cddb1eb8993b2953a2a41466b93292d012f4e0053252452a96edca1bfae7aa271d835f4ef0d3e7be33d81c89cc6a35cb81ff027d8b7fe7e2efa4286cad79d1cc79bfacb6be221d9cc9b866d0dcfbe021e8508a029d8c5e0116b7d9fd1100012c88f817f4f6c9c75d46e5ca8b8979529559ad138718d1a7f19986092fd727bb6b852b151f8d7602912082ba91898dfd9399ba29490250c165e2ee1f403f5b5e8a7ad0e06284f4e8f2233c941d6fd92589a6b43adce7704ba4fdfe5ecbf77fdd80c80bd9367dec1979c3bad1e61770fa0c83fc1f66865af43e0f4aa6df1e9f72ff28bfcc3f1098c7b70ac875b4191da4d9e576b3611b13fcd398de729f653152433267be560145bc0b3438e0817a1009a02f876b2a2cbf9939f92d13d6c28bb724b7b7822e4d4480f36d47147f610526280ae0663813c07dbe279677ccfcbb0f7ba51c32b547684b1745ace252f743e90b2c73be8020de406033887f9d584d52fe3127edb083796b6641c760014f96a980e61980bae686efd2b8c797e756a1998df4f81861285f8455c295ad6592c82ac93b7e855fb375375536a31f4ada9e152aa1bf995b99de9839c030bc2c5553c1a487f6ae15708118d2ce29fdc5f88148b4b9af99ee132c31dff4f2a084743c5fd4779d82458b40c245cee6ceef9e0d6bf5f7001bea8b53a353f7c4dbe5d6c2fef3354676da4c5dc52d470eca3fa4de7db0b9e5df815daf2b686118aa447e2881ff2d883c7663dbd30fd004ba509adb7c0abe58f13d56ba17d8337e9315232f2ff03dd4bbb463413d6d53986258d791dea5b91a73bc6d97c8090bb50fcb694268fabb4956e034d1392c3dc379abdecdf4b7e74b2b57bc4a32e30447ee38cfeb1d65f3122c1f02c8a401540ce25ae9f9bec7044667708ece4522aad55063518b6c1b8df676a4e00f4274faeb025bde6495a389e7354382d011010d9c73fc46bbbffe7b2bc137e8f8dfaff19a2dce2c57804a9d9eeba5df37df5fb899b4873f4b16a162cc36b2c0bb1dca65fd2277ab2fa8e4008cbc0fbb8ed1e2c78978587d9ca004af20491e3a4db9864117051a41354c78c315a9fbce344fe86adb2c3a18c9672464f3c1c7f1a9532967bfe3a1c35ca9490b06beb9637c5496c9a1ebd2c095e80007debf78984af92722d95eb2b5962f58b00914cb4c2bf94735c84c7b757b6ac41b6c7b8fcf696b60e87d5474fcbb859b627a9f5825f0dc6e641e45f3bbe86e233e5375581755832b11181db1c4870fd51c7541796382bc1248688c44601022c9a76b7e7a300c8c6cb922a24d1f61071237bfabbd0d2b278821dc3ef99fc870c11747685521c230448a8d3acc4999baf12568dc45b1535f2176519c7c64d6d866631d59d12bce0a98264f800a28d8d90a997b2e5e124511e0601362b540d5f9e46285ec6f84f3e30886e7d452f692c642c4497ce3fdd2867ab6fd435b6e03dad36f712b197ce6071e1168a125bb617e21d3fee2d5f32388471b074358de233021e68d4b4af925c1237c989189df2c8adf0123c84acb3c9df1ebfdbf3474b389649e26e46129115940560008f05af32c24a9faedd93efbd2cc7892c1d29d7dbbb2239ef10333f9ffac731f6ee0cf38f22c7c3090cc132e2db7a9a52e41e0f4784da9d829a5bba1f010aaabc163d63eb5dbe41b27eb12f8159721c8ee0b8f875cc35b8ea0df8f4758654c9a871cc7937f570d429f24a054a6358c79c50ab767fead035188df0e5555b32d59ac8576239ddcacca8ee89f70f1b46e77b3d29695f366000f1f0e6e54b90bcc626e4119d57982cb97c96e3f95f4f0a5f9e31a0eb590416e858165dcdd827814e3cb70b2ee4e77725a160a515c45bfb7c5efe070d102e0ee09b1a39011edee453d7fef87860730aea39d07d8cb0889adf5f00e267f313a004b41029784c2df08f118016ac02c4d794721b29579f9c41c833a21b9c21890176bc1df839124398c5b34852e47c7c7b9e2585480888fc94e5ef22f75b738f90a3ba829170d5550910757e3d80f4c2857bea376d1b5e825d9f62737df4003d04860aaf7547e58fe15763deac71523be3dfbe6c6d06bb6bd83928e430435b6beab839bb679237fb74daa2a8a92c73c1b2345cbeb62", &(0x7f0000479000-0x4), &(0x7f0000001000-0x4), &(0x7f0000000000)="2a45bff42bddaad710c4d2339da72a26accd2d3a95dddae80a5b0d0a899790c933edeb3170da7f7de0c62db3c9a7b5aa4bcb32b93cfef8c9b06030468a55b195cc2b42d95bf56c") mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f00003de000)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r1, 0xaf01, &(0x7f00001e3000)) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000539000)={0x0, 0xffffffffffffffff}) r2 = syz_open_dev$dmmidi(&(0x7f0000404000-0xd)='/dev/dmmidi#\x00', 0x27e948be, 0x40) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000e60000-0x13)={0x0, 0xb, "2cbea8f58338e3eb8ffa40"}, &(0x7f0000a79000)=0x13) ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0xc028ae92, &(0x7f0000def000-0x28)={0x7}) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00001d7000)={r3, 0x6bcf, 0x10}, 0xc) 2018/02/04 21:33:36 executing program 3: io_getevents(0x0, 0x0, 0x0, &(0x7f0000ad2000)=[], &(0x7f0000ac7000-0x8)) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000001000-0x19)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000)=@int, &(0x7f0000d44000)=0x4) 2018/02/04 21:33:36 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f000098f000)='/proc/self/net/pfkey\x00', 0x40001, 0x0) r2 = request_key(&(0x7f0000a0e000-0x8)='rxrpc_s\x00', &(0x7f0000c98000)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000083000-0xd)='/dev/binder#\x00', 0xfffffffffffffffd) r3 = add_key$keyring(&(0x7f00004e3000)='keyring\x00', &(0x7f000051d000-0x5)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffb) write$selinux_user(r1, &(0x7f0000066000)={'system_u:object_r:usr_t:s0', 0x20, 'root\x00'}, 0x20) keyctl$reject(0x13, r2, 0x4, 0x8, r3) poll(&(0x7f00000bd000)=[{r1, 0x1420}, {r0, 0x80}], 0x2, 0x5) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000a4a000-0x8)={0x0, 0xfffffffffffffff9}, &(0x7f0000ef9000-0x4)=0x8) setsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00009f6000-0x14)={r4, 0x7fffffff, 0x1000, 0x8, 0x6, 0x5}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 89.152927] binder: 11924:11942 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 89.161912] binder: undelivered TRANSACTION_ERROR: 29189 [ 89.168432] binder: release 11921:11926 transaction 261 out, still active [ 89.175476] binder: undelivered TRANSACTION_COMPLETE [ 89.180635] binder: send failed reply for transaction 261, target dead 2018/02/04 21:33:36 executing program 2: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000000+0x751)='/dev/audio#\x00', 0x8, 0x1) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000a91000-0x4)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000916000-0x8)='./file0\x00', 0x0) chroot(&(0x7f000064c000-0x8)='./file0\x00') chdir(&(0x7f000073a000-0x2)='..') chdir(&(0x7f00001ec000)='..') truncate(&(0x7f0000e81000-0x2)='..', 0x0) 2018/02/04 21:33:36 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000004000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x38, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @local={0xac, 0x14, 0x0, 0xaa}, {[]}}, @icmp=@dest_unreach={0x3, 0x5, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, @rand_addr, @dev={0xac, 0x14}, {[]}}, "c4e60974958cac44"}}}}}, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000736000-0x1e)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000324000-0xc)={0x7, 0xffffffffffffffff, 0x400000000}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00005ed000-0xc)={0x0, @multicast1, @multicast1}, &(0x7f0000c22000)=0xc) accept4$packet(0xffffffffffffff9c, &(0x7f0000d66000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00004e4000)=0x14, 0x80000) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000c67000-0x50)={@dev={0xfe, 0x80, [], 0x0, 0xd}, @dev={0xfe, 0x80, [], 0x0, 0xb}, @loopback={0x0, 0x1}, 0x9, 0x5, 0x62c, 0x100, 0x6, 0x2000040, r2}) 2018/02/04 21:33:37 executing program 5: mmap(&(0x7f0000000000/0xaea000)=nil, 0xaea000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000103000-0xb)='/dev/audio\x00', 0x80000, 0x0) mmap(&(0x7f0000aea000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x40405514, &(0x7f0000aea000)={0x0, 0x7, 0xfffffffffffffffa, 0x9, "b966c8764ff3543659f12dd6accf8c3ead5dee9035f32a21a71f44958f04b54df3dbe751872c21fd8a839c30", 0x10001}) mmap(&(0x7f0000aea000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000aea000)='wchan\x00') ioctl$DRM_IOCTL_IRQ_BUSID(r1, 0xc0106403, &(0x7f000084b000-0x10)={0x40, 0x10000, 0x0, 0xa552}) syz_emit_ethernet(0x4a, &(0x7f0000525000-0xe1)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x2b, 0x0, 0x3c, 0xffffffffffffffff, 0x0, 0x0, 0x29, 0x0, @rand_addr, @multicast1=0xe0000001, {[]}}, @igmp={0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, "6e39de902479d315415cbbd0edf8e8f29c74f9b073a8508c7cd3c1cd97309116"}}}}}, &(0x7f0000adb000-0xc)={0x0, 0x1, [0x0]}) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00002e8000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$KVM_GET_PIT(r2, 0xc048ae65, &(0x7f00002db000-0x70)) [ 89.276842] audit: type=1400 audit(1517780016.998:102): avc: denied { sys_chroot } for pid=11973 comm="syz-executor2" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 89.279817] binder: 11966:11972 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 89.309696] binder_alloc: binder_alloc_mmap_handler: 11957 20000000-20002000 already mapped failed -16 [ 89.319868] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/04 21:33:37 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000940000)={0x1, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000141000)='/selinux/checkreqprot\x00', 0x80, 0x0) syz_open_dev$audion(&(0x7f00007d6000-0xc)='/dev/audio#\x00', 0x27a0583, 0x400000) 2018/02/04 21:33:37 executing program 7: mmap(&(0x7f0000000000/0x34000)=nil, 0x34000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) sendmsg(r0, &(0x7f0000018000)={&(0x7f0000014000-0x1c)=@in6={0x2, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c, &(0x7f0000013000)=[], 0x0, &(0x7f0000033000)=[{0xc, 0x84}], 0xc}, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000006000-0x9)='/dev/vcs\x00', 0x2400, 0x0) 2018/02/04 21:33:37 executing program 2: syz_open_dev$adsp(&(0x7f0000a57000)='/dev/adsp#\x00', 0x8a, 0x8000) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000a1b000)='/dev/hwrng\x00', 0x2000, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000c0b000-0xc)={&(0x7f0000acd000)='./file0\x00', r0}, 0xc) fcntl$dupfd(r0, 0x406, r0) readlinkat(0xffffffffffffffff, &(0x7f000046d000-0x8)='./file0\x00', &(0x7f0000851000+0x605), 0x0) [ 89.328670] binder: 11957:11961 ioctl 40046207 0 returned -16 [ 89.367395] binder_alloc: 11957: binder_alloc_buf, no vma [ 89.373082] binder: 11957:11961 transaction failed 29189/-3, size 24-8 line 2957 [ 89.383997] binder: 11957:11976 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 89.396888] sit: non-ECT from 0.0.0.0 with TOS=0x3 [ 89.408456] binder: 11966:11997 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 89.412841] sit: non-ECT from 0.0.0.0 with TOS=0x3 [ 89.421469] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:37 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f00007d2000)='./file0\x00', 0x6000, 0x1) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000027000)='./file0\x00', 0x0) mount(&(0x7f0000039000-0x8)='./file0\x00', &(0x7f0000022000)='./file0\x00', &(0x7f0000019000-0x6)='ramfs\x00', 0x0, &(0x7f0000038000)) r1 = dup3(r0, r0, 0x80000) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r1, 0x118, 0x1, &(0x7f00002f3000)=0x3, 0x4) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000e6f000)={0xa, 0x2, 0x1000000000000, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x0, 0xaa}}, 0x8000000000000001}, 0x1c) connect$inet6(r2, &(0x7f0000d95000-0x1c)={0xa, 0x0, 0x4, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x9}, 0x1c) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc2c45512, &(0x7f0000c8f000-0x4c0)={{0x7, 0x6, 0x20, 0x9, "2204011b21952c8cd603b9857d327a79dbd57c71e28cefa643c39dc425a3f03eb155aa19bb4def524fb5d396", 0x8001}, 0x9, [0x800000000000, 0x10001, 0xffffffffffffffff, 0x2, 0x10000, 0x3, 0x618fc5b0, 0x6, 0x3ff, 0x4, 0x4e, 0x1, 0x5, 0x3, 0xdb7, 0xfffffffffffffff7, 0x9, 0xffffffffffffffe1, 0x1000, 0xf1d5, 0x400000000, 0x81, 0x800, 0x7f, 0xc77e, 0x100, 0x4, 0x100000, 0x4000000000000000, 0x8, 0x7ff, 0x9, 0x2019, 0x0, 0x1, 0x6, 0x8, 0x6, 0x3, 0x1000, 0x0, 0x6, 0x0, 0x80, 0x4, 0x5, 0x1, 0x3f, 0x8, 0x6, 0xa181, 0x8, 0x8, 0xd8, 0x5, 0x9, 0x101, 0x227d, 0x7, 0x7, 0x400, 0x0, 0x2795, 0x0, 0x4a40, 0x7, 0x7f, 0x4, 0x3, 0x18, 0x7, 0x8, 0x6, 0x3, 0x6, 0x7, 0x7, 0x6, 0x217, 0x7, 0x80, 0x1, 0x3, 0x7, 0x7, 0x1, 0x9, 0x4, 0x3, 0x1, 0x80000001, 0x4b9, 0x1000, 0x2, 0x3, 0xffff, 0x100000001, 0x1f, 0x7ff, 0x0, 0x3, 0x1, 0x3ff, 0x9, 0x434, 0x100000000, 0x6, 0x4, 0xffffffffffffff01, 0x6, 0x7f, 0x0, 0x76, 0x8, 0xfffffffffffffff8, 0x8, 0x8, 0x6, 0xfffffffffffffff9, 0x2, 0x3, 0x0, 0x401, 0x8, 0x4, 0x9, 0x1000, 0x2], {0x0, 0x1c9c380}}) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00005fb000-0x2e)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x1, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e) 2018/02/04 21:33:37 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000430000-0xf)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}}) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f000001d000-0x50)={0x0, 0x1, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) 2018/02/04 21:33:37 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f0000fbf000)={0x0}) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000340000)) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000e92000)={{{@in=@empty, @in6=@mcast2}}, {{@in6=@remote}, 0x0, @in6=@dev}}, &(0x7f00000ae000-0x4)=0xe8) sendmsg$nl_netfilter(r1, &(0x7f0000d65000)={&(0x7f0000de3000-0xc)={0x10}, 0xc, &(0x7f0000ebe000)={&(0x7f0000bc7000)={0x210, 0x2, 0x6, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@nested={0x2c, 0x2, [@typed={0x10, 0x0, @u64}, @typed={0x18, 0x0, @ipv6=@loopback={0x0, 0x1}}]}, @nested={0xe8, 0x0, [@generic="9d4b3cb0045568ea3b3f773211d370a9139cb38bbc1b3abcb966e2ff87f5d6fa8f9132200f4f02a4dedc65fb1ddf26de7b599e573721b65f03355827be20142a6856d2634b482f73161997ded0b3ddf193b409f4770471658e00d778762c33d2b725a635282165cf7de18c201a66525d71508a484012454c72369c798dbf", @generic="056805f43a59e88450b62825a84e1c23ed9d0a7051f41d56665c1d20e7c465f2ed7d5b7400dacd3027", @typed={0xc, 0x5f, @u32}, @generic="ef22524a1da62d6a732c878d75d87b297bd068a223f9700e", @typed={0xc, 0x50, @uid}, @typed={0xc, 0x0, @pid}]}, @nested={0x78, 0x7c, [@generic="3fd49aaf049ac083d2409227d3bc311e7234e22896a00163d3a1b7fca20236ac4e63bb4ca4ee2a5154b3c6a48abd48a5b4efedf70cc2e0793d723264a35be2661a9029b899ad6274abb1c8b1debe1e60423f7d2ac910132f47041b45d51a3a422ed21f", @typed={0x10, 0x71, @u64}]}, @generic="0c28d0108778a1984ec9784a45048d62bd0996e86016fb4ec6a898fcc21dcb20e3c2cc68c90daa153eb49a94c50bf0fcf4e51e42aeb01691ebf6c4a7943940ae7f9c342c49e5f2cb2f6efb98e5437b748e6036089dae721f138dad7a7c9a54273e040d149eb7b68d0e61fc73d9db96"]}, 0x210}, 0x1}, 0x0) 2018/02/04 21:33:37 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f00006e1000), &(0x7f0000928000)=0x4) socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000a95000)={0x0, 0x531}, &(0x7f0000f59000-0x4)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000119000-0x8c)={r1, @in6={{0xa, 0x1, 0x3, @dev={0xfe, 0x80, [], 0x0, 0x16}}}}, 0x8c) 2018/02/04 21:33:37 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x1000000000800, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f000017f000-0x28)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00009cc000)={&(0x7f00002e5000)={0x10}, 0xc, &(0x7f0000b2b000)={&(0x7f0000efb000)=@newneigh={0x30, 0x1c, 0x301, 0xffffffffffffffff, 0xffffffffffffffff, {0xa, 0x0, 0x0, r1, 0x0, 0xb}, [@NDA_DST_IPV6={0x14, 0x1, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}]}, 0x30}, 0x1}, 0x0) 2018/02/04 21:33:37 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000ac4000+0x53)='/dev/binder#\x00', 0x0, 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:37 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f000075f000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f000040a000-0x4)=0x1000) setsockopt$ax25_buf(r0, 0x101, 0x0, &(0x7f000074c000), 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000038000)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r1) readv(r2, &(0x7f0000353000)=[{&(0x7f0000744000)=""/28, 0x1c}], 0x1) mmap(&(0x7f0000000000/0xb3c000)=nil, 0xb3c000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000c67000)={0xffffffffffffffff, 0xffffffffffffffff}) read(r5, &(0x7f000004c000-0x5e)=""/1, 0x1) ioctl$int_in(r4, 0x5452, &(0x7f0000009000-0x8)=0x3f) fcntl$setown(r4, 0x8, r3) fcntl$setsig(r4, 0xa, 0x12) dup2(r4, r5) tkill(r3, 0x16) 2018/02/04 21:33:37 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) creat(&(0x7f0000bb6000)='./file0\x00', 0x1) r0 = syz_open_dev$binder(&(0x7f0000fbf000)='/dev/binder#\x00', 0xffffffffffffffff, 0x8000000000000002) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) openat$dir(0xffffffffffffff9c, &(0x7f0000c32000)='./file0\x00', 0x200000, 0x2) [ 89.427228] binder: release 11957:11961 transaction 266 out, still active [ 89.427234] binder: undelivered TRANSACTION_COMPLETE [ 89.427257] binder: send failed reply for transaction 266, target dead 2018/02/04 21:33:37 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000639000)='/dev/ppp\x00', 0x311085, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00003a1000-0x14)={0x0, 0x680, 0x101, 0x152c, 0x3}, 0x14) connect$inet6(r0, &(0x7f0000011000)={0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, 0xc}, 0x1c) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000416000-0x4)=0x4, 0x4) perf_event_open(&(0x7f00001b0000-0x78)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f0000023000-0x38)={0x0, 0x0, &(0x7f0000021000)=[]}, 0x0) 2018/02/04 21:33:37 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000801, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f00003c4000)='/dev/snd/pcmC#D#c\x00', 0x800, 0x2000) openat(r1, &(0x7f000056d000-0x8)='./file0\x00', 0x400000, 0x8) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000b9b000)=0x40000000007, 0x4) 2018/02/04 21:33:37 executing program 2: mmap(&(0x7f0000000000/0xff8000)=nil, 0xff8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000ff8000-0x108)={0x0, {{0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}, {{0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @rand_addr}}}}, 0xc) [ 89.471995] binder_alloc: 12001: binder_alloc_buf, no vma [ 89.477644] binder: 12001:12006 transaction failed 29189/-3, size 24-8 line 2957 [ 89.504925] binder: 12001:12017 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 89.510096] binder: 12011:12018 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 89.545607] binder: BINDER_SET_CONTEXT_MGR already set [ 89.551190] binder: 12001:12006 ioctl 40046207 0 returned -16 [ 89.563711] binder_alloc: 12001: binder_alloc_buf, no vma [ 89.564836] binder: 12001:12027 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 89.569404] binder: 12001:12017 transaction failed 29189/-3, size 24-8 line 2957 [ 89.587749] binder: 12011:12018 DecRefs 0 refcount change on invalid ref 0 ret -22 2018/02/04 21:33:37 executing program 4: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00007d7000-0x10)='/selinux/status\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt(r1, 0x65, 0x6, &(0x7f0000001000-0x4)="06c83b1f", 0x4) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000001000-0xd)='/dev/dmmidi#\x00', 0x8ab, 0x80800) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) connect$netlink(r2, &(0x7f0000000000+0xb8c)=@unspec, 0xc) sendto$inet(r2, &(0x7f0000001000-0xf6)="5357067ed9f1e36a2e662fa0fed0365744874f99f94952ea3f81643359f8035583138b356ba4ed57644a3a51da10d21deec8ec7101409852cf98d5ffdaabf1983c9db5f9191960065ba55c9c4192c81e3b0f267013c0ce28b1a1721917b5c4a6a5efc4548bc31ca1fd37376bc887bf418408108999561ed9cb53de1ec194ab5067a2efe4c9357c48a985314618bd0a7ca84872caae92b91dda334d4976f2f95c8fbea3d3bf4e86c4c2edc1ca957032dcc08b4f8764e8fa01adbb9f56a799ccebcfcfafaaa395e15df90e7809d07d52490eb0dfb0b82c9e4b8c0fe16e893a9bfa3b8d2604dc7f2bdcabd2e57a179df1514972b922fb00", 0xf6, 0x20000000, &(0x7f000059b000-0x10)={0x2, 0x1, @rand_addr=0x1}, 0x10) 2018/02/04 21:33:37 executing program 0: mmap(&(0x7f0000000000/0x36000)=nil, 0x36000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000037000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000038000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000038000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000038000)='/dev/usbmon#\x00', 0x7, 0x4000) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000025000)={0x0, @in={{0x2, 0x0, @local={0xac, 0x14, 0x0, 0xaa}}}, 0x5, 0x101, 0x6, 0x2, 0x1}, &(0x7f000002e000-0x1)=0xa0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000031000)={r1, 0x8, 0x9, [0x61, 0x6a, 0xfb38, 0x1, 0x6, 0x4, 0x0, 0x2, 0x7f]}, &(0x7f0000024000)=0x1a) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000037000-0xc)={0x6, 0xffffffffffffffff}) shutdown(r0, 0x0) mmap(&(0x7f0000036000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000039000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000039000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = add_key$keyring(&(0x7f0000039000)='keyring\x00', &(0x7f0000039000)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$get_keyring_id(0x0, r3, 0x3f) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r0, 0x800455d1, &(0x7f000001c000)=""/151) r4 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000036000), &(0x7f0000036000)=0x58, 0x80000) mmap(&(0x7f0000038000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000039000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f000003a000-0x24)={0x9, 0x5, 0x3ff, 0x3d, 0x8, 0x100000001, 0x1, 0x1f, 0xfffffffffffffffa, 0x4, 0x8001, 0x1}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000038000)={0x2006}) mmap(&(0x7f000003a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f000003b000-0x4)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000026000)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000038000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet_icmp(0x2, 0x2, 0x1, &(0x7f0000038000)) mmap(&(0x7f000003b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_ENABLE_CAP(r0, 0x4068aea3, &(0x7f000003b000)={0x81, 0x0, [0x56, 0x5f0, 0x63f]}) ioctl$KDSIGACCEPT(r2, 0x4b4e, 0x6) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000007000)={0x1, &(0x7f0000006000)=[{0x34}]}, 0x8) 2018/02/04 21:33:37 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) fsetxattr(r0, &(0x7f0000893000-0x9)=@random={'trusted.', '\x00'}, &(0x7f0000761000)='vboxnet1(#\x00', 0xb, 0x3) 2018/02/04 21:33:37 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000635000+0x43e)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000a9f000-0x8)='./file0\x00', &(0x7f00000db000)='ramfs\x00', 0x0, &(0x7f000000a000)) r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00003b6000-0x4)) chroot(&(0x7f0000fde000-0x8)='./file0\x00') umount2(&(0x7f0000c57000-0x8)='./file0\x00', 0x2) unshare(0x24020000) 2018/02/04 21:33:37 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000f73000-0x12)='/dev/snd/midiC#D#\x00', 0x40000000, 0x10000) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000fc0000)=0x101) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x10a, r2, 0x4}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:37 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000561000)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0x0, 0xaa}}, 0x10) sendto$inet(r0, &(0x7f0000c96000-0x3), 0x0, 0x8000, &(0x7f000057c000-0x10)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000e77000-0x1000), 0x0, 0x0, &(0x7f0000bc9000-0x10)={0x2, 0xffffffffffffffff, @multicast1=0xe0000001}, 0x377) 2018/02/04 21:33:37 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x2000, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1000000010, 0x802, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00001bf000-0xf)='/dev/sequencer\x00', 0x440140, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(r0, &(0x7f00006a5000-0x1c)={&(0x7f0000f83000)={0x10}, 0x3, &(0x7f00002bb000)={&(0x7f0000013000)=@newneigh={0x1c, 0x1c, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x1c}, 0x1}, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00007e4000-0xc)={0x4, r0, 0x1}) getsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f00000c8000), 0x2) ioctl$KVM_CHECK_EXTENSION_VM(r2, 0xae03, 0x80000000) 2018/02/04 21:33:37 executing program 2: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = getgid() setfsgid(r1) openat$rtc(0xffffffffffffff9c, &(0x7f0000003000)='/dev/rtc\x00', 0x10000, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x6, 0xe, &(0x7f0000001000+0xf82)=@mangle={'\n\x00ngle\x00', 0x1f, 0x4, 0x378, 0xd0, 0x1c8, 0x1c8, 0x2b8, 0x1c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000cea000-0x40), {{{[], 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0x2b8}}, [{{@ipv6={@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, [], [], @syzn={0x73, 0x79, 0x7a}, @generic="a42172bf4e3aafbad7055201be88ad8f"}, 0x0, 0xa8, 0xe8, 0x0, {}, []}, @common=@unspec=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00'}}, {{@uncond, 0x0, 0xa8, 0xf0, 0x0, {}, []}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @ipv4=@multicast1=0xe0000001}}}, {{@ipv6={@ipv4={[], [0xff, 0xff], @dev={0xac, 0x14}}, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, [], [], @generic="7e45a70d42589a6e4d08a584c84de70b", @common='gre0\x00'}, 0x0, 0xa8, 0xd0, 0x0, {}, []}, @unspec=@DSCP={0x28, 'DSCP\x00'}}]}}, 0x3d8) [ 89.630342] binder: undelivered TRANSACTION_ERROR: 29189 [ 89.640372] binder: undelivered TRANSACTION_ERROR: 29189 [ 89.683952] binder: 12042:12049 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 89.717184] binder_alloc: binder_alloc_mmap_handler: 12046 20000000-20002000 already mapped failed -16 [ 89.729187] binder: BINDER_SET_CONTEXT_MGR already set [ 89.738468] binder: 12046:12050 ioctl 40046207 0 returned -16 [ 89.743420] binder: 12042:12059 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 89.744669] binder: 12046:12063 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 89.752271] binder_alloc: 12046: binder_alloc_buf, no vma [ 89.765645] binder: 12046:12058 transaction failed 29189/-3, size 24-8 line 2957 [ 89.777270] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:37 executing program 2: mmap(&(0x7f0000000000/0x11000)=nil, 0x11000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = accept4$ax25(0xffffffffffffff9c, &(0x7f0000012000-0x10), &(0x7f0000012000-0x4)=0x10, 0x80800) bind$ax25(r0, &(0x7f000000b000)={0x3, {"a511e26bdf1b6e"}, 0x29729308}, 0x10) r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000005000-0x38)={0x0, 0x0, &(0x7f0000003000)=[{&(0x7f000000f000-0x24)="240000002d00030007ffeb946fa293b7ff0000001f000000000000003540000000000000", 0x24}], 0x1}, 0x0) 2018/02/04 21:33:37 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000397000)=""/16) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00006a5000-0x9)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) pipe2(&(0x7f000063c000-0x8), 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000ded000-0x20)={0x40010005, 0x0, 0x0, 0x1000, &(0x7f0000726000/0x1000)=nil}) 2018/02/04 21:33:37 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000001000-0x17)='/selinux/validatetrans\x00', 0x1, 0x0) write$selinux_validatetrans(r0, &(0x7f0000ff6000-0x72)={'system_u:object_r:gpg_helper_exec_t:s0', 0x20, 'system_u:object_r:systemd_passwd_agent_exec_t:s0', 0x20, 0x0, 0x8000000000000000, 0x20, '/usr/sbin/cups-browsed\x00'}, 0x72) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000003000-0x8)={0x0, 0x0}, 0x4000) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000002000)) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) vmsplice(r2, &(0x7f0000001000-0x20)=[{&(0x7f0000003000)="5e5abdf6533fa6521f113d18289fd0e97d0d524dcb87e21b39e2a82ebb490fd5c792c8ed86d65bc2caa2354b888b07ff7eec2ab29bbe24c1e1b3c0e7fad71e1daeee3f837e77932e7a4f73a023cb13f8a7ed27379ff82e33b9e76f6f9d433224868a1b6b624b19ad16dcc970cbed46e966fd2b4fa27fe374641569464e6ed103af83eaf10d0d00aad418bc17e0c60ba6717cc9b2e80d0cd6a7c7b320a7c88a728ea6100f20608a411288edfc051422331e0f83fc96e0adff9b2748e87ea372f925b208f861cfa0ff4118074db3", 0xcd}, {&(0x7f0000003000)="54b7b436d1c3fcdedb2861cc7371436e1dd6d6681747077692e5b5d20f386a14987d20353a8233b427f80ee8df8eee3cb710cb82c8ad6c72e6989a593fd05ae5717e27e8beb089875e746d3f22e04b4652dc140a13b1b33654b71162677f438bd2fc5e996163211fa953dc0b6300ed3b027e5c37f70452f3a787d476c1e35eeb3887e5df2af41750aeeb798f64952f9f36da9ad9d570a90df7064c89a74a08a872a5aa53c83448a2498e02b4c6d1f3ad782e8210daa24089e8a0a6255620b84779a6f2a96117dacc90732b7300ec92c98451e143", 0xd4}, {&(0x7f0000004000-0xb1)="ad3f9e091de21b5f7b83f9fa0025730ebf63ae9691d0e392b75228fe8c10d92d4a9282d6d720c9681b6047308efd8283acfbef2b97daac942c22725f603e6080a20f8bc963ac647a4b2cde1c98cd6e3ba7a68502c36d515a13a4c84c8ab2c3f07f308101562930b32ac6e1952dd186111e9b0aa2322ef700c0901ce7aedd85d80fc8ee64f1cc625f5d7d52f89b6151a3a7f4cafcc6a54daa30b82822b9a4847ca77270582dda3fa5f588c87cab7319d818", 0xb1}, {&(0x7f0000002000)="41b8a82eda24857c13288ec713195f4e133cf284a522bcf1aa8cb626c195987d119a71602c81ae8afeead894178dbcc550e0d82bca40359c83f349d09b7d4474cfa787fc24693d90912a3f3096f686f89380f1bbf0d97157daec211cdde23b4169a57be7e54413ae3b50d8302f9bdd7b36e1be07f4a8e20175ef9791e1f1a7dbd04c520c6d543138d29b3fc3dcb5", 0x8e}], 0x4, 0x1) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000000)={{{@in=@loopback, @in=@empty}}, {{@in6=@loopback}, 0x0, @in=@rand_addr}}, &(0x7f0000004000-0x4)=0xe8) readv(r0, &(0x7f0000001000-0x10)=[{&(0x7f0000000000)=""/74, 0x4a}, {&(0x7f0000002000-0x1000)=""/4096, 0x1000}], 0x2) 2018/02/04 21:33:37 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000525000-0x2), &(0x7f00001b9000-0x4), &(0x7f000019d000-0x4), &(0x7f0000eba000-0x2)) r0 = syz_open_dev$admmidi(&(0x7f0000d8b000)='/dev/admmidi#\x00', 0x5, 0xa00) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000b5e000-0x4)=0x0) r2 = syz_open_procfs(r1, &(0x7f00002d4000-0xf)='children\x00') clone(0x0, &(0x7f0000b24000-0xb2), &(0x7f000025c000-0x4), &(0x7f0000ad9000-0x4), &(0x7f0000e03000-0x98)) preadv(r2, &(0x7f0000f44000)=[{&(0x7f0000d54000-0x77)=""/119, 0x77}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000415000), &(0x7f0000d7b000)=0x4) 2018/02/04 21:33:37 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000b9c000-0x10)={0x2, 0x1, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000fa1000-0x1), 0xffffffffffffffbb, 0x20020005, &(0x7f0000386000-0x10)={0x2, 0x2, @loopback=0x7f000001}, 0xd) setsockopt$sock_int(r0, 0x1, 0x2000000000000009, &(0x7f0000535000-0x4)=0x4, 0x4) setsockopt(r0, 0x1, 0x9, &(0x7f00002be000)="eacea12e", 0x4) 2018/02/04 21:33:37 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000ef6000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000e99000)={0x105, 0x0, &(0x7f0000905000)=[], 0xffffffffffffff0a, 0x0, &(0x7f0000072000)}) 2018/02/04 21:33:37 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f000003a000)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f00003f4000-0x1)=0xfffffffffffffff8, &(0x7f0000e6d000-0x4)=0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:37 executing program 0: r0 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001000)={0x0, r0, 0xffffffffffffeffe, 0x1}, 0x2d1a4a965c399dc1) r1 = socket$inet(0x2, 0x80005, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x84, 0x7, &(0x7f0000004000-0x2c0)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000), {{{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@uncond, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@ip={@rand_addr, @dev={0xac, 0x14}, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @generic="ff39f226c425e2c4e2bfea0144d273dd"}, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@uncond, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}]}}, 0x2c0) [ 89.782806] binder: release 12046:12050 transaction 274 out, still active [ 89.789771] binder: undelivered TRANSACTION_COMPLETE [ 89.794913] binder: send failed reply for transaction 274, target dead [ 89.808045] audit: type=1400 audit(1517780017.530:103): avc: denied { validate_trans } for pid=12065 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1 [ 89.816368] binder: 12070:12076 unknown command 0 2018/02/04 21:33:37 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f00004a8000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) readv(r0, &(0x7f0000d71000-0x60)=[{&(0x7f0000c05000)=""/4096, 0x1000}, {&(0x7f0000ccc000-0x4b)=""/75, 0x4b}], 0x2) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f000057c000)={0x0, 0x25}, &(0x7f0000d87000-0x4)=0x6) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f000097a000-0x8)=@assoc_value={r2, 0x1ff}, 0x8) writev(r1, &(0x7f000000b000)=[{&(0x7f0000c03000-0x106a)="2c267e242481c30c666d158d944f0d89d0b24c02deea35d5f9772f8dae1cd41446cde1fbd5331eb8ac66abe4cabe3d1e42910a6a97054224ebde680a2c55c3eb196263fff503b9a83e01ec52bb3c81701958db38fabf47e496cf0a9432989b7476733757dc1062021181e6ac4f656a7b7be4ace9d1d96fb9cf322fa1916986285493f75f8787212d0ccbd4c3fa28fda762b68fbf35cc9e334d419c9d9fab1b0a5fd501e429ef862e908502d31b442c89b8e728b222c35ef07ca658b0c27225da062e195f29b1b2ba25d4099813dcd2f613c79466432b6c36fa3b2e7822aa51458c4d5cea7abdba8e2f129daff37f27487e477a5c5ba0f214c0ba7845e146c8689525e3a923e35014b6ddb9b85e35ad7590abaf67c006c4b1feb963d9eab378801359edbcdd410f113b39b11b5f7a420a080df102df54c169372e0e045640619942d91cf198369418515e484ee19965db6d9ff1b76561d8b60216afb1b236d5b56cbdfe8a3166c2cb934bd953d7d4989e899f871d0892bc9cebe86962d59c65881ebf3edcfb52180ff5795d2b5abefefbc7d122a20dc5b32465da34213a0c623d7a9b2f3339fa63ddc561a45ac96a68c4f21423a05ea2235b6df0ed19019d07d9b0e9cda2f58709b494a46ebe64722863d67a846b829f3e3ce4c9f0ce5a37d93fb1d07a420bde1c678ab8ad546c5a1f295baf92e543c4da2dabfb9b15b89e2875c06d7dfcb2994a68fefbdfa07991c1222403482c5b09928214d1d4369ab817d15838538566a0176cc12e72bdac913ea4ad953e4ef72e338c9abb074e45389d831d29eb0c2147ccf7cd404c7c71e77fa9e44a1dcd4bb893211bfd9a2c25214e9202ebc41539286e3f2417a34400bfbfa668b8c0dc75673bbb42c3d88870ace8de6b6b9b5d51264a690396cc342012bba7192829d5e13d7603ed5e8489811daa185e2ad017a5c66df226512cef5ebc7d7b9556d42af281defaadcff6d6f264dedf38296b00b0c1a534dc539c3c7f6b1882be5cd29f7c6541d9efc446ff28ea9a7cf7ced90bf2a3cd4b08b98debf758df3bf64090af0fa91269a827554d0088657fff5d93bcd5c9f26ab2aeceb659e427e05ce81fa0bf118ac60e56aca2129e6bc8513e6372de0ec4b7561d69e7126daf2a98ed9f96b0d3d611a8f0a69468fed7caf20980b80cb2bd629e376aface6d811ccb978546ac135b8cb146862ec33a4f14cec8f340b09bcc49fed4b5f861d397de3eb153841bfeda6cf888f18df77940d2ff55759d1e7c7976f5f4de3803b3b6f1eb5d6e7bb1138f8198119a237482acfe813619c20b7656c76236ad6622e6f917b74fe13679677d7008d603de253372e93994e10590b44c71468723cdaa8a0368c04773926d5d901d46b671d9e5f43641fd39cef19474375343f0a0be26e5614d1970e7d1a6c832253cdbc7f859955ad62674c9a97287d7cb4d811fb7694d579322fdf25ff824605aa0c8cf5460bed8ca2a8b1527c9c51f6b7c1510143b024142d6a9e5111c4aa98147ecc41febad60fb132faa75cc3b61ca564412ef8827327a85efc37ce6df695d394c2399f6e24189499438e0f77b598891e6ffbf855d741817f44f4a431ee11ad30a50b178a5ef179137ba24336b9b9a6a459d1f361eed683da46ccc51081331fc422471a136d31ad7698fc27d0a5cc2e48d0c0af32c91489e03647a9e9771c4fc62d3877079fb037b641a5fe7bda287ab1a049ee5dadaa2f971566dcb708e351e0f937993696fd31a1d999addd76127e97ad684948d0d5e6bd21b0b68986295d7cc71be683e448b1e3016ae3e98ee83512c398376d52bb0ab50674a886d34a7c123748396498581ff22aeb3052d01b3f6dc473b6ce27d359dc9077a68a2abe4b17c3dfbaeb7f90f1be19c89de6753620f33e31cfe27a3a18b333e548836e38920a3459b5407268f0d41c58c6f5091172cf0a508c1d73f2aa9e953496bbe8ab03533f89e2b4dafb37b89d25e0efb75ff84bb1cbd60a33dddb627e88efb44138b40ffad9bf70111f7e8f6b01e89b3a74b9cf71191f2bd026ba01e16a21d0abca2491351475a08fb593cdfb40047e896457af4c3a61f4fb7ad570080193954b62a7839127ddfb8d93018978fd3e642658213571246308454cc4195cead295f6f72c10def5930930e44782edd916230fa99423def58b780f6936d55aa952baea0c58630526df65f0ebf91b0e01c97f9b3bbca8fceff87ffc945c972b51b11954a476967b52c2fa3247a6e6bba9cef9ff5efd4523a64e11005128003b34251108d8f3dd62c3db158fec915546db1db5f02300b3f5baee8ac9a498d00a1bdb1cfab31dffc4506c799a269b6be101c0e8a2907c5464733a06d8f855c619befa9b77cbceb48da086ac09e510c609cb5c95d0f69d053ef35c32a7b96e6ab7297fdf211e198bf90087433474bffd8fe0d1e77934d8848d2d6a5ce21124e8c2af71e28026950caa63c4b0f6648e41225b384d5ee21701659489ccc2017d48463e0dcf97361c538c8b47d049f2b36d0584cb786215400ce18e285c1dbad47dda87c28d3f5f7fb15c560d1b28472f787b4915300364ce08acf3747d0020731e81dac8c252ed2cb5e096268f6d3e363620d92f272bd34c240eb4aba3d01904d897723345234ccbc4610a3a2259b244397b1f1db4094dfbc765aa212dd09a9197c9ff51e0f07c3547fc3f2f86e2d996b3bb4a6ebb282a10e2738b1e945ce3f33bd3979bfba6edb830341f6eb997cab67f9eb7a57fc1a8bf0ce64d9300e622a144bb424ecace72f0d16ef443de9ba89d8ac38e2e88f0a3ed23ec851dfb45df034532169cca827c88081e7fd2354819d9c20ea39f2932787246d8806e089ec1c70cca020f898602f211eb2504aadc3090d85a3ec9483451058d6caba71806f3f494d73755774296a67511572eb801b188dfbddf065be196febbfbce5af895fdc7278a1ede609f9af86f208aeef20001a9fc0bc04eef1a84229dda539e6bcc31479321036f162e57f41b1991cddc88179be2b1ada532eeb770aab9ec82399b80879ed2cdda07b061b0f0ee35002209d9b5afa9836efd2cad153227f4af2c1b4f60c21573c35faec09c45467540dbf3cabee5a2918b4a9432ebe672306f1acfdae1a3c3d8be48c58621c0b16312ed7777f81fc9084eeddf26e68c5d7f0d83347897a69e9b293c1e93b17448fea811d13af456f30f4f5b0ed0ec8b5876ab2dadeff381093f16f5013cfff76f2c77fdaf87d0d82697e070131831054757ac544aab5801ca1dfa665ded0e9de3eedb8cb6f17485a92eceac1b2b33927bb410c9369a4b7f3fc186828693a92fc07f415d244ee972b25c2d42b69c5e03ba57a1037d59f02a098fe62536e7af192233d86e8fae5d17fc7bd13b6e54d59941edeb975c85667a743ad4825e68cd00c707ba80bb0902d7f7fabd7c8e6a6df462b210528ce8378a6255c1da496305c84e741c5a5175919b44938f969bc2cf50e0ea4569e0dc523118e7b4d8165893f610a49a215f0945f0c177d1fc348cfbdbe1ef33bd8f1f41f761b9f8bb23172315bbd451d729f823d20559b3535d01173c92dd4b8c151d1e9be2eeb62d133f050bea021e75e41d8eab2678f0bfb40e134d8a60029a9ee4332316e1665360f477255915f344e1c56ed620431e9e4371c983abef24ba800c239b2273b14b342339a374a0fc3aa30898ef0e69040ef4dd6c298dc90e03242118eb824bd23044c87783085533e19445b43ef341c4372ac4545ac03a3adc532475947d63ce67e1e3763cc7f9ff9d103c434570c02c7b811a648b5bbfadb847d29311b6589a4864fd8af8e354b221fc78e407c95160460cd74d5966ba405da1f496950a6ac1e79ab6dc511ecd726d05d38e0fd65bd66c58c11280785a302aa00ddc03cad93833bd357b30ec13e91d632ec8d5565ed6a5d0554f17b4d7efa147fc0d9035d8a96213e9465da1d3b94f56d3f2b12d7e394a5fff25873c591cee50c5c14273d4b1c645d5ded4a0ad5d8a1296f40c2b65cf457a5780c4a4569927bd896c0d71498f2d31f4f61282540105f5845326aa61ceb01c10be922a2fdeaa1a9689922e255e053be4c4cb45f5c6bd8af4f93f8362bbf54875ddbedab4b97e8cec478e4ceda8121439523839abb6e1cdc7ba2eb34c1fe9931585e1e0d8c326276bab83170752a30f2a3a250aad1cc1f72155457dd3ab40e4c2f1454084683f8bfc92fd87af76a73dbbf06f8d4f18dffbff0c8310eb96303c60401e4efa54def27c4e023aaaee24d525d1d98822eaeb33bbc5d40e8845b6ae1b29ede30c6675f5aab93b2b28391008e62d9d9bd1224116d9874233c57f3524e34a2737f74daa1bb9051ba8e2564fa2f3e5462bd67a7be796c682ba55d0f64331b1c0c3e45aec99548e65b61420f25cad6d3ca9063db31fe16b7157249cdc2e592188efddd0161314104615509ee1ff212c98a448a5b2b7a931b01b1ed502135f324f3b58906591ce181010e9c62ce9cfab26d4ddf9ab43fbc277d15b8bfb93edbcfe276e5646fde162dc926487440cdcc90a92ed03662ec04ab9ec1b1647707b43c7fe18a030e3001cd7915013e0196c4609aa8475fc85302b963f4be6a16b8206b099c81b6bf4619389f6df538813a2ad08183e97750b35b1ced267166f4f39b13d9925db22bdc6dd7c3ca8d0aab439040d42952e62eee9a2728c9b7e45f7463f8447ec2ec435bd7e91bd05ad09ec013468f4ba54437da9b8db677f4eaf10c5746da05bf12359b3aa915be2999e2bce629dd4ad01ce0b6229e4b49cca0157abb5221488a785af2d71a149f096b0c564a6d36ca92d36ea15c54dc44eaafed114a858f1c126f68888eba594dcd52ae7f233e2ec88d2a2fc95da3385e02f30746a844f8d6e05b724aff933c15088cde099f04f4228745bdb51180d4e6114a364cb6ef32a71872dfcb86278df4a20423c354699cdb4c63b35dc4fa04a5d456c65e72b20be53f302e8ccbe6873e76e0adabdca405c50a9d933be9046c616c8e6ada9949de0db64bed0b6c8c8d6250a2589896ebbdaa5e7d254130c4b5fd7e9b57da57e5491aad4aa5f81d73a220332abf1e7a5ccc360bc1ac342408f8d5335e97a3c2f8353498946bfbbabf386459423c4e2af0c908b4724df1f97b92991a937a955ac45aa3b130768c49d550cfdacd2e7753950f336d9ce6f367fb566c935bb940f9beedaaa4348efff216e201a9e5de2c65ac43f6c3d0e8d5f0b960b65c3285c99b2f7d747657bf77afb9057a6d28bede1a72d45cb2125a8902150685e3ca7171212e01d224e876feb972d5ded4313c48164034bc0244ec73e687d87b44c33a16e8471e25e1a58094dfc509a007a3f2c010dfffeb80f36febb448fc40fe301e897bbe1aeb2a7a7ca968b22bb5d5ad5b366a4377ae441937f2b60a4e3ec6c8a90dd415cc47ae6dad270eaadab63c7f321b3af28d9079759da8b18167608a4ae2e08a84f84eeccb08c56cc476ed0db598c174437c1eace848c717a7e5aaca4e35d861038326bae04ebac9bc451fa4c5d60bd52eeeac89e01e11b3719f07b33a4192709713d120b0f7bddd82cbb13c321ccd87880993eedb0e2a8ca88dd7ec9af1367240b20209f96c237e067889503fee6bf3787a4d90570de215fb02d11a82a379303bbb5ed40d0432a317b50ff1ef21bcdf57f894a6938ad35396b6bf8dc24287cea55c472b6bcd7a2e3fd4a6cdf3435e54170fac4f116fdd3817240c940fea9b0509b5e047f23e6f7ef05d04ccdd39bd8d70e1a130e72fdf6c1e", 0x1001}], 0x1) 2018/02/04 21:33:37 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000d09000-0x9)='/dev/dsp\x00', 0x20000, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000168000-0xb1)=""/177) syz_open_dev$vcsn(&(0x7f0000d59000-0xa)='/dev/vcs#\x00', 0x0, 0x80600) 2018/02/04 21:33:37 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00008f0000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x840000000003, 0x2) connect$inet(0xffffffffffffffff, &(0x7f000074f000)={0x2, 0xffffffffffffffff, @rand_addr}, 0x10) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000d1a000-0x8)={@multicast2=0xe0000002, @dev={0xac, 0x14}}, 0x8) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00004e4000-0x3a8)=@nat={'nat\x00', 0x1b, 0x4, 0x34c, 0x94, 0x13c, 0xffffffff, 0x94, 0x13c, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x4, &(0x7f000097c000-0x40), {{{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0x234}}, [{{@uncond, 0x0, 0x70, 0xa8, 0x0, {}, []}, @MASQUERADE={0x34, 'MASQUERADE\x00', 0x0, {0x1, {0x4, @local={0xac, 0x14, 0x0, 0xaa}, @empty, @port=0x2, @icmp_id=0x1}}}}, {{@ip={@remote={0xac, 0x14, 0x0, 0xbb}, @remote={0xac, 0x14, 0x0, 0xbb}, 0xffffffff, 0x0, @syzn={0x73, 0x79, 0x7a, 0x0}, @common='teql0\x00', {0xff}, {}, 0x9d, 0x1, 0x1}, 0x0, 0xc0, 0xf8, 0x0, {}, [@common=@icmp={0x24, 'icmp\x00', 0x0, {0x10, 0x3, 0x3}}, @common=@addrtype={0x2c, 'addrtype\x00', 0x0, {0x800, 0x44, 0x1, 0x1}}]}, @REDIRECT={0x34, 'REDIRECT\x00', 0x0, {0x1, {0x2, @multicast2=0xe0000002, @multicast1=0xe0000001, @icmp_id=0x2, @port=0x0}}}}, {{@ip={@remote={0xac, 0x14, 0x0, 0xbb}, @loopback=0x7f000001, 0xffffffff, 0xffffffff, @generic="15d8d43eeabf26f644f911a38115a6cb", @syzn={0x73, 0x79, 0x7a, 0x0}, {0xff}, {0xff}, 0x5c}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x66, [0x80000001, 0x1000, 0x9, 0xfffffffffffff89f, 0x3f, 0x8000], 0x7ff, 0x53, 0x125a}}}, @common=@socket0={0x20, 'socket\x00'}]}, @DNAT1={0x48, 'DNAT\x00', 0x1, {0x6, @ipv6=@dev={0xfe, 0x80, [], 0x0, 0xe}, @ipv6=@loopback={0x0, 0x1}, @port=0x1, @icmp_id=0x2}}}]}}, 0x3a8) 2018/02/04 21:33:37 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f000036b000)='/dev/mixer\x00', 0x0, 0x0) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r0, 0x800442d4, &(0x7f00000ce000-0x4)=0xdf) perf_event_open(&(0x7f0000228000-0x78)={0x2, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x405, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000068a000-0x1)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0xa, 0x6, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10d, 0xb, &(0x7f0000000000), 0x4) [ 89.857209] binder_alloc: binder_alloc_mmap_handler: 12073 20000000-20002000 already mapped failed -16 [ 89.885088] binder: 12070:12076 ioctl c0306201 20e99000 returned -22 [ 89.888085] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/04 21:33:37 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000002000-0x78)={0x1, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001000-0x1)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = dup3(r1, 0xffffffffffffff9c, 0x80000) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f00007c2000-0x4)=0x6, 0x4) mmap(&(0x7f0000f1f000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f0000202000-0x4)=0x7fffffff, 0x4) sync() ioctl$TCSETAW(r2, 0x5407, &(0x7f0000c5f000)={0x1, 0x4, 0xfffffffffffffffe, 0x8, 0x3, 0x80, 0x7f, 0x1ff, 0x5, 0x38}) ppoll(&(0x7f0000a91000-0x10)=[{r0}, {r1}], 0x2, &(0x7f000084d000-0x8)={0x77359400}, &(0x7f000065c000), 0x8) 2018/02/04 21:33:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000cce000)='/dev/vcs\x00', 0x8001, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000248000)='/dev/vcs\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:37 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000079000-0x58)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x58) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00005eb000-0x11)='/dev/vga_arbiter\x00', 0x80200, 0x0) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f000095b000-0x4)=0xffffffff) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000d9d000)="833e2ff137eb85307dd908901658fb8347270bd892df725483049be5d9945a7f95f5fb469375db6db1353d8c0ef92e10ba52c72aeed2be", 0x37) 2018/02/04 21:33:37 executing program 3: mmap(&(0x7f0000000000/0x11000)=nil, 0x11000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0xff) sendto$inet6(r0, &(0x7f0000002000-0x2), 0x21f, 0x0, &(0x7f0000003000)={0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f000000b000-0x15)='/proc/self/net/pfkey\x00', 0xe80, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f000000a000-0x50)={{0x8001, 0x7}, {0xc24, 0xc44c}, 0x6, 0x2, 0x18d7e8f4}) [ 89.921113] binder_alloc: 12073: binder_alloc_buf, no vma [ 89.926775] binder: 12073:12086 transaction failed 29189/-3, size 24-8 line 2957 [ 89.937451] binder: 12073:12098 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 89.944558] binder: 12073:12081 ioctl 40046207 0 returned -16 2018/02/04 21:33:37 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000001000-0xa)='syzkaller\x00', &(0x7f0000000000)={0x73, 0x79, 0x7a}, &(0x7f0000000000)='.', 0x1, 0xfffffffffffffff8) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000020000)='/dev/mixer\x00', 0x8040, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000633000)={0x0, 0xe39c}, &(0x7f00001c4000)=0x6) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000153000-0x8)={r1, 0x4}, 0x8) socketpair(0x11, 0x4, 0xec, &(0x7f00002cc000-0x8)={0x0}) accept4$llc(r2, &(0x7f0000666000-0x10)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00009b2000)=0x10, 0x80000) 2018/02/04 21:33:37 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f0000e05000)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00007aa000)={0x20, 0x0, &(0x7f0000193000)=[@enter_looper={0x630c}, @increfs_done={0x40106308, r1, 0x3}, @decrefs={0x40046307, 0x1}], 0x1000, 0x0, &(0x7f000011f000)="73911ae8983c6d3968ef0cef1cec109efa06e4e2c150669e4166aac561dce312f36d2826c022b5bb6fa5588404525e1bad83b9e14fffae46bf5f2876ca22b216b9b1ab579d7f305d94fe841ae550ffaa72c2b11fa8e228a9019e1753794d950286dd35edaf3caa302b0e1571647784b83e277d09d26a5eaa0c3f23c3d27e009d212802e528612960fa63af42adbb7214898a8d17962174dcdbdabc162ff8779963c39b3d1d0e923c417285f56edfd7be8d36b6f206697d3ad20c8772b245ccf82aca6f58cbb8c51df8a3de84ae806214e5cd8a2a506f4d09e3f9ec8b654ba7a475d36d3ee06dd54143427ce1017c40733e4e2fdabe004e0af07ee1fce06bbe42c2478649b5a5827162dc4fceaf26e1c81cda42acc99ec09e55b08598565d70f184eba46b87194b6793cf35c9ca1db0df8c49bd54e8c30b280361b84e5e71846c80253b0fc3136e97261ae906a7991b54182fbca37e5bb1728f39ef5e56585d522823c19507b284370fb6e022a780047a230206a5146a4c790a1148a8e6737ddc1dff5752dfdc55f52977d57b6ab7cfdbd6e25bdd806081b75e2d09dcda890deb813edf630b76b31a46e777ec281f82c200e07728f7352d86b065ecc0e8e1731db477b39e991c5270a1e79d3d1e2316ca391443d7e02438340bb9fc37f5a45214454f63baa490fd69093a0604218040efdff5cb897d05bad00e907f6bfe609a7f83dfacfc5d0690c0e221ec93fa712a406908dae33241876fbbe7230c5bb50dc8725d7c3862469cf78bbf456573b8f5c73bcd45eec42ddd5c9abb672308cb109d825350b86106b7576f2b777b64299e65f2a5de8dbc39d8f6ee904740fada7b8ee6331854dfeb941a629c290b4a66f658580d0583e66d51c69dba7b42ff8b92f7e84c28c6c7c926bc1f63964cfa448e2a60d7e1a6528d23155551eda09d1cce898d813af85db1be15b5e248ef2dda3380ad325e88453320b5b95d3bf139be21089f36ce2765a1655994c6d751376c9ab14532818608f7c75fafc5aa6fbb1ec037f23bf96b3809853297bafbaaf268b8db9fd267fadb196cd843c65135fd9919a4b37a32e8971041fc429386ee4ad51e28b639d1b365da4162cd6a939ed9c769540bd961a69cf75e7f12996cd18cbdc9f396fd88cca8b05080f0784aabb01a5c6b9ba90c255b9a6e209f179c699f483e4eebb12e0fb8af10a8d6512858e7236c60ad79ef93333faa3ad23e5ef666dca3976828dfe1f2a089eacbe8358069bb587b43fd788d9c31d4e496d2834660b06a1f40a5a0108ad2f2291dd7b2f5be7fb00f509be7a5bac1254a2f3e589439b871e6b84925b8540f244d4ea4409e478b2c5ca46ec8653bca6a306c9a80e2713d38450aa6dbe292b11b6f6bdc6fbdc4b549b8b19c8560635decf0d6854014268bfa961a4e197accb9c1e360a197d6330053391a7f3673708f34b2c0bbb379557f5c1a852aa32a1ec596f2622f546ecfbdf3d3a069d76acfb84be24a6aa7b1c2ef91a2694eb141cbd42b6a380fd16275ded20f43f9b72c5ca51959bbf67c6c2bf10a3b606632892a166b7db11e829ac93ac8c22d98ae8b15496ff3c9c2e423ca1163d668875c22d5baae6621f54ab9ab74a515f5e56141288f9815aa104da8385e83944888eb3dba7a8e6f9ffdf58b11714eec73905e0217422a61559453161e5ce5a3b52f28a4de92b714da767e536fb4475719d09e05a3e92986ea78b08b053ee38469aaf1afd38c9108eae7dd806d04352192336da3acb96d3bd301296a0152dfa9909343d8ee86724142c325de31f41487185446762c8acf76c6a890c4b06680006c78077ca79145ed10fbacec377788fb51545209cc841e2ab839808cdb6a6f380521f0e0619618faa8f4d963d0822783de63bae94b5107c32434b9c3ca2eb971e2aaf39346c87e5c200c2c7a064596bdb6934fc99a6c13ad10370ccd70e7637efbfe4b136657ab3c5d5c61bdea33666fb0c92ef8193439c1008ec7d67775673b137db109f2780f888df4bbfec294ca1f3d55ae47d7299a2d873c6695d450c03a9ea19f16b127ea00b27ded3b3a8bbc921ca4c35be389cd8a52396ce52f124cb07ff8b290a52dd4f46e1ff81a475db92682e2378ee0a87127da6d2e3e31d82376c73343f8759ee38a1385f6e7e9b26130447738fe9913d1a2809a585e97a3dbccd13e0d9b8550d81e1b0747d74fdcc2256e35de424612c2b18891dd1e2a70bc93a22d36e4bae7f48a0727f64541242221d58a82533d4d87ee80e90900eeca1941d1f7dd86a30c346764bc0aecc31d68d3f0181e64227a7b3e17d38681f962601ce85abe6d8e305f75dd65a6dc8b63bb03e8d3691accb13af5a7040e23ad7bd5d0be610bf9cd459e72d0d1f03db44a84ab35caaa0eaf0bd2cb7f0a61e7efcdd02a856fdfd95e42a64c4c0ad630cf9c12edd24c2cb55f211bb3c396a0b74c9e62251a79c6981691efee7f9cf21859d4284195e03ada1f3d427e05bbc73078cbf202af6d1ff2086f181124d0f93faf7fc4960725355a3aa0ff381f669b1543cf55165f6d1c17905127ab18ffedc812defbf59d6f43b184afd6c296cc934c1633612bcf60e4b2cfd81aac9965114b2260924fc610d0e39e2822c78b3091f89821cdb3b4186271dab08fc9b2a5c83bf502513296186e09117382fb10f580bb53441dd44cf894c5f668688c39c4c0bdf8815eb1703a638af1ad5b17ae5ef18147fa9bc025d8b3cab1e4ace2ea8168dea6d4ffb333784a564ad409c3a68a94ba6b6ebc6656285df0d62e68f2d7ab84672d868a86bed539794571f0b78359d74718321a0dec1d60930c0b5e781024548aeab30d12ef4872e0cc4f53f07c47736a8dc10f3bbe46ea2c532fc6d073c1b98ac543ea2f575db5f71ba39d9f4d8b66cd906fb96337a73be78224a0b2b50ca1d5a1006172bb23c9ffa05edb7ae485e41ddb5e8f7bee4fffe9de58a444e18fe6daaacf59e30e06efc45b40fff51ac7a4422346d659820a08468181b3354c82187babf951122aed16fc85ab520f640b0360dfd1cf2270a3b4f359e9919d0257cdd09716698c0a2a3bdbd7b81af01d17e2ea2eb51500dea71f1e72e537623fa5a332a56a1b714ba72cf11838d32cccf48156a8bf16d1ab10ffee627f3c6e7fb17758d7d441ac7e748d806a526c7fc65d2c7dc98da272e17d42c8a9a4e7ce1c2a3662aad33602e155372c444601057d1e480106c083cb73fa423f266bc223c16c8427b4126d440668559a3825fa45dad4a8a957956d709f3636133ac1efe9a924bc356aa25d8baf645d9b089dd8634956c4ee7303257ceb82bbdf91904c5b16d79d3ef103a0245c282a1f2721d7a900a9bf5fa69cd109512df8f834735224c6140753c1e8dcdd7eb76442e681b9d29ce8985c4a0110b17f4604a74ead576b0f52d3163fdac66d92b45538a330ac286a95a3e304f94239edeedd0ab3f164b3562e62044ac004db10af8abd4695acc393d19d3b53731dd089ae1906a2a80285d195307759faf2adea191a1061e57a4c63006ccb9df5a88ea5133983e8d3dea643861b24ff273f13ac4407347505bc962c0dab7d5d46935bdb9420e911f129ec86e5fdeed60674b643be508d142f2e69ae5527f0957078c36d64582bc8a018d2f05e3bd630e11c2c46d8af7c852a797343816bd46884b049a810f869a76615e8889de1afa2811514c45e62882fe480c9a289412b00003f5e6b46557d4fedf24a6aba3385a291cb29670725149cd1129fb02ce197c37b4b1484b99ee76686336fdf3ebe395cac73ccd44846a5052a273bf0f36fae75ce55b4bc919d339147748eb750704eb25edc503fdcb3384bb2e67f7bfa71864a211986e518f50c3ef9cbf946ac4d4835a58548bda0aa9eb2f5b86791d5f50f48281d62519e0d73faf3837da430d004e10681b3b8e0ee113c02c4fbbd25714ada15281ebacc627a1aad68fc3bd04051e779b7df0307863922e41df6e0083ca5aeedd81fc743acb30d519dad1a25aefec4d71df737fbe4c37e3520de301ddc0564d353fdaa88a059216df9959d79e416a79e87919fe03d3db0a86c9307d09fe870264c880e079e89f3f108423627b1f63d6d4545c7c0e18ea34a33cc1e13648a1a10016a609e1b5fd68cbabcc46c624c392006fb79e155a7843eea7dc6a42c323c82285f4e9027d73652853e138e3260b215f2b1dde7b1c55568f1753777af16ea84672e7e38d5e7ab9dd7ac93824e336e27fe973e4a5bdb8df8cc67e1de0897494656058ec148f94b0960c7ba65ec34ea0e95af17a6d7b0a4a71bed124813d4fd233f6fa196eaa202a1b61a2a202abb0adef039cd4489a80fc671fbcdd90c93c40549418d1c0e28e1246aef8b117f95a0a09ac239e1540e98889e00ad86f14bf46d65c20a717ecd965ddb63644c42dc2da4e60042b1bd165ede0326a349f7415c3bfa6226c0c94e2eda94f37904be76eee4dd90465f95b3b8225ab6985d174767b630b3aa20eca92ebb1d242b5aea946c373d4843101ba08a4ffffe3e2f40cad1e96aae0b714bfc0d9a27731aa753cfb35196edbdb11856bcb71c28c854ba3261f2745ef8336501b247b25c2f6bfc52a7b6aece35a34d71b8be3d87d9751a11aeba3c8351dc31c261c167aca59f176444bd122b4dd5674e23734551ba291461023fc35241b4d968f81836d23d8296c633da747f4b55ce3654e92031159ca675dd2465d652c250c8a2dabfb7a71a2242394a4d06e138bbc01e998cfcc48020c8bdbd03eb6046554f011b0542317e8bd25275201ea3f982bbd05a589989d5961cf256c2a0cca42cd7c3c6db3ef7e49adfba141afd6aacf9eb334cd175fbb5aa6c63c604a4d4f312a20456cf74dc465cdc1e84ae68ae8ee46ade4e994d4108604e67c035e7d0e3693c0d83e59d772245e869587b0a8f48aefca47a2e2e43ba90c3f500daa5f45c3a0c48c5f9524f794bf7a0a7383c1ed9c1084be614d17093f61762a9210e6c500223fd737b02f33bc15432b4b6b565a783b6004c3e2d50d2d153e66d1d60bb75ad9da0a8b158dfed8ac677f5f1a13af3792fd1e98d6d4aed99804b9a09f2b8213c79d42c96b3b464cf159ddbbca321ad9edec06f42a195afb26b888f4fdcc82a3107ca7f604661b0b50ad7536c1a9137f7f9f61d08188a445388f691e5c2b48e9b845c867583b9b491a1fbe38f90e5564d3b9e34c2a91803785ee40355a81a78d5da109e3b5c867b4a4a0dfd893d862801ab2aa2577dfbcd9150498447b8d92d5c7ac8bab2fe9983e58df24ec077998efac81b11a988e66f63a22463bba1ca5897ddd7396da73202307ea8d29020058a0ff32ea37c91af67c0b2aed05ae25c0a82f0c3680a3f2b5a28624e9ff1641f87f18c72fd71b9313406923e9c63c127b0a3915027bf59d5a4a184a57d5ada12d4cc6955bcd179ad991fecb9ec53e9d49ff42c768345bdd9463f4036fa683e950592f53812b36f29cf767ecfd95f0e7f526f009f281be740ac14f7299bba9db13078547a0fd01b6f7512b74a9ba5aecf6ba0ef122cf0469b200b86636a11311782c4f06e7cb88b20602a6ec560b9e153351ff0165eec6ac33a46b1a9310a37e0d539f3739c9a00dda744070810e8ea84db7703c630e488fc86a0e4c669a3eab25be82cd520533cd330a0d7e4b5ee8d1bc565be8ff64fa06d814e1eb63f61264dc344ca29a8af695cdc6f9345ac776414182c1349fe1859d80c43df375c3808714075613e5db64b488ca990238386c24888c4ff10589ae9db771d6febb9a6f2"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:37 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000a6e000)='/dev/vhost-net\x00', 0x2, 0x0) r2 = open(&(0x7f0000930000)='./file0\x00', 0x0, 0x180) fcntl$getownex(r1, 0x10, &(0x7f0000ae1000)={0x0, 0x0}) getresuid(&(0x7f0000dea000-0x4)=0x0, &(0x7f0000f26000), &(0x7f0000f18000-0x4)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000c0d000-0x4)=0x0) sendmsg$nl_netfilter(r2, &(0x7f0000713000-0x1c)={&(0x7f000014b000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000739000)={&(0x7f0000bf6000-0x2bc)={0x2bc, 0x1, 0x2, 0x110, 0x4, 0x3, {0xc, 0x0, 0xa}, [@generic="ec0b73c92371479e828b1837983d85056de1af04d7b344b48546bcc71d733bb330423aea11a20a9bac5f3e42bdc0e91cb2df99e1b9d2166bd2a662067f7e42dcd544bf5e18c8c33354095a30f6087165f7289863faa49e8de70f285a275b830c06141e9ff638f0fafafb776ba2a64ecc5db1bd9fa989e488347c00", @generic="ea933e979781c8c4b491d4d0ac2ceca63eaffa38ebb386e8db4c027599b947aa1951f474bde8c1fb9d7d1f1cc6212aa9222231551f135631b46df933a7fff5c261dd22530f4b60098e86cb495703f29bed159595864673c1c025dec7b5b2932395d0ab70de66976a28d89bfdf1a6b62e64fe0582a8fecd0db52aa10653d524a2f347a35ffd0d545235a2661fa614684ed0ca00644f49519c6283a6d9438e098716c4a476cf5bd628047c3174b0ac7502c21306b98a2d", @nested={0xc4, 0x95, [@generic="f542287aaa83b14ef4516d5b4079a497ba690679937497bdbc5e24b32aaab20e6f336f6902913ffad4cf2905fcb2a17bcdc58e8762e439a5611fa6d3ae65f98e3ef4924a51e1e1643504a3dcd5739209f2aece0883e7e06e87bbff131ab2d3131cddfd64653dd2441b6aec053ceeea47be2e39084428f6686a13b19d991428a678308789", @typed={0x18, 0x88, @ipv6=@empty}, @typed={0xc, 0x7c, @pid=r3}, @typed={0x18, 0x5e, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}]}, @nested={0xb0, 0x18, [@generic="d9ef6fc1e2cef02610b8b494c99d43dbe486811ab0bcc28a43cfba6d40e06db8b352a844817cbb80f50014015630dba033858ab40fb40f22c2c8db5aad320b6b1adb47ea832383b23249c020052df25d12f9330ed1bcf641ccc94fbc866d907cf0bc66af0a848d77c132f622d6f4f76238301894be730a22aeb61785b69bec9d40afe3e3b5b8d631", @typed={0xc, 0x42, @u32=0x81}, @typed={0xc, 0x12, @uid=r4}, @typed={0xc, 0x5, @pid=r5}]}]}, 0x2bc}, 0x1, 0x0, 0x0, 0x90}, 0x800) ioctl$VHOST_RESET_OWNER(r1, 0xaf02, 0x0) 2018/02/04 21:33:37 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000d20000-0x8)={0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000bbb000)={0x0}, &(0x7f00005c3000-0x4)=0xc) mknod(&(0x7f0000280000-0x8)='./file0\x00', 0x1105, 0x5) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x8, &(0x7f00009f6000-0x8)={0x8}) ioctl$sock_inet_SIOCSIFPFLAGS(r1, 0x8934, &(0x7f000027b000)={@generic="6f198212629509bde87c4648390192cc", @ifru_flags=0x8000}) r3 = socket$netlink(0x10, 0x3, 0x1e) writev(r3, &(0x7f00002af000-0x8)=[{&(0x7f00008d8000)="290000002000190700003fffff00da060200000022e80001040000040d0014000001ffff000000019c", 0x29}], 0x1) [ 90.014725] binder: undelivered TRANSACTION_ERROR: 29189 [ 90.020733] binder: release 12073:12081 transaction 279 out, still active [ 90.027796] binder: undelivered TRANSACTION_COMPLETE [ 90.032975] binder: send failed reply for transaction 279, target dead [ 90.086135] binder_alloc: 12118: binder_alloc_buf, no vma [ 90.091860] binder: 12118:12119 transaction failed 29189/-3, size 24-8 line 2957 [ 90.099996] binder: 12118:12126 BC_INCREFS_DONE uffffffffffffffff no match [ 90.102871] DRBG: could not allocate CTR cipher TFM handle: ctr(aes) [ 90.107135] binder: 12118:12126 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 90.121411] binder: 12126 RLIMIT_NICE not set 2018/02/04 21:33:37 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f000087c000)='/selinux/enforce\x00', 0x201, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000d59000)={0x0, 0x9, 0xa, 0x10061636}, &(0x7f0000bdc000-0x4)=0x10) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setlease(r2, 0x400, 0x2) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f000033a000)=@assoc_value={r1, 0x6}, 0x8) openat$ashmem(0xffffffffffffff9c, &(0x7f000022b000-0xc)='/dev/ashmem\x00', 0x100, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0086426, &(0x7f00001f8000)={0x5, &(0x7f0000e92000)=[{}, {}, {}, {}, {0x0}]}) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000378000-0xc)=@sack_info={r1, 0x3, 0x100}, 0xc) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f0000245000)=""/21, &(0x7f0000c55000-0x4)=0x15) sendto(r0, &(0x7f0000caf000-0x45)="888f2b7a1e465c60a25f072f6cdc4f5e54e14015b9c0fb8cb698ca5b8b95c64a1a65d1f26da6842c44eadc4b263aae795b5185dedae5f56dd128af0f4117ce4a228a5d8f3d", 0x45, 0x2400c044, &(0x7f00000e0000-0x10)=@ax25={0x3, {"222ea171e89267"}, 0x5}, 0x10) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000487000-0x4)) ioctl$DRM_IOCTL_LOCK(r0, 0x4008642a, &(0x7f00008f1000)={r4, 0x4}) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000ee7000)='/dev/rfkill\x00', 0x200000, 0x0) poll(&(0x7f000086f000-0x18)=[{r0, 0x400}, {r0, 0x1024}, {r0, 0x252}], 0x3, 0x10000) sysinfo(&(0x7f00004f5000)=""/218) setsockopt$inet6_int(r3, 0x29, 0xc8, &(0x7f00008d6000), 0x4) setsockopt$ipx_IPX_TYPE(r0, 0x100, 0x1, &(0x7f00009c3000)=0x8, 0x4) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000301000-0xc)={0x8, 0x0, 0x0, 0x6}, 0xc) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, &(0x7f0000112000)={0x3, 0x10001, 0x9, 0x9, 0x8, 0x8, 0x10000, 0xfffffffffffffffa, r1}, 0x20) setsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f0000f0a000)=0x1ff, 0x4) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f00004ca000)=""/4096) setsockopt$inet6_int(r3, 0x29, 0xc9, &(0x7f0000c3a000), 0x4) 2018/02/04 21:33:37 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000b2a000-0x9)='/dev/rtc\x00', 0x4000, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000c24000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup3(r1, r1, 0x80000) ioctl$DRM_IOCTL_AGP_INFO(r2, 0x80206433, &(0x7f00006c5000-0xa8)=""/168) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000b86000-0x68)={0x79, 0x0, [0x1f]}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f00007a4000-0x400)={"8a927799b09a029f01061eda96dd379385fc78b28fcbf8eb8455a6fb67a8de46d4d436f5a01a47191dc792f414ac8437036bb34b6632c980073c4cdc084a1966c440f15811b116f5b50e90810603f10a2c83eb8c06219424d0b67e4bb4b3c5199cadd60d3f6fc72a7eb011b622072532229fbc9d9c4d1e0451d8092b0d584c8fd736ee3e7d73d5267b67a69251b1a864fb90692d30ec7e806326f17f0a7a24aa58b111193c880000000158cb00807d63dfb58775215937ae2b62b46c6d6916f2fc52eeab0000060000000003252929e628ad2c34a0ef717fb2504d9bd66eabce8f2fafc812148e072f3087a5566c38fda729442c3ebd62e970a9a3eb242747993601a1a186b8376d39c69c6de555b2638feeae79436a9708b3bb19f38377382ea7b4c9c2d674b80ef220109f8fa8200de4794547b4da6430ac512116d358949a298812c5d540179e0000000000000000d4053474ba93a8ad32b16371b42350bf984abb465228cfd848e54abc383d21d00200000000000000bf10bd30a1371757b138ed4a19db7c777995fd42ad446d9d2755f8552563c7639ce00da8ee01009ded52625a000000000020dbd0695beeae158271064ea79bddf103ab6e6ac794f37e09d0c3bc4923cc7b631c6df64f28d75d99443d6653db3c6b7961190e8f82a233925540b32c08000000ef93f01aef51c697c457944206c1b2af2eb21ed8437a371c0b427cd8c94f3952ee752b858eb5bf410a0c4f4793cd6638a2a23d68cb6e86925599fbc1361b8ce27bf6d79027894b6c0003cc97a64088edf383a51eef947915369bdd4fc3cded2663d1751583008fbba284c5b6ffc525101913ee59d117d34c73e50fbd33ceb4508c00000000800000004a884a13542dee77b265178301a5d9260036ccc70d695105d1ddb56f1ac26584547d8d5cecb3c672068cc7ab31ddc5b47c253b587d712c6113acdf49fa0100de0f7b3717528e35b7e70733538a5cec8f69000000199002baab7690fab7933b676deddb27755d6a8f29c643dfff0e4bd7c2b13b7a57a3120c9dcbb70200339dc0862dafad481a63e7f90d14c54803d8b100e0ad5cae7a0a7b2f329c3b00000000007c0002f4b2eebf5bcd42688b08a10a6575a31f81f01c13c7cb674ff41cb3c7f6896d41e86bda845164825e28b9fb719e695a9ed5710f924aefde1c96bed74274594038347691a088f9bcaeba90315d3b3cfc24388cc15dffeda1bd610582c5b74fa6c6e789ce44ef71871a028b85000000005806743e8e075b8624686ceb21db0100fd74dd0067d82a72c099a2d52a599494388cb56cdb5ef9190980f9128e689ecee98b2ed59e1537fc9fe144dc203037040f5fcfd8f2ef242803f7bcbc07145f65b8912a4a055b858de8acf080852c4dd353a00a5aac3d6a33e0075506a1fd25799f1637b1bafaf09954ef"}) ioctl$KVM_RUN(r3, 0xae80, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r2, 0x28, 0x0, &(0x7f00001f0000)=0x100000000, 0x8) 2018/02/04 21:33:37 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000b7b000-0x8)={0x0}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000b99000)={0x0, 0x6}, &(0x7f0000427000)=0x8) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000adb000)={0x4, 0x9, 0x4, 0x400}, 0x8) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f000004f000-0x8)={r2, 0x5}, &(0x7f0000c55000)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:37 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x9, 0x111000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x2b4, 0xffffffff, 0x21c, 0x12c, 0x21c, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000000000), {{{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0x12c}}, [{{@ip={@dev={0xac, 0x14, 0x0, 0xb}, @remote={0xac, 0x14, 0x0, 0xbb}, 0x0, 0xffffffff, @syzn={0x73, 0x79, 0x7a, 0x0}, @common='tunl0\x00', {0xff}, {}, 0x1, 0x1, 0x20}, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x6}}}, {{@ip={@loopback=0x7f000001, @multicast1=0xe0000001, 0xffffffff, 0xffffffff, @generic="9381f191685cebc673db5295505a9c92", @generic="776f306f639ad5de4dbbbccafe53d529", {0xff}, {}, 0x32, 0x0, 0x4}, 0x0, 0x94, 0xf0, 0x0, {}, [@common=@ah={0x24, 'ah\x00', 0x0, {0x10000, 0x9e, 0x1}}]}, @common=@CLUSTERIP={0x5c, 'CLUSTERIP\x00', 0x0, {0x1, @random="9bc3480340cf", 0x7ff, 0x6, [0x8, 0x0, 0xf50, 0x1, 0x200, 0x9, 0x9, 0x100000000, 0x1, 0x62, 0x81, 0x9, 0xcb8, 0x0, 0x91e, 0x5], 0x1, 0xecd0, 0x100000001000}}}, {{@ip={@multicast2=0xe0000002, @broadcast=0xffffffff, 0x0, 0xffffffff, @syzn={0x73, 0x79, 0x7a, 0x0}, @syzn={0x73, 0x79, 0x7a, 0x0}, {}, {0xff}, 0x29, 0x1, 0x8}, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x6}}}]}}, 0x310) r1 = socket$inet(0x10, 0x2, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$GIO_UNISCRNMAP(r0, 0x4b69, &(0x7f0000002000-0x1d)=""/29) connect(r1, &(0x7f0000008000)=@hci={0x1f}, 0x0) 2018/02/04 21:33:37 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000689000-0x1e)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f0000793000)={0x0, 0x6, 0x8, 0x9, 0xffffffff, 0xa7}, &(0x7f0000de1000-0x4)=0x14) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000a92000)={r1}, 0x6) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00003cf000-0x1c)={&(0x7f000018a000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000008000-0x10)={&(0x7f00000ac000-0x118)={0x18, 0x29, 0x701, 0xffffffffffffffff, 0xffffffffffffffff, {0x800000000003}, [@nested={0x4, 0x0, []}]}, 0x18}, 0x1}, 0x0) 2018/02/04 21:33:37 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, &(0x7f0000b59000-0x20)={@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x20) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000788000-0xd)='net/anycast6\x00') preadv(r2, &(0x7f0000560000-0x80)=[{&(0x7f00002f1000-0x77)=""/204, 0x33d}], 0x1, 0x3b) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f00004cd000)={0x0}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4008641c, &(0x7f00004f4000-0x8)={r3, &(0x7f0000694000-0x36)=""/54}) bind$packet(0xffffffffffffffff, &(0x7f0000003000-0x14)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x14) 2018/02/04 21:33:37 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f0000991000-0xc)={0x0, 0x7ff, 0x2, [0x3f, 0xfffffffffffffeff]}, &(0x7f0000579000)=0xc) setsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000b66000-0x8)=@assoc_value={r2, 0xffffffff}, 0x8) pipe2(&(0x7f00008f6000)={0x0, 0x0}, 0x84800) ioctl$VT_DISALLOCATE(r3, 0x5608) 2018/02/04 21:33:37 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000c55000-0x8)='./file0\x00', 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000dc3000-0x18)={0xaa, 0xfffffffffffffffe}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000c20000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000a78000-0x10)={&(0x7f00000c5000/0x3000)=nil, 0x3000}) ioctl$KVM_DEASSIGN_PCI_DEVICE(r0, 0x4040ae72, &(0x7f0000382000)={0x1cd, 0x81, 0x1, 0x7, 0x8}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001000-0xe8)={{{@in=@multicast1, @in6=@dev, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@remote}}, &(0x7f0000001000)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000000)={@empty, @dev={0xac, 0x14, 0x0, 0x14}, r2}, 0xc) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendto$ipx(r0, &(0x7f0000000000)="8bd1fbd115101afb4a32dcceba7f158377d5acaa86dc6d8e48f2804c0c0f46e402d23d81e83352a522e095cd461b157137acef4c33cb0c904c6661c569368247e480c2c013f440f876f8f1cfdcb7c32cb49473970bdaed88d1e336eb718425130653127936ee2bb11b722cde290100a4ad232f47d70550e360299bd8afadf3b677ca692360ca097ff63bd9414e1ab6d6807a6dbd5d5ed2b8d5a03d6d2267d6d31e265715e5986e5a07f4d281fbd233cf3cbc5d148217efb94e08adc138ecb0a00962fc7b140dcd00b8ba9920167f57b1feb14c87b854044e931f05820ef2339363df7cb45ec7c948dbd19bb9df23b4d2fd4c4c3a609e99b8e9d6abaf28520786fcae138d681e799b1a362a2f5849d3b99ef90a29e559f97ab2e34445bc70c7f29fb7e47897a6ae4e5d35978791cccae6ba4b6f6c741c2e26c625d1722a0ddba7bf45833d044042e3fcaf4891edd70ca740e6f1ae78819cc2379b768f88445c3148f9b5e783bbb41c0a3684a2de911f3ca0f2ab3076cd70c3e84f6289e7274559480772e1b39b9dec97e37bb4de991ee85dd388939ec5a2d891d4921c1df9ab530a7da59ca42af8ebe93ddff5272d7fab4ad7f8a8aaa0445f18757f2fa541d1106a34f391654fba53c725c7b9348a34b484c33f5a949e94ef58e7a61ecd2f1754d874d5a9c7a54257df080709a9b56fc21b8c2d877e7fdad42da0e707a385de5b496e2a26a398129a1fb2b5413819a32c6c9965f2b248c6135b6f1f1e5290737d3a8bcacec56b49eda3b0f44618c84be13f9d96c45382489608ff61264efd82ca7fa1398db00d1ca5d3c2640a9c316daeb1b5b3681c2680c790506e78836a0898793bb707be937ce6f51469310f9dc7d307f4a33bc3f14afc0f8b8391b12476210ede739363c87292a47e1ca8a4fc997c063854a5acbf2ce953f9a9e5eb60e1036820939b88debd18d183a36fd3e0255fe87e14b07691b2cace1f29507a4d4085ff5c512f97d55160d14554a830a6e67f349a7cca96b6331a7c63fd76672740ac7fede69f259d1e8b2b3229f539830598ce45323307995d17f71c7629717f898ee873a21320edd9e1c9ff22e2dad6551a17a683ac3d935161a3cc74ed2ee8b9ad8e68157a0080497fcdf590369da941722e86138323c9badc0ca83302394b5baec1bb51f48b1dcb2368a4b9414a03cf8017cbdc9a2c4ac5057c7f718d5da3b86a5cc4431b8696c19bfdbb80c6c15723a79283649d60b70d2fca395925a2d690678bec6d3be17240a732a612155d7c0b306d7d4ae7b092ef38b776f047b680a359c1897658e5eea229999b8a96bcf80821e95ace0c1d24a1f5b348132cb32f126d589d65986c2badbd0053c207e29a89e178aa8cc7fc07993aaf34ce3bd076002f87a67b2f6633a2cafdf817db10850f9e8007818464c776b05fbe4e46eee4d7101574e2d65e00844754d7129e57f02ad365e11b4cb3644cf257482fc823ace7c04e0a37e9fcf7e619866a86a878629d3e70cdc3a9199470a26673145d65b5fe19e60430da2865209ae513b2dcb8a80d773aee42d07465f1f8c44fac5cc6285e18ee41f17f323fe4e5b732c0a9a700cf2403c2b7f5644daa1d0a1dd9d25635d45e335c512a08aaa4b1e0be8071eeedb8d00521b0c1bd2a0849a694cd6112e0478ad2a70afaf5cc38c2fb1c808d78232e540e75f1937e66b6337907140e01c590815da0628c9f9a0b97091d7a22ca7b031a62fbd82989b628bd4884e4742b58bb97c0ec3ef0906f993eb9ccdc72376af20667db4c28ef921df6c3a7de033cf18878be14a3096322df4833032e21271444bf8e2a25596711ca53677d288ceb97762a30b610b32205c51d38abf1606f0a2b1b5acbd5cd9f2f12637c84e1edcfb90f1c2b566de847381f9cd490684de06b4dcd5f18373774867c18b65b3d235c4236f6ebdc0162bd4d47baf8e63186331c4276bf72ee2f1383a088b22b1fef9260ad5e8d193db776aecd77129a53777c98a703e546e074f3c387b15914c1b9bd4a9c798b56153cde884d71ed60d51764e1605e55ae413744bbd1b4416caadd30308d8a195191782a4001b3eef9ced565246d2205c23dc343acc9d5d063431cf95be38e07d037ba9bc95d5a635b9942f1378929140ad4ee827fa851b4aa1392f2dac3b490de34311692bbb6914d3e9bfb451272d38c20c02e051893914630e2513a829c5cf3c2918415cecba629850a277579efd4bc7e0cbabc3f745106e6c2d66f39b2c2d6fa3c0142fa0f5c9460f172df578f24addbd2b0bee87f5b22d65732b77b634141ee9638f9cdd1efc9f9941487159cd70729b5c70a409e0327af55331adc9181f65bea27f99d27f338d498522f9f1d2b50c3564ce65034ea26f7b92c7ab18e07152108da145d6cc50bf07a62cbc1d668ce2789a2d08111c09abc9c3fc3f94f9f462e737629a089e6021651de0054914dd147f5c6d45d0bd0c7cc250b3983a17f57ec466de85daa9451d53109b12be8afb791f4e4a31204ef30bcab2238c15bd01f05c9bbba42a36e35378bb6202fd1298171b397ccc535bea55b3f618bc76f123518bf5b399c21b10b69fa5e5554e498341c4c47acd2174f8a9db062e20c39dc12ad0e7c53faf9412e791d2cc976a18e0efeeace1e38bdb73a979ce2fb5715a3c8b73ef490061c838944fe6b76770a8d669a56a7024c344f1756e42c8bb14553e8ba4cba8d28784af5871e605e36375c57c4fa1a395d19abd425a451614ccb7499390a8e6c8224c45374d8257a4710a73f4d958f562d14c7022f4dbc98c1acb36a31e5d7e98a79f8f221f0b8813ab8c18d7641f716b252b506f2a8b28b5ee1aa8a89bda4934b70a5243e48bdb33d68e760cbe009f49ab7be560b927ba52bb63fc4f4707d31150064c448218d8396160912564a848d6f840f181367bc44ab4823bbfa9bf49880b32f8c7bc064ceaecc3150f85c6c240f6d85f428625541e35bb5cfefb816a5073672e9cd8ee7ec0c2144b0012f8e24a5afa354c16cf8ef7d067fc340157c8ad4c90bf5d592e2f56d2aa1c488e5430c249763b36b9638ed13d3fe4ff71e6b76cdf35ed4217d59a67a8502d1f57408fa017a7f30b75e8e9911f80d5793c53c1449baad0bc69883a8f17078506beac977ebdd479baba790a1dd885196d6858e5c271cddc09743d4d23599b3dd1ff9ef18888ea0a848540a9513bbaf1d779d3b943da58a899f44d851a989326de1d5a4f4c736969ddd6bc36f41447d0868a5f566615fc3afd06d5d3d7c9385664e9640fe43d59a216187e486d2355d3785cc7425175687256af16710d5f91a6bb0c07051a3507bfbb286fae76f2e231e966644c9cfa3be5a253114802a921346c4d35c28a9f6672f94efc6a947dd41497abdead1c713e4dae0778d27c1a788f076d7e141bf926f6734371da9658060ba83e41fdf2ed5a3ccadcaeb8dd2ab071b9c3fca3e8e1d7dfc85846066e05798afdf71c803f343a8f84ee427043a9f070c4161e374d200f444a8a993dbbe9538308e607acf936f678c99161e07ab6aefecec7d87db91763434a5c3ce851788816d2ad9861791d38328c7a8b240cd6f12741791d698aee87aaf2df0a6241d1e236b786f4127198b8a0b7603e50a7fe984cb9ef7fc227b2861f2fc8d061fea30fdb64c2580cb773cc8bb111a091e3f94c2d3797de32677cc5c79ce1d7dc6f28084a3295453bbc24975b9446f39374f578eeffe9f5adf818df9caeca1d73f37695707b7410571290ebbaf5021725dbf51ef9894fe4a5956d72cf7429cbb3870e562838c6b7062f5ef1feb279905cc7596d05816ef082e4cb4c9cb2f030bcee9877bf7d3b2e5d17400064a8b6d706d8824079adf6e956db29697696546d3a50bb9624721bdecb83eddf5cad78a9e01066059c115d26d9e67f723d322d20431dba9bae70a58f455ceef4a55b1ff6a490b1a5976e233d3889210043a865541c339dbc7a63954a620525bf44147b1999795956e8e5541e72d05602635b206a4c293d17f5a502c54243e59e9f936d15f3cb89e0e1daf3b3e095918e5100f1cb01cdaefb13a71b41121cc0155fbbea66f265024ee6578cd491bf258e6522407df7b7ccd60f795f306bc3e443cca374adf54d3bcd0a69ef7404946c4301c3634a845921d887565082462b0ddfd97e9aaad91328a511343fcbc13b370ead171228075fa98b466be5bb9d7d10b0eeffd43833661fdce3fca2fdb8fc8dc2f9b3a5216b84ac96e8157c93f5d81977178e1f26e954d94aad91f03ffac4aae442a01f5330382661adda535b29b740bc4d19d0d60d7dde3c45626d59682724becd0da11664aa0a4c939e7aa36c7cb3a09521eae5a7c6340e708081dc8782047a09deadb8c572dcec5fdeed0117a9d6cecc04cd00e4f2d83bd6cd8d807e59b728d8fbc055777c43a0c38f63653cfdcdd41acb8c25c7d8ced63c9cb484cbf0a47b183ec65cb8c45739067d5baf562a67c645c5609125f640198feef911582e5a03739583e69c985d0731ccc1ec2b8850e8041364053e8da54f101f2482f9b2e0d57ccb466709f12b62e7a6897b87f5d282a2f41ab5ad0cd8887b306193a3b65cbd5fb91d582bba0b9058580cfa0049d838b80bdadafd6093a610280a2239535ae8fb3159c2bdf7baf1737448f65f59b69996cc307c1a99a52be30ccae63fe503dd6f3d4a9dc4a5f58da97090ca70b837996773d4a7fee6ea83ea9a77d18e95d63a46e99f2536635c68809c6f4d507551612782789dd93b88690dbcf5b6f7972c0400f935101e9f9e76ac8c4cd2ed5d5e6c83f8e274f62911eb0ee6bcabee5e0e018c801fa86965853939d1d72689f1bfe88f93486fd6122b301e5a9bce8fac3cdb11663facca630e45be92a43b554dbce996e0ab77a226793ee23580a271cd06b1f8f5de65c2dd88b8f62b60469fb9d84091672248cc0c4001ba748b1b3aad8437b4f372026d79d2d801ca60dd57880a2960d4570295578705fa37dc118e7c8cda0c2b466f341f392afc70aa404d3733245785ec22d5d6accc35b3301a31866863b0b8f447dbc414fb97d8b8686350a5e2dd43658df3e472d97a4c7e49b6fe7b314d1c95303c9b8dc2a9673e6da9980cedb85600888a0fae09fa70cc6a020b59a41146d5b8c5ff9d263361081f7e3843691dd1cf428deccbe3e919e5b50a021c1b6a251f471f0075b579898a2918920e93337765c76e9d7405c9bbbe6ea89e7bc9b73d5c1de2a2fe8b0efb6ba378567af8efee7714af929ee5134c2322951c7695e5673612e3f5c73cce559abd903f91217d752ba64e91a3c545baa03c373434e07f57b3eb0d1335468f1613d145a273ca0d1594a7f8bd8362c6faebc8fba18b7dbee4baf39af26eb8d2cc13f799ef6480fd603074fcd96e494a20f394033e1cafefadece623f1498472cf3ec80004190b57cb6e9144b45c902bf96c6c1ec01df59bea9b9137ff74cb3187467e838f37333d17e78290c031adeaa39977c0f471082f0228ce704501217e43772bb3b8a4f06051c2f0427b2b80230e5748047205b296586f93e8737a656479d4567d31ab839f3edd0e2e0984604fe16b08befecc458cc29c9c2acaf5f49239090ee3f9ff934c3fcb25496b0c0c3804b2534a945a8bf224fe85b43e194b71601f007ff378fa8ec7dc3c4c05d0d6138af1891bae411da19d2d851bd3dadd972cd12a2df72cb483c7b789fd285353a11ad4938d728d95203cb25f1b06f342056b264106a89b126e6a5c6d2a142140fe536e85c490915d86dbd5f35275825", 0x1000, 0x4000040, &(0x7f0000003000-0x10)={0x4, 0x2, 0x5, "975844bce0ed", 0x8}, 0x10) syz_extract_tcp_res$synack(&(0x7f0000001000-0x8), 0x1, 0x0) [ 90.149819] binder: undelivered TRANSACTION_ERROR: 29189 [ 90.200786] binder: 12138:12146 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 90.215673] binder_alloc: binder_alloc_mmap_handler: 12148 20000000-20002000 already mapped failed -16 [ 90.234267] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/04 21:33:37 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000002000-0x1e)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = dup2(r1, r1) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000013000-0x8)={0x0}, &(0x7f0000002000)=0x8) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000001000)={{{@in=@multicast1, @in6=@remote}}, {{@in=@local}, 0x0, @in6=@dev}}, &(0x7f0000003000-0x4)=0xe8) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000002000-0x20)={0x8, 0x9, 0x4, 0xbd17, 0x7, 0x80, 0x6, 0x4, r3}, 0x20) close(r0) 2018/02/04 21:33:37 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000234000-0xa)='/dev/ptmx\x00', 0x0, 0x0) open(&(0x7f0000f6e000-0x8)='./file0\x00', 0x81, 0x0) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000cf000)='/dev/kvm\x00', 0x400, 0x0) 2018/02/04 21:33:38 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f000078a000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00006d8000-0x20)={r2, 0x0, 0x0, 0xffffffffffffffff}) r3 = epoll_create(0x73) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000a7b000)={0x10000000}) write$eventfd(r2, &(0x7f0000353000-0x8)=0x2, 0xffffffffffffffc3) [ 90.245989] binder: 12148:12152 ioctl 40046207 0 returned -16 2018/02/04 21:33:38 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) set_mempolicy(0xffffffffffffffff, &(0x7f00005fe000-0x8)=0x3, 0x79d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00009a9000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 2018/02/04 21:33:38 executing program 6: r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x21000)=nil, 0x21000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r1, &(0x7f0000003000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) r2 = socket$inet6(0xa, 0x3, 0x1) sendmsg(r2, &(0x7f000000a000-0x38)={0x0, 0x18, &(0x7f0000010000)=[], 0x0, &(0x7f0000005000)=[]}, 0x0) ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000017000-0x18)={0x234d, 0x7, 0x9, 0x6, 0x5, 0x33}) recvmsg(r1, &(0x7f000000c000)={&(0x7f0000008000)=@hci, 0x6, &(0x7f0000007000-0x70)=[], 0x0, &(0x7f000000d000-0xac)=""/172, 0xac}, 0x2) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005000-0x20)=[], 0x0, &(0x7f0000006000)=[]}, 0x0) recvmsg(r1, &(0x7f000000c000-0x38)={0x0, 0x0, &(0x7f000000c000-0x10)=[], 0x0, &(0x7f000000b000)=""/254, 0xfe}, 0x10002) r3 = accept4$vsock_stream(0xffffffffffffff9c, &(0x7f0000899000)={0x28, 0x0, 0xffffffff, @reserved=0x1}, 0x10, 0x80800) mmap(&(0x7f0000021000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x803, &(0x7f0000021000)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000b42000)=[{{&(0x7f0000336000)=@pptp={0x0, 0x0, {0x0, @empty}}, 0x20, &(0x7f0000755000)=[{&(0x7f0000108000-0xe3)=""/227, 0xe3}, {&(0x7f0000086000-0x24)=""/36, 0x24}, {&(0x7f00009bb000)=""/252, 0xfc}], 0x3, &(0x7f0000044000-0x9d)=""/157, 0x9d, 0x3}, 0x8}, {{&(0x7f0000527000-0x10)=@can, 0x10, &(0x7f0000b8b000-0x20)=[{&(0x7f00001d1000)=""/236, 0xec}, {&(0x7f000051b000-0x7f)=""/127, 0x7f}, {&(0x7f00006e7000-0x92)=""/146, 0x92}, {&(0x7f0000364000-0xe2)=""/226, 0xe2}], 0x4, &(0x7f0000025000-0x37)=""/55, 0x37, 0x7}, 0x8000}, {{0x0, 0x0, &(0x7f0000245000-0x10)=[{&(0x7f00006e0000)=""/249, 0xf9}, {&(0x7f000090b000)=""/87, 0x57}], 0x2, &(0x7f00007bf000-0xbf)=""/191, 0xbf, 0x9}}, {{&(0x7f0000d91000)=@nfc_llcp, 0x58, &(0x7f00008bd000-0x20)=[{&(0x7f000042c000)=""/21, 0x15}, {&(0x7f000044f000)}, {&(0x7f00009b1000-0xe9)=""/233, 0xe9}, {&(0x7f0000910000)=""/20, 0x14}], 0x4, &(0x7f0000403000-0x1000)=""/4096, 0x1000, 0x1}, 0x7}, {{&(0x7f00000b8000-0x1e)=@pppoe={0x0, 0x0, {0x0, @random, @common}}, 0x1e, &(0x7f0000751000)=[{&(0x7f0000c90000-0xe4)=""/228, 0xe4}, {&(0x7f0000418000-0xa3)=""/163, 0xa3}, {&(0x7f0000505000)=""/223, 0xdf}, {&(0x7f0000f8f000)}, {&(0x7f0000726000)=""/225, 0xe1}, {&(0x7f0000567000)=""/45, 0x2d}], 0x6, &(0x7f0000a67000)=""/76, 0x4c, 0xffffffffffff3578}, 0xfffffffffffff163}], 0x5, 0x20, &(0x7f0000be2000-0x8)={r4, r5+10000000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:38 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x1}, 0xfffffffffffffca4) recvmmsg(r0, &(0x7f0000ea7000-0xe0)=[{{&(0x7f0000be8000-0x32)=@pppol2tpin6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @remote}}}, 0x32, &(0x7f0000018000)=[{&(0x7f00009b4000)=""/76, 0x4c}], 0x1, &(0x7f0000164000-0x12)=""/18, 0x12}}, {{&(0x7f0000881000-0x10)=@vsock={0x0, 0x0, 0x0, @any}, 0x10, &(0x7f00002db000-0x8)=[], 0x0, &(0x7f0000a0b000-0x75)=""/117, 0x75}}], 0x2, 0x0, &(0x7f00009aa000-0x8)={0x77359400}) getresuid(&(0x7f0000688000), &(0x7f0000a8a000-0x4), &(0x7f0000ff0000-0x4)) 2018/02/04 21:33:38 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) socketpair(0x9, 0x80000, 0x2, &(0x7f000091a000-0x8)={0x0}) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000020000-0x3)) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000a00000-0xe8)={{{@in=@empty, @in=@multicast2=0xe0000002}, {}, {}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4}, {{@in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x0, @in6=@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}, 0xe8) fgetxattr(r0, &(0x7f00008fb000-0xd)=@known='security.evm\x00', &(0x7f0000797000)=""/162, 0xa2) [ 90.292608] binder_alloc: 12148: binder_alloc_buf, no vma [ 90.298303] binder: 12148:12152 transaction failed 29189/-3, size 24-8 line 2957 [ 90.307642] binder: 12148:12156 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:38 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f0000847000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0x0, 0xaa}}, 0x10) sendto$inet(r0, &(0x7f0000fc3000-0x1000), 0x0, 0x0, &(0x7f000069b000-0x5)={0x2, 0xffffffffffffffff, @rand_addr=0x2}, 0x10) r1 = gettid() socketpair$unix(0x1, 0x400000001, 0x0, &(0x7f0000dbe000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000540000-0x8)=0x3f) fcntl$setown(r2, 0x8, r1) readv(r2, &(0x7f0000cf8000)=[{&(0x7f0000fb7000-0x64)=""/1, 0x1}], 0x1) fcntl$setsig(r2, 0xa, 0x12) readv(r3, &(0x7f0000fa4000)=[{&(0x7f0000fa5000-0x8e)=""/1, 0x1}], 0x1) r4 = dup2(r2, r3) tkill(r1, 0x16) ioctl$TUNSETTXFILTER(r4, 0x400454d1, &(0x7f0000585000-0xa)={0x1, 0x1, [@empty]}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r4, 0xc0405519, &(0x7f00008ad000)={0x1, 0x7, 0x0, 0xff, "4bb464394c0827d1f2c92c03cab08c150733241d66174570e54cb403a2213a757fa7e3826e30537f7272ff22", 0x20}) 2018/02/04 21:33:38 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() capset(&(0x7f0000458000-0x8)={0x39980732, r0}, &(0x7f000033d000)={0x5, 0x7, 0xb5cd, 0x1, 0x0, 0xea200000000000}) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) r2 = syz_open_dev$usbmon(&(0x7f0000285000-0xd)='/dev/usbmon#\x00', 0xffffffffffffff01, 0x2) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f00001cd000-0x4)=0x4, 0x4) [ 90.380258] binder: undelivered TRANSACTION_ERROR: 29189 [ 90.386622] binder: release 12148:12152 transaction 286 out, still active [ 90.388390] irq bypass consumer (token 0000000073cfed3e) registration fails: -16 [ 90.393635] binder: undelivered TRANSACTION_COMPLETE [ 90.406405] binder: send failed reply for transaction 286, target dead 2018/02/04 21:33:38 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0x368, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000399000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000777000-0x4c)=[], 0x0, 0x0, &(0x7f000078a000)}) r2 = syz_open_dev$dspn(&(0x7f0000cf4000-0xa)='/dev/dsp#\x00', 0x2, 0x80000) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000210000)={0x0, 0x5}, &(0x7f0000dae000)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000adf000)={r3, 0x57, 0x301ffbf6, 0x100, 0x3, 0x9}, 0x14) 2018/02/04 21:33:38 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000a57000-0x4)=0x0) r2 = getpgrp(0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000724000-0xf)='/dev/sequencer\x00', 0x400081, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000fc5000)={r3, r0, 0x5}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000fe6000)=""/20) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r4}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) ioctl$GIO_UNISCRNMAP(r3, 0x4b69, &(0x7f0000bda000)=""/12) 2018/02/04 21:33:38 executing program 4: mmap(&(0x7f0000000000/0xd15000)=nil, 0xd15000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x6, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f000021d000-0x4)='/dev/snd/pcmC#D#p\x00', 0x3, 0x2000) mmap(&(0x7f0000d15000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000d15000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000d15000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000d15000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvmsg$kcm(r1, &(0x7f0000d16000-0x1c)={&(0x7f0000d16000-0xc)=@nl=@kern, 0xc, &(0x7f000071e000)=[{&(0x7f0000d15000+0x8b2)=""/28, 0x1c}, {&(0x7f000056b000-0x1000)=""/4096, 0x1000}, {&(0x7f0000d16000-0xb9)=""/185, 0xb9}, {&(0x7f00004ab000)=""/114, 0x72}], 0x4, &(0x7f0000895000-0x1000)=""/4096, 0x1000, 0x1f}, 0x2120) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000d12000-0x80)=[{{0x0, 0x0, &(0x7f0000d11000)=[]}}, {{&(0x7f000079c000)=@vsock={0x0, 0x0, 0x0, @host}, 0x10, &(0x7f0000d12000-0x8)=[], 0x0, &(0x7f0000d11000)=""/120, 0x78}}], 0x2, 0x0, &(0x7f0000659000-0x8)={0x0, 0x1c9c380}) 2018/02/04 21:33:38 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000332000)='./file0\x00', 0x24) r1 = open(&(0x7f000011a000)='./file0\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x40049409, r0) 2018/02/04 21:33:38 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000635000-0x12)='/dev/snd/pcmC#D#p\x00', 0x1f, 0x440081) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f000075c000+0xa0c)={0x0, 0x0, 0x7, &(0x7f00001fe000-0x8)}) madvise(&(0x7f0000e4e000/0x4000)=nil, 0x4000, 0x11) 2018/02/04 21:33:38 executing program 0: mmap(&(0x7f0000000000/0xf29000)=nil, 0xf29000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x2000000084) setsockopt$inet_int(r0, 0x0, 0x16, &(0x7f0000c0b000)=0x200, 0x4) sendto$inet(r0, &(0x7f0000f29000-0x68), 0x0, 0x0, &(0x7f0000e85000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0x0, 0xaa}}, 0x10) mmap(&(0x7f0000f29000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000f2a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000f2a000)='/dev/sequencer\x00', 0x100, 0x0) mmap(&(0x7f0000f2a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000f2a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) stat(&(0x7f0000f2b000-0x8)='./file0\x00', &(0x7f0000f2b000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETOWNER(r1, 0x400454cc, &(0x7f0000d6c000-0x4)=r2) prctl$seccomp(0x16, 0x4adc9291b791f7cb, &(0x7f00002b1000-0x8)={0xa, &(0x7f0000f29000)=[{0x8, 0x40, 0x4, 0x7ff}, {0x1c90, 0x6, 0x2ba7, 0x4}, {0x7, 0x200, 0xbe62, 0x9cf}, {0x7, 0x3, 0x3f, 0x100000000}, {0x5e, 0x10000, 0x328}, {0xfff, 0x56, 0x8000, 0x5}, {0x2, 0xc12d, 0x7fffffff, 0x7fffffff}, {0x6, 0x3ff, 0x9, 0x2}, {0x5, 0x2000000, 0xa, 0x4}, {0x8, 0x4b9, 0x5, 0x8}]}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000a9d000)={0x0, @multicast2, @empty}, &(0x7f00001b5000-0x4)=0xc) mmap(&(0x7f0000f2a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000f2a000)={r3, @dev={0xac, 0x14, 0x0, 0xf}, @multicast2=0xe0000002}, 0xc) 2018/02/04 21:33:38 executing program 3: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000003000)='./file0\x00', &(0x7f0000003000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x3, r0, 0x8) r1 = socket(0xa, 0x80001, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = request_key(&(0x7f0000005000-0x5)='ceph\x00', &(0x7f0000004000-0x5)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000005000-0x2)=']\x00', 0xfffffffffffffffd) keyctl$assume_authority(0x10, r2) getsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000000a, &(0x7f0000003000), &(0x7f0000001000-0x4)=0xfffffffffffffec8) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$loop(&(0x7f0000006000-0xb)='/dev/loop#\x00', 0x3, 0x202000) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000005000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r4, 0x404c534a, &(0x7f0000001000-0x4c)={0x5, 0x4}) ioctl$LOOP_SET_FD(r3, 0x4c00, r1) 2018/02/04 21:33:38 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$selinux_create(0xffffffffffffff9c, &(0x7f000068f000-0x10)='/selinux/create\x00', 0x2, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000005000-0x38)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000006000)="240000005a00030207fffd946fa283bc0aeee6d87986c497271d8568b51ba3a2d188737e", 0x24}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00005f8000), &(0x7f00007b6000-0x4)=0x4) 2018/02/04 21:33:38 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f000026b000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000db3000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f0000614000)) 2018/02/04 21:33:38 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f000039c000)=0x400000000000001, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f00001b8000-0x4)=0xffffffffffffffff, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00003a4000)=@common='ip_vti0\x00', 0x10) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000dd9000)='/dev/sequencer2\x00', 0x10000, 0x0) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) sendto$inet(r0, &(0x7f0000a92000), 0x0, 0x800000020000000, &(0x7f0000303000)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000966000-0x14)={0x0, 0x800000000000852b, 0xffff}, 0x14) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000f2000-0x10)='/selinux/policy\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000797000-0x8)={0x1, [0x0]}, &(0x7f0000b30000-0x4)=0x8) writev(r0, &(0x7f0000794000-0x60)=[{&(0x7f0000dfa000)="06", 0x1}], 0x1) [ 90.483548] binder: 12196:12208 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 90.505652] binder: BINDER_SET_CONTEXT_MGR already set [ 90.525349] binder: 12195:12212 ioctl 40046207 0 returned -16 2018/02/04 21:33:38 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000773000-0x78)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x60}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x7f2000)=nil, 0x7f2000, 0x3, 0x31, 0xffffffffffffffff, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x1}], 0x1, 0x0) mbind(&(0x7f00003b5000/0x800000)=nil, 0x800000, 0x0, &(0x7f0000002000-0x8), 0x1, 0x2) 2018/02/04 21:33:38 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000802000)='/dev/cuse\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffff9c, 0x84, 0x14, &(0x7f0000656000-0x8)=@assoc_value={0x0}, &(0x7f0000a91000)=0x8) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000ca7000-0x8c)={r2, @in6={{0xa, 0x1, 0x9, @loopback={0x0, 0x1}, 0x2}}}, 0x8c) bind$alg(r0, &(0x7f0000e00000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58) geteuid() getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f000035b000)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000e25000-0x4)=0x18) ioctl$LOOP_CLR_FD(r1, 0x4c01) rename(&(0x7f0000e92000-0x8)='./file0\x00', &(0x7f0000725000)='./file0\x00') pipe(&(0x7f0000860000)={0x0}) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000e5f000-0x8)={r3, 0x5}, &(0x7f0000be8000-0x4)=0x8) r5 = accept4$alg(r0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0086426, &(0x7f00004ab000)={0x2, &(0x7f00005cb000-0x10)=[{}, {}]}) recvmmsg(r5, &(0x7f0000e36000-0x80)=[], 0x800000000000169, 0x0, &(0x7f0000c49000)) [ 90.535523] binder_alloc: 12195: binder_alloc_buf, no vma [ 90.541210] binder: 12195:12226 transaction failed 29189/-3, size 24-8 line 2957 [ 90.550188] binder: 12196:12223 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 90.559979] binder: 12195:12199 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:38 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000001000-0x12)='/dev/snd/pcmC#D#p\x00', 0x2, 0x101002) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0e05403, &(0x7f0000fe1000-0xe0)={{0x3, 0x0, 0x7, 0x3, 0xfff}, 0x9, 0xfffffffffffffffa, 'id0\x00', 'timer0\x00', 0x0, 0x170, 0x8a, 0x1, 0x2}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$KVM_SET_MP_STATE(r0, 0x4004ae99, &(0x7f0000bff000)=0x1) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000d3000-0x8)=@assoc_value={0x0, 0x80800}, 0x8) 2018/02/04 21:33:38 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$audion(&(0x7f0000300000-0xc)='/dev/audio#\x00', 0xc59, 0x20000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000ab6000-0x4)=0x5) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsync(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 90.604584] binder: undelivered TRANSACTION_ERROR: 29189 [ 90.611737] binder: release 12195:12199 transaction 291 out, still active [ 90.618760] binder: undelivered TRANSACTION_COMPLETE [ 90.623974] binder: send failed reply for transaction 291, target dead [ 90.624681] binder: 12239:12241 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 90.650934] sctp: [Deprecated]: syz-executor3 (pid 12244) Use of struct sctp_assoc_value in delayed_ack socket option. [ 90.650934] Use struct sctp_sack_info instead 2018/02/04 21:33:38 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00006e6000-0xf)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000c98000-0x8)) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000ad6000-0xe8)={0x5, 0x0, [{0x10f002, 0x39, &(0x7f00000dd000)=""/57}, {0x2000, 0x18, &(0x7f0000eca000-0x18)=""/24}, {0x0, 0x81, &(0x7f0000cc1000)=""/129}, {0xf004, 0x28, &(0x7f00002bc000-0x28)=""/40}, {0xf000, 0x1000, &(0x7f0000db4000)=""/4096}]}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00003fb000-0x68)={0x0, 0x0, []}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x300000) 2018/02/04 21:33:38 executing program 2: mmap(&(0x7f0000000000/0xb60000)=nil, 0xb60000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f000019f000-0x8)='keyring\x00', &(0x7f000001d000)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$search(0xa, r0, &(0x7f0000028000-0x8)='keyring\x00', &(0x7f000003e000-0x5)={0x73, 0x79, 0x7a, 0x0}, r0) keyctl$assume_authority(0x10, r0) 2018/02/04 21:33:38 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f00005c8000)='/selinux/status\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000cda000)={0xa, 0x2, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0xb}, 0x1c) connect$inet6(r0, &(0x7f00005bf000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000695000-0x2)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "06f526", 0x8, 0x11, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, {[], @udp={0xffffffffffffffff, 0x2, 0x8}}}}}}, &(0x7f0000775000)={0x0, 0x1, [0x0]}) 2018/02/04 21:33:38 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0xff5d, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:38 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) close(r1) r2 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) socket$inet6(0xa, 0x6, 0xf1) syz_open_dev$binder(&(0x7f0000fac000-0xd)='/dev/binder#\x00', 0x0, 0x802) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000899000-0x10)={0x4, 0x7, 0x2, 0x2}, 0xfe50) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mq_unlink(&(0x7f0000f8c000-0xd)='/dev/binder#\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x4, 0x0, &(0x7f000000b000-0x10)=[@enter_looper={0x630c}], 0x4, 0x0, &(0x7f0000004000)="2716c84b"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005000-0x14)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) socket$inet(0x2, 0x1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00004ac000)='/dev/snd/midiC#D#\x00', 0x40, 0x102) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r3, 0x29, 0xd3, &(0x7f0000d25000-0x5c)={{0xa, 0x2, 0x3, @mcast2={0xff, 0x2, [], 0x1}, 0x7}, {0xa, 0x1, 0x6, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x2}, 0x4, [0xfffffffffffffff7, 0xfffffffffffffffb, 0x200, 0x40, 0x1, 0x5, 0x9, 0x1]}, 0x5c) syz_open_dev$tun(&(0x7f0000a9e000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000a9d000)=0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00006e6000-0x8)={0x0, 0x67}, &(0x7f0000c4f000-0x4)=0x8) 2018/02/04 21:33:38 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) poll(&(0x7f0000ffd000-0x8)=[], 0x1ffffffffffffd59, 0xd883) r1 = socket$inet_udp(0x2, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000f91000-0xc)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000d4b000-0x4)=0x0) ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f000018d000)) setpriority(0x3, r2, 0x400) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000e8c000)={0x80000000005}) removexattr(&(0x7f0000a75000)='./file0\x00', &(0x7f000062c000)=@known='system.advise\x00') 2018/02/04 21:33:38 executing program 7: mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000-0xa)='/dev/ptmx\x00', 0x0, 0x0) getresuid(&(0x7f0000002000-0x4), &(0x7f0000001000-0x4), &(0x7f0000002000)) r1 = dup(r0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write$vnet(r1, &(0x7f0000002000-0x68)={0x1, {&(0x7f0000004000-0x44)=""/68, 0x44, &(0x7f0000009000-0xf3)=""/243, 0x1, 0xc9403d7c02eb0882}}, 0x68) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000003000-0x4)) ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f0000001000-0xab)="df7f02f6ea0164cd16e514891e42189bb2b990e9ad8ffbefcd6557919d16d51ef9671ff107ef2f1f7e78d0a335c27dab1269f8676e45cb170096edee0ba620bfa93844a2d6fa942fe7f0cd807587ebcb531f532e2f9209e1061281ceef1a331d282278ee6eb17d14c4bf3a1bc7bab7caf66e6c989175a0d3c12a44fdc3f6c1b702d20afd1b117d63aba728534340480a66b02d5e3671831d0df2fa236c152b0906c574d561661d71b467a1") openat$ptmx(0xffffffffffffff9c, &(0x7f0000006000-0xa)='/dev/ptmx\x00', 0x501001, 0x0) 2018/02/04 21:33:38 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe2(&(0x7f000015b000)={0x0, 0x0}, 0x84800) r4 = syz_open_dev$vcsa(&(0x7f00004d3000-0xb)='/dev/vcsa#\x00', 0x1, 0x103202) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f0000575000-0x70)={[{0x7fffffff, 0x35793b24, 0x200, 0xee7b, 0xe6a8, 0x7ff, 0x80000000, 0x400, 0x6, 0x100, 0xffffffffffff0001, 0x5, 0x3}, {0x3, 0x6, 0x9, 0x6, 0x0, 0x3ff, 0x3, 0xdc5d, 0xfffffffffffffffa, 0x7, 0x7, 0xb1c, 0x2}, {0x6, 0x7, 0x3dd3d72b, 0x4, 0x100, 0x74, 0xfffffffffffff40e, 0x0, 0x100, 0x3, 0x8, 0x2, 0x7fff}], 0xfffffffffffffffc}) ioctl$LOOP_SET_BLOCK_SIZE(r2, 0x4c09, 0xb55) ioctl$TCGETA(r3, 0x5405, &(0x7f0000528000)) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000157000-0x8)={0x0, 0x6}, &(0x7f00009c0000)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000a41000)={0x3ff, 0x9, 0x206, 0x2, 0x7ff, 0x5, 0x9, 0x7, r5}, 0x20) ioctl$KVM_REINJECT_CONTROL(r3, 0xae71, &(0x7f0000ca1000-0x20)={0x5}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:38 executing program 2: mmap(&(0x7f0000000000/0x1f000)=nil, 0x1f000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0xfffffbffffffffff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002000)={0xffffffffffffffff, 0x0, 0x163, 0x27, &(0x7f0000015000), &(0x7f0000008000-0xec)=""/236, 0x0, 0x9}, 0xace5f23da6bc9f80) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x1, 0x32, 0xffffffffffffffff, 0x0) setsockopt(r0, 0x111, 0x2, &(0x7f00008af000)="1f5bffe1", 0x4) 2018/02/04 21:33:38 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000dc7000-0x2c)={@random="a16e8aa67acf", @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [{[], {0x8100, 0x70, 0x9, 0x7}}], {@ipv4={0x800, {{0x5, 0x4, 0x7, 0x0, 0x28, 0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, @rand_addr, @empty, {[]}}, @gre={{0x0, 0x0, 0x1, 0x0, 0x0, 0x7f, 0x0, 0x1, 0x880b, 0x0, 0x0, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], "9fe8fb74"}}}}}}, &(0x7f000038f000-0xc)={0x0, 0x1, [0x0]}) [ 91.124766] binder: 12256:12264 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 91.132596] binder: 12256:12264 unknown command 0 [ 91.136626] binder_alloc: binder_alloc_mmap_handler: 12260 20000000-20002000 already mapped failed -16 [ 91.144406] binder: 12256:12264 ioctl c0306201 206b0000 returned -22 [ 91.156609] binder: BINDER_SET_CONTEXT_MGR already set [ 91.164796] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/04 21:33:38 executing program 5: mmap(&(0x7f0000000000/0x2f000)=nil, 0x2f000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000006000-0x10)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f000002f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvfrom$unix(r1, &(0x7f000000c000)=""/179, 0xb3, 0x2100, &(0x7f000002f000)=@file={0x0, './file0\x00'}, 0xa) getdents64(r1, &(0x7f000002b000)=""/188, 0xbc) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x3, 0x7, 0x9000}, 0x4) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000024000)={0x10}, 0xc, &(0x7f0000024000-0x10)={&(0x7f0000011000-0x13c)={0x20, 0x23, 0xaff, 0xffffffffffffffff, 0xffffffffffffffff, {0x4}, [@nested={0xc, 0x1, [@typed={0x8, 0x1, @binary}]}]}, 0x20}, 0x1}, 0x0) 2018/02/04 21:33:38 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000673000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv6={0x86dd, {0x0, 0x6, "010060", 0x14, 0x6, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, {[], @tcp={{0xffffffffffffffff, 0xffffffffffffffff, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, {[]}}}}}}}}, 0x0) r0 = open(&(0x7f0000e79000-0x8)='./file0\x00', 0x40c000, 0x10) getsockname$netrom(r0, &(0x7f000030e000)=@ax25, &(0x7f0000f69000-0x4)=0x10) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000841000-0x8)=&(0x7f000023a000)) ioctl$TCSETA(r0, 0x5406, &(0x7f0000642000-0x14)={0xff, 0xc3b, 0xfffffffffffffff8, 0xfffffffffffffffe, 0x3a8, 0x8, 0x8, 0x1, 0x10000000, 0x25}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00006ca000)='/dev/sequencer2\x00', 0xcab18e0f884a9d3c, 0x0) ioctl$KIOCSOUND(r1, 0x4b2f, 0x7) 2018/02/04 21:33:38 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00003c5000-0xf)='/dev/vhost-net\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fb0000-0x9)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) socketpair$inet(0x2, 0x3, 0x0, &(0x7f000041f000-0x8)={0x0, 0x0}) ioctl$EVIOCGNAME(r3, 0x80404506, &(0x7f0000315000-0x12)=""/150) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f000065f000)={0x1, 0x0, [{0x200004b564d04, 0x0, 0x583}]}) r5 = getgid() setfsgid(r5) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f000012e000)={0x0, 0xd8, "ef2434fa250c8f12ddde1a2a923b3e4b9bf95f244355b80072745960e4fb243a4e44d730648d23313a422e6601ae2746de5ed35e60e1742d58b795116286591b35e1d31d260dab3db18e691079969a635672bde259efb2c668a6de21700a5462b3cc1cac8e44d76cd0d68a8ce6edb66b2f743ab2c2f8027f737af4427c132b7c28210f1794d22db31bc2ca52c79ca4a5e3696748109440d3d255394d2e3b6cf2072e99ae354825388fecd10fa1a9ecfed1f57ea485641a0041c39840e3b74c2c56efb3d4f32c0a59185da8dc0db6a92bee4f0388839a29d5"}, &(0x7f0000bce000)=0xe0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f000040b000)={r6, 0x6}, &(0x7f0000c03000-0x4)=0x6) [ 91.176371] binder: 12260:12262 ioctl 40046207 0 returned -16 [ 91.187139] binder: 12258:12276 ioctl 40046207 0 returned -16 [ 91.196934] binder: 12286 RLIMIT_NICE not set 2018/02/04 21:33:38 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x80002) ioctl$TIOCSBRK(r0, 0x40044591) r1 = socket(0xa, 0x7, 0x6) setsockopt$inet6_tcp_buf(r1, 0x6, 0x1a, &(0x7f0000d17000-0x31)="10792bcb547858aa6aff0cd819d1e62fd268e7bf851471a8c2bb00087b6ffd9db49b6e150e6200921d40b86c45bcb6bacf", 0x31) write(r0, &(0x7f0000c29000), 0x0) 2018/02/04 21:33:38 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) r1 = syz_open_dev$dmmidi(&(0x7f0000e0d000)='/dev/dmmidi#\x00', 0x7d0d, 0x28002) sendmsg$rds(r1, &(0x7f00000ce000)={&(0x7f0000b21000)={0x2, 0x1, @broadcast=0xffffffff}, 0x10, &(0x7f0000a3e000-0x50)=[{&(0x7f0000ea6000-0xef)=""/239, 0xef}, {&(0x7f0000c0c000)=""/190, 0xbe}, {&(0x7f0000189000)=""/104, 0x68}, {&(0x7f00008d9000)=""/193, 0xc1}, {&(0x7f0000443000)=""/118, 0x76}, {&(0x7f0000104000)=""/4096, 0x1000}, {&(0x7f0000818000-0xfd)=""/253, 0xfd}, {&(0x7f0000c32000-0x8f)=""/143, 0x8f}, {&(0x7f0000a4c000-0xac)=""/172, 0xac}, {&(0x7f0000064000)=""/237, 0xed}], 0xa, &(0x7f0000d72000)=[@mask_fadd={0x58, 0x114, 0x8, {{0x9, 0x9}, &(0x7f0000db7000)=0x80000000, &(0x7f0000fa3000)=0x9, 0xc1a, 0x200, 0x1, 0x1, 0x4, 0x8}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000cb5000-0xd0)=""/208, 0xd0}, &(0x7f000033c000-0x1), 0x2b}}, @cswp={0x58, 0x114, 0x7, {{0x4, 0x5}, &(0x7f0000876000-0x8)=0x1, &(0x7f00009a5000)=0x7, 0x9, 0xffffffff, 0x1, 0x0, 0x8, 0x30864f65}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000667000-0x4b)=""/75, 0x4b}, &(0x7f000057b000), 0x2}}, @rdma_args={0x48, 0x114, 0x1, {{0xa5c1, 0xfffffffffffff999}, {&(0x7f0000a00000)=""/82, 0x52}, &(0x7f00001f7000)=[{&(0x7f0000734000)}, {&(0x7f0000cb5000)=""/92, 0x5c}, {&(0x7f0000479000)=""/4096, 0x1000}, {&(0x7f0000745000-0x8e)=""/142, 0x8e}, {&(0x7f00004f9000)}], 0x5, 0x0, 0x2}}], 0x158, 0x40004}, 0x4000) 2018/02/04 21:33:38 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000bfe000)={0x0, 0x2386}, &(0x7f0000047000)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00005e1000)={r1, 0xf6, "0039b7d51f48edfff810880f92244235fcd595785ec68695d84903c24384a641814ec0b9707d4b0a9c369ef965b7dafeff300a039660acaa24850e7f5eab197d12f27372e83fb0345439e281e76f906f157d576602ad88f1e78887b15bc4dbb85f55ee33689b8bb1b22407c0e2936bda06baca3a12ad449a01d7bdfb58c6c860475b96284572260b04d70d8e7becad19f03a87b8f5fb806ce983ad998cf444e796e2235ff132ea38a5c69b7090ba45c9ca9c19acd2d1dbca7ea12e33e3a106800ac31da46b3f34c63346da9058b6d32e7b0c370936f9cdb0586dfb00a9eac52b95d6a3d3a533c23d001a3e37aaa85539ca3797d7557f"}, &(0x7f0000e0a000)=0xfe) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r0, 0x800443d3, &(0x7f00003d2000-0x14)={{0x7ff, 0x9a, 0x1, 0x10001, 0x7, 0x4}, 0x8, 0x1, 0x80}) openat$selinux_context(0xffffffffffffff9c, &(0x7f00000f0000-0x11)='/selinux/context\x00', 0x2, 0x0) r2 = syz_open_dev$mice(&(0x7f0000a86000)='/dev/input/mice\x00', 0x0, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000058000-0x12)='/dev/input/event#\x00', 0xafd, 0x8000040000001) write$evdev(r3, &(0x7f0000302000)=[{{}, 0x8000, 0x1, 0x98}, {{}, 0x10001, 0x219, 0x10001}, {{0x0, 0x2710}, 0x200, 0x1, 0x4}], 0x30) flistxattr(r2, &(0x7f0000e24000)=""/179, 0xb3) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000dcc000-0x1)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 91.218578] binder_alloc: 12260: binder_alloc_buf, no vma [ 91.224280] binder: 12258:12266 transaction failed 29189/-3, size 0-0 line 2957 [ 91.241697] binder_alloc: 12260: binder_alloc_buf, no vma [ 91.247332] binder: 12260:12262 transaction failed 29189/-3, size 24-8 line 2957 [ 91.257619] binder: 12260:12271 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 91.259808] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/04 21:33:39 executing program 5: socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000018000)={&(0x7f00002f3000-0xc)={0x10}, 0xc, &(0x7f000000e000)={&(0x7f0000618000-0x133c)={0x1c, 0x1d, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, {0x1}, [@nested={0x8, 0x200000000000003, [@generic="e3"]}]}, 0x1c}, 0x1}, 0x0) 2018/02/04 21:33:39 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x800000000005, 0x84) r1 = socket(0x11, 0x100000802, 0x300) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000df000), 0x4) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00002f5000-0x4)={0x0, 0x0, 0xfffffffffffffffd}, 0x4) getpeername(r1, &(0x7f000077c000)=@un=@abs, &(0x7f00002da000)=0x8) connect$inet6(r0, &(0x7f000062b000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f000094b000-0xf0)=[{{&(0x7f0000105000-0x14)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x14, &(0x7f00007c4000-0x90)=[], 0x0, &(0x7f0000b8c000)=""/202, 0xca}}], 0x1, 0x0, &(0x7f00009fc000-0x10)) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000c9d000)='/dev/autofs\x00', 0x44200, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000aff000-0x4)=0x1) 2018/02/04 21:33:39 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) setns(r0, 0x40000000) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) [ 91.289378] binder: 12258:12276 ioctl 40046207 0 returned -16 [ 91.307305] binder: undelivered TRANSACTION_ERROR: 29189 [ 91.312947] binder: 12300:12305 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 91.332691] binder: release 12260:12262 transaction 296 out, still active 2018/02/04 21:33:39 executing program 2: socket$nfc_raw(0x27, 0x3, 0x0) mmap(&(0x7f0000000000/0xd0f000)=nil, 0xd0f000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f0000d02000-0x5)='user\x00', &(0x7f00009f1000)={0x73, 0x79, 0x7a}, &(0x7f0000aa5000-0x6e)='n', 0x1, 0xfffffffffffffffc) keyctl$search(0xa, r0, &(0x7f0000d0c000)='user\x003', &(0x7f00008ea000)={0x73, 0x79, 0x7a}, 0x0) [ 91.339830] binder: undelivered TRANSACTION_COMPLETE [ 91.345054] binder: send failed reply for transaction 296, target dead [ 91.375766] binder: 12258:12286 transaction failed 29189/-22, size 0-0 line 2842 [ 91.383804] binder: 12266 RLIMIT_NICE not set 2018/02/04 21:33:39 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f000000b000-0x4)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00006a3000)='/dev/audio\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00006a7000-0x12)='/dev/snd/pcmC#D#c\x00', 0x0, 0x40400) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000177000)) ppoll(&(0x7f000026c000)=[{r1}], 0x1, &(0x7f000097d000)={0x77359400}, &(0x7f000016a000), 0x8) openat$audio(0xffffffffffffff9c, &(0x7f0000255000)='/dev/audio\x00', 0x800, 0x0) read(r2, &(0x7f0000cb5000)=""/72, 0x48) 2018/02/04 21:33:39 executing program 5: mmap(&(0x7f0000000000/0x10000)=nil, 0x10000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0xfffffffffffffffe, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x894a, &(0x7f000000b000-0x28)={@common='ip_vti0\x00'}) 2018/02/04 21:33:39 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000ab9000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000fb8000)=""/246) ioctl$EVIOCGREP(r0, 0x40047451, &(0x7f0000b3c000)=""/174) close(r0) 2018/02/04 21:33:39 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000401000-0xb)='/dev/audio\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000d00000)={0x0, 0x5f, "3a8bf874b2e8bf771f45600ea1cb2f6e4587376e3e915ee6fa512d29d2156671a71ed1f363837cf3f74cad4df738f3e0c54280334488364a4918302ff8de5e512e98d7d65b52f1d8c6b4e2e21e19ff4fe48a1de4b8706260d6da47b9d78172"}, &(0x7f00009ee000)=0x67) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000302000-0x8c)={r3, @in={{0x2, 0x3, @empty}}}, 0x8c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:39 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) fallocate(r0, 0x1, 0x9, 0x5) r1 = syz_open_dev$sndmidi(&(0x7f0000cb1000-0x12)='/dev/snd/midiC#D#\x00', 0x2, 0x2000) getsockname$netlink(r1, &(0x7f0000a93000-0xc), &(0x7f000024b000-0x4)=0xc) 2018/02/04 21:33:39 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000464000)='/selinux/enforce\x00', 0x200001, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000d59000)={0x0, 0x9, 0xa, 0x10061636}, &(0x7f0000bdc000-0x4)=0x10) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setlease(r2, 0x400, 0x3) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f000033a000)=@assoc_value={r1, 0x20}, 0x8) bind$inet6(r0, &(0x7f0000dd7000-0x1c)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x5}, 0x1c) openat$ashmem(0xffffffffffffff9c, &(0x7f000022b000-0xc)='/dev/ashmem\x00', 0x100, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0086426, &(0x7f00001f8000)={0x5, &(0x7f0000e92000)=[{}, {}, {}, {}, {0x0}]}) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f0000245000)=""/21, &(0x7f0000c55000-0x4)=0x15) ioctl$DRM_IOCTL_LOCK(r0, 0x4008642a, &(0x7f00008f1000)={r4, 0x4}) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000ee7000)='/dev/rfkill\x00', 0x200000, 0x0) sysinfo(&(0x7f00004f5000)=""/218) setsockopt$inet6_int(r3, 0x29, 0xc8, &(0x7f00008d6000), 0x4) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000301000-0xc)={0x0, 0x0, 0x0, 0x6}, 0xa84cb7351995539) setsockopt$inet6_int(r3, 0x29, 0xc9, &(0x7f0000c3a000), 0x4) ioctl$VHOST_SET_FEATURES(r5, 0x4008af00, &(0x7f00009eb000)=0xc000000) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000303000-0x18)={r1, 0x7, 0x10, 0x3}, &(0x7f0000f84000)=0x18) [ 91.429668] binder: 12300:12305 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 91.463006] binder: send failed reply for transaction 304 to 12316:12322 [ 91.502326] binder: 12343:12345 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 91.511884] binder: undelivered TRANSACTION_COMPLETE [ 91.517098] binder: undelivered TRANSACTION_ERROR: 29189 [ 91.527488] binder_alloc: binder_alloc_mmap_handler: 12344 20000000-20002000 already mapped failed -16 [ 91.539757] binder: undelivered TRANSACTION_ERROR: 29189 [ 91.543233] binder: BINDER_SET_CONTEXT_MGR already set [ 91.551139] binder: undelivered TRANSACTION_ERROR: 29189 [ 91.554282] binder: 12344:12346 ioctl 40046207 0 returned -16 [ 91.558867] binder: 12343:12355 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 91.570440] binder_alloc: 12344: binder_alloc_buf, no vma [ 91.576103] binder: 12344:12353 transaction failed 29189/-3, size 24-8 line 2957 [ 91.590955] binder: 12344:12346 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:39 executing program 0: mmap(&(0x7f0000011000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000001000-0x20), &(0x7f0000012000-0x3)=0x20) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000001000-0x8)=0x4) 2018/02/04 21:33:39 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000c2f000-0x4)=',\\', 0x0) ftruncate(r0, 0xffff) write(r0, &(0x7f0000cbd000)='v', 0x1) syz_extract_tcp_res(&(0x7f0000f1b000-0x8), 0x800, 0x45) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) mq_open(&(0x7f0000001000)='#*\x00', 0x0, 0x0, &(0x7f0000736000-0x20)) 2018/02/04 21:33:39 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dspn(&(0x7f000039f000)='/dev/dsp#\x00', 0x1ff, 0x2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x80045400, &(0x7f000006b000-0x4)) r2 = memfd_create(&(0x7f0000ddd000-0x6)='^eth0\x00', 0x3) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f00007c1000)={0x5, {0x2, 0x3, @remote={0xac, 0x14, 0x0, 0xbb}}, {0x2, 0x2, @rand_addr=0xfb}, {0x2, 0x0, @multicast1=0xe0000001}, 0x0, 0x0, 0x800, 0x1, 0x7, &(0x7f00007c9000)=@syzn={0x73, 0x79, 0x7a, 0x0}, 0xffffffff7fffffff, 0xffffffff7fffffff, 0x10000}) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000b1b000-0x8)) remap_file_pages(&(0x7f0000c84000/0x3000)=nil, 0x3000, 0x2, 0x20, 0xfbc931204d84f3f7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x115, 0x0, &(0x7f00003c0000)="a268b48e3a3118ee5e6e07b8d6b02a499d0142c41598d10b8d73bbddf11120af6bf12aad364de41a4467af2ac3db98a31ad1b7bac9ff5ec8848adb334c7b1d6bfd0cfe779c49e0d7200876617da9465576c845fd26eb48cace82a00e8b2b90c8dba2238cd1d5c583480fd95cdd540d5504f63ce97a6b37626dd412942cb32e0d9bc19dd41509e2c8da1364f5c45c80f64b0e0859f38e5a3fe0cfb97a602d87283ac7826340df626fefab8c59cb525fe77c395c60f2356b77e996c50581c9f4a0d612b0f9d15f6da541fc83fa65156e95c6df90773411954f22d93eaa6ec5104b1b3b40e54ed15d1326ca1e1af034e094d69fddb702fb2d0000000000007fff1fe562c580798afc5fb631a8cedbc10c39f3de7ae026"}) getsockname$unix(r2, &(0x7f0000e90000)=@file={0x0, ""/4096}, &(0x7f00000a8000+0x26f)=0x1002) 2018/02/04 21:33:39 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) write(r2, &(0x7f000006e000), 0xfffffdd8) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000389000-0xc)={0x2, r1, 0x1}) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000a8e000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000e44000)) ioctl$sock_ipx_SIOCAIPXITFCRT(r3, 0x89e0, &(0x7f00001a9000)=0x8) socket$alg(0x26, 0x5, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x1000000000013) 2018/02/04 21:33:39 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000db9000)='/dev/usbmon#\x00', 0x0, 0x8400) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) sync() ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) fcntl$getownex(r1, 0x10, &(0x7f00002d5000)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f000025e000-0x10c)={{0x6, 0x3, 0x1017ed2979, 0x10001, "30c3b623af37412755e7392ce8ee4702018fefd4a91c86d83bf410765bd4f440a7231aff77158e74885e30c6", 0x8001}, 0x0, 0x0, 0x100000001, r3, 0x80000000, 0xffff, "0553d0c2c2523713e6e39e1c91074ac889f657e8d3a1913774bc86e7f5c83128913d1f32a3c3f75d035f5bb8922963e6aacbbc8c07808289512012e10c812bc7", &(0x7f0000fa7000-0x2)='@\x00', 0x2, [], [0x7c8, 0x4, 0x80000001, 0x5]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:39 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000f8b000)={{{@in6=@dev={0xfe, 0x80}, @in6=@mcast2={0xff, 0x2, [], 0x1}}, {}, {}, 0x0, 0xffffffffffffffff, 0x1}, {{@in=@dev={0xac, 0x14}}, 0x0, @in=@empty}}, 0xe8) perf_event_open(&(0x7f0000c1a000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f000088c000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x9}, 0x1c) connect$inet6(r0, &(0x7f0000187000-0x1c)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x200}, 0x1c) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f000071f000-0x15)='/proc/self/net/pfkey\x00', 0x82000, 0x0) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f00007cd000-0x8)=&(0x7f0000c4b000-0x1)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000d13000-0x8c)={0x3f, 0x7f, 0x1, 'queue1\x00', 0x3ff}) 2018/02/04 21:33:39 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f00003fe000-0x5)='user\x00', &(0x7f0000a03000-0x5)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000b0000-0x69)="4dce4a59b18cc70ac63fb330e17032889f6dcff3c370ec8406fa4c592a8fd2148bea69e50ff50463df1f54d4a03fcc9473882c5fb535c74d3febc6e091acd640a186f1e0097c3edd9158faaff9a2f9adac17686fd285dac1ba182e0461784f888548c8fe0a6823001237c9adaaeb959586aa60dc067215165ec6a8a6c4401235738b786acd67927fc69b390c315c0a0771dac5b717f1a70f7f9109ca3daafbd27213d570abcf7b59005f72b1696c2063e5d36602f06fd62138289d4f6b4c9a468cd9dd", 0xc3, 0x0) keyctl$assume_authority(0x10, r0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 2018/02/04 21:33:39 executing program 2: mmap(&(0x7f0000000000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000007000-0xa)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800000c0045002, &(0x7f0000005000)) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a45321, &(0x7f0000004000-0xa8)={{0x1, 0x2}, 'port1\x00', 0x80, 0x800, 0x1f, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, 0x2}) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000002000-0x4)={0xfffffffffffffffa}, 0x4) writev(r0, &(0x7f0000001000)=[{&(0x7f000000a000-0x1000)="c20e23898d7942a315e4de5a6426f3ca3cf7cc3e931b4422ecc38c70b0a3267848286412ea77e2e74916918011e1398d75afeef6b9df76bad7f8848eb40aa0d46fb99efdfd11ceb229d3cdc59b07a9ea9bee42fbc51d4ae3df1531e77a858702c2a352b521f8408bbf7c164d672331b1e7a951cf4cded880f3c48a358b4807310f6259d1f272d165fab04fd17cc2eda4fe9a2ec34a2d409f580f57d04e30ede3f9cf86430d925a5d8b65d4dcf8f81e1c3f34f6161992eb02dfe88dfbfad990bf7fe98db3f0d29bc371840ca281dce94f187d18d2c1b7b5a540991edcf3c112dae7fc9b80483d7672d7909e2b12dda06d58cdbcb162bcdcec255974a3ec3bb053e471be94f47e4880f35c63970246a7f04f0496639dab483b6d1653d016546bf5dfb19da4f41a1c397965639b5b7e864faf6e79b174bcbe56e90fdd2f75dc73629a6f48734de54177b7a86951d3667507f14848521db1fccda23fa24b71e4b308e1a66361aae3fda516220ba3c9e5d9a4d2e64372da966da7fd063e653b75b4be39ebd0c937c6f448412a27ef3abf1ce8fbd6229bb749b42775f9012e0660672b606d4b8615fc1308391abceb29a2871dc66c341d2f87f588f8e373d3d6583656fef32c73ae30c85fec1f6496392de25079f1b2ee79f56b75608a0c824ace448234e96633349e9d37d00bd2cf895c67d0aa528ca8150cbdf75fe475ab94610b88", 0x200}], 0x1) [ 91.608730] binder: undelivered TRANSACTION_ERROR: 29189 [ 91.614329] binder: release 12344:12346 transaction 308 out, still active [ 91.621369] binder: undelivered TRANSACTION_COMPLETE [ 91.626521] binder: send failed reply for transaction 308, target dead 2018/02/04 21:33:39 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000001000-0x18)={0xaa}) r1 = epoll_create1(0x80000) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000002000-0xc)='/dev/rfkill\x00', 0x161c0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000002000-0x4)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair(0x1e, 0x7, 0xff, &(0x7f0000001000)={0x0, 0x0}) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r4, 0x112, 0xa, &(0x7f0000002000-0x4)=0x9, 0x4) getsockopt$inet_tcp_int(r3, 0x6, 0xb, &(0x7f0000001000), &(0x7f0000012000)=0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) dup3(r1, r0, 0x0) 2018/02/04 21:33:39 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x80005, 0x0, &(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_timeval(r0, 0x1, 0x37, &(0x7f000000b000-0x10), &(0x7f0000000000)=0x10) getsockname$inet6(r1, &(0x7f00001ec000)={0x0, 0xffffffffffffffff, 0x0, @loopback}, &(0x7f0000170000)=0x1c) [ 91.675816] binder: 12366:12374 DecRefs 0 refcount change on invalid ref 0 ret -22 2018/02/04 21:33:39 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000bbc000)={0x0, 0x0}) write(r1, &(0x7f0000f80000-0x1000)="479afd828f9ca053383d79e25e096ca7f0a8ed536b50b1fa10b9af2124f88a8e1a1b827c9edd6f3036cddecb4fb03ed977c6206710e77a7b60aa6d577f23b00f9e82639f4b9a0f86739d4fd421f994489f34e44eb60d1d45cce7afb5738ffbe3f8e2bcb62a6f35917be8efb32b4b5660241162e32ce0892318a1fa65a81f02ef29f85b5df436fce9ebdec4603963a06e4e4d3df735c57a61f0a36d657720c33562aff631e482fa3a693fbcd509a09e796d318eaf10a54a242542808da13b2440d102ff5b27d0a62463fea6d2d516a8f5b22089b5a1c0eccab01eba0a4b17d58cb4b6a888142b97d4737c97fa9224b7876e1b8ffe2e7c8ca9cb0ea8c401063dac80cbbe1bc34577dd6ab53df838e5fb59298f83eae35df3ae7d3678a7fc8c93baf40353c111ab3e86bb99ab04de3384edb662ffeff9bd534feaa01c545e5d2da6aa3c76491628669c5ff98a9685888d03a46c625517fff6c202796eec0e3e357823df7561901f69c3298e753bb77c24231bdea8cd56969254fc2904de78c3cc56abaa78e27cb176aadbfacd705c2d52c0b34dd589cf27696dc7fe4491b59768c5aa6c96e07b704b089a36482c87b45d1a7fe70d3299c6a5bad3e9f1872f9709d6b1e26f302829fc4a97583bf103e26fd22c9ecd61d100b1a55dba0ce3784339c287d0a593022250925beb83dac8ca8ab96a8d9d331ceeccd258df3136968537c0c79f6a0e0d946521940a5e7def231c24d01581591cdccc21809ef73d06c4ed4f7f2bc3e0073141decc7906f8cd78c39d7988b936a917e03c7ea56043addc6e83ba8b9324a8b65d57c9774c194f278a3e9f7884f3bba3cccceb05132ecc15a2d49da1eff1f1b8522fff7b5bccf57be526211033e1b14219797dd9af9a34410b3f3e9d5a47aac5c6c822dbf4538fb69c441ccb1188c9f72dd65449514c930d3cf04216ed2124dfaddd0b17d2658b4ae007f98fbb4ced99b517ef49ecbbbc829855fd3c9d37a1cf5820a2c39c1dd285f72de713c59b11b24c14eb92bde41005d298ca88fbc198cee99c83211a454619b28710c4c8db597c834035c950fbfa8cffed6861be82b51729351214b43ad734ffa5f1554e7ab358b98b631497ffb81363ed27cf71a929c3002f202771cd54aeb99f6f09e065a0f3fbf1fd8783510fa30477532110ce6141eb53b8159ff2676463dc9e4a8ac1a0355f2965713b4e1f8cd40a095e9447393381368228fd4c14c76ecb63208bd24fe566d066782357598835da2974d2458cf0c9d41229dd8eceb92fc1a13e8c5404fe14b1693e2f53b0bc5c4781931427b02f948cd0dee0d7d52010e15da46c05201ba1b0567a04e1a4c0c303e76ff14c6b575ddea66585a338e0a5b334a509f3ce3324554aa7a214e09fdba2d760f6424d875c280eb8021a1162c585e6a012cbe9013bb19bc7b3d0dcaede5df4a6a5444ba4841d767ef5d7b057a77fd4769357495bd1fd1e049ce4d1e00bb187608576a3afa251e49f059be228e6908bf43142a9db685de92c0ae9118d704170159de287f18557dc81614c1c9a5d6f05f1552dbd2e144433e94c35789e242b7b085998560656f334c4ee2a713cb1a4208bb7b024055402d5796603110216eef62601920490c4334a6c70f1d01c26ae62e3aa7c5c6d2c477a736c8a6a3c3cea4d3562340a6255dd28b5587f7b3bfafcbf0586d0cb7dfc7f92e40dacec77f5ad824c965ebd734aa12cb146f95c89e6e4141a50a28e85d0dab756ffbae54320e4518eedb4b894fc46303efa31cb7de4f86de9e8bf397a5eb171600596274e53089cd3c236aa97df47c96e2c3e1abdb6d7ecb0f392dd00bc74676239b25a49ada4bb72ae3527a17b74c0bb216f69c90ef2c44cfc9729efc48ee3a28316a0b4c0b11987b5c9109378eb7f04725102c314800538f0f65e0a31bb202d7d5cd81c87c6d0c3730b44e6632758e824236a78441680ca830df00f92ba08cbc3a73ed529d9749135e1732535742a4647bab2caa286f7d78ba2860082c1bacdbe8094d49479d073b10cbd47c1e45d1965d4efce19db34d7f70369698bbb4e6404770c4f45045a534dc0034db47fa88f3022735b4358ce0e1fe6442444b11a4f09a08292641058e65fdd935859e30395e4cd731405c222dde2f2b2cc4565856092abed27c4658b821099efce072e905138dab73830b0ac08d8e2514b4735c1cd4fd0ffddc09e46ddfc5ee93adf62d9ec067293fffce14ac5657c684bf6c51b62d0020f456be653bb8f491f8518d247e6bc9579663aa6522b529fcb4c4413b233d44e00e0200927aa7c3c9ae328a83916052db4809b5c3c641bbc6616e3822bf5ccf5037529cb77064026bd9260765a0e66a6cf2466b5cda6d3dfbddc831fa135305847230c129b95ba13930c575f431b19da1af143996a26a16f3ad28bf4cea94fde7314f994e48e6f4d0ac05dc07f3d8f75b3bef36590120471c6574f89f90e9341248a493a7fcfa1237608578e1d8a41dabca840c7f40362bc4abf9fd45670204e09b0ff52f78412ed5408aa6e1bdddf0de6e824836b1252dc16ec4d9a129efe2452ace5b3fd436796569ced73e708c7ac5ae6c2d4b997808be4ba1497b8d8a7ebb6b3e34d7038791e116491270416949b7ff33ed8cf3b7ac9c47d3789334c7de4e4cc6ed6791462fc36aa930e82df72ee0bb6b80db91a3d593c56578f0b73c95f76622457ceeb99425ee28ba43e4d6536bf1268ee18739d691681204418de25075a90d57f3c836fe37235c803231386331b5ca4114a8c8b191dc5c7788dc078f2f7a2b7145dde31e6559ef9e4dcf2ccb956b72a795f679b5f5c9c7b668c43e4cd4bdd9768f7c5f47897fbcc79d040c8450cc61041120b712723f9ca125bdc0ad5ae5122113aa61020030ca4fdedbc44101d228c332aef877c56e0c3f8d21f55ec5c2cec7ed7b8d25629ca6cf52943c072809605b3c11c29abba9a4d07c3f1a8493ebff71bbb197513e43e9e182c9ca61a00bc75052b532a2ceb57ca178797c281c34359ca5be0d56a97cbacc7db6b27341c147d1bdf52f7b3487de054dbd2b072cccc55ffebb67927931cb9307b11e55c5f73446f1c3468028e55a8a7070e4f747c2af8bba9a7bdbcef2e54672ad5749e6d953627ab8e223b30b7487a36f76286143c65cbbcc7c926fc466d008f92ee2c7392fef479789a98fc392125d9a9e8d02e8082a2809f8e58f1bd13d574f3e9b4f1b192640ecaa5b1541a1b6dae0099106819d9acd7cc1e04337b590d2d75b725c7f2ea8d37db154bf28f0073a73d9ab72416b771c2993c913db3a04336629509aa50927c91db2a99ae78546604bd85e4fccad08483623fa0b312286b9204cb64f27f86eb1e1dd5c0d38312f4884debafcbff0e6d8a3e407e3495c6e5f467a4a969e7c7c4ddaebceb57e466bf65d9907ae101c77a5e46e84d5035f1c75ca27e0b598ea10e976c425de1a8b3710822fc9b0f42c1b4a7965379671f7cadbd9baace68bb03c8f72470813a26b787b4a8b9586bdc6cb03c0e8b58e5c3c5cb5aa9e66e3dcc4a1fe6fa20067c54d5787358f2658e97eacde012bbf87a87dd5f723edfa7e2966e9a151e09a4d912012cb49afa4444c731cee87eae17e61c1d3f813533b46c0c2a233962e53cc9faf4e6cea568aec77f06476b69c16ae9ec73dd6573f6f16e4f9016d95df9992eb8192c861b2fe0e741b889428553c1957af224a6cd0292ab0d0be38ff48963997e2484479dda79b51590c1912f3dd9cc778100b1cc5d08d25733395c12ba965ff78e99054a5300d556669e7db004e6b6c3da8f03254c1010e6b5899787f1a3e79d3cb5b905ecbdca50a95c270c80269c7fc1e00eaf3dfc578548ed07d1c23ed1313703447f1d6d11c1855ea8cc8e074de7ee93f3dbdcd56de9f74c0333c1d4d6c518a19d0b1bb33a92cc36d55f21b4223584508959b551d9d20707024814494d222fe56ec1b35cd1db521842d3daf9d22d792c01283868da7befdd5d0ab9decf2f975436e3bc48f1d1d8e7ea0288e28237fb8478bdd2db41c5737fc00601bea40a114d864e442572f0f110b667b5eb57428e8e1f70cf219179a6c753e736a8dcb0e8a1243fdd6bab84b9e2afaef9bddff38c51fafec2a26ba0a2c89ca67a3068cdea283d4b83811f8ac9f5d399a4f74a003ac4fb9a54fd5167d3f779a749b25f0a29de4d880a48dae16a38ebd728a5b51008cfba846adf3c503cc87afccc54aaae744a2efa5f09fc66f2d22b4850f6d397172c6ae8288654d885620c65b8e5ecb3a6536d8355bed734635592eb801109c88d75441b167442dca063a217bd035dd6a78d7386f5c4949a87ae9d55c27c69cad0ec8018901b17d5a3493cb354151f8ab52dd4bb81a344462b2bebe8639fa295faf2fd1d51f9153cf0bee20b08053657af6fdd6b2260732b9353927bff7b46816a848c66f527bbe18b072ec00b8ffd586f42281ab514e8c3488e4602ff1dc4f9ef6ad758f44978d6a8f34595eac2b8d4d95bf763ac892172e80e315e11641cdcaa509c333df1d1afa1a252cc33d2b0642cc1df2a7a3b3f0af0157dcd69de2d512ed0ab501bb655e6c4fa2d753bc224d995506c95fe20f4cd11cdf8b8d599cb2bae25168b0231602fa04ee4e5dfafed61301c76bee9feddbb770313114b6fa9c643a979b99366a58dbefbdd848f68af467d467a31d9e0c4ec39c870233e59831eb6b63cb1834d49dd878e805f9393ada0cd146c9d85a2dd9c344c16cbbba1fc0e1da809b190ee8c3b922e5eacbc3965ba3698fd18d08c8ce172c61e04c02b3bbba839c892bcfc337b32959ca7c44c9e7566d84640c2c7030ef9ceda09b9debc7784716b61828f8fd8a0a599ffe1cf4d5c4e264d93a0e61b50be93f5ce776dfab4595218ca3fee4f95f1a914321db56f2e2a319ee058afe2c2bf580908b88a153ef34c32af4c0cb4e6d144fdb375458f16f3531089bbc63b0fc973a826331ab5b02b904e2e376ac09795ae7472e93e66b654eb719a0d21bc292573e888dd2aaf28252cb6cabc3a66b0b2f1aa5cc4ab79d2a5903284026d4710c5a9d2052a4479b71538cbe410153101b4b3c43c77e808f869e4b09bba7fb43cafb3d7d055662bc5cc38fd9524da7b63ff41b1ceb1a754a2628a2b5f6f6823f091251adebec601f2307bb3138d12682d4515dedb071d01e3481cc0bd575196ba29d0ea5e232e166e62e7f0d65bd99da65736812e1fd96872a5592cec04c7d5bb038b8efc9f8364484e4b439f8db6220c0fa09efdd3aec4aa2336bd3b2bb31ae2e9842413ad6437d9b3b698940814906ecaee191597b6e384811c67e7c434cffd751747fdd13a3f7e80caac04d2349ce3020e0993e9ebef8e0b23f4fbb759dda9a5c70d86d7061a1107f01faf8cded15ecc77401b5b8d8edcea05563105fc4456c62fbe133bf1fda8a351e04d3a57530b0af21f0dc74e1d0e0881cdca0405e342cfac6c9ad54314b71d8070b2cd1baf548b9498b68043c85ce143f6e7930195f2661352fd3d5b6e984cdb44bec514f5e1eb6faaa9476d0d7f39aaac8df351fea1f5b5381c358b3cb89984cd440ba12e1e49aa2f7ef2d0cee482ce8476793976d1f36d023cd01be8861aae0abdda910368e961384b35043e9be04b64142b199794d22da45e280f696de4ebc979375e2e4d78852be9604bd99eb2f9f65a5c0b228a3ca5f8d2f4542d67f5ec7dea77530d6fa20e1728cd1f978da5ce5e4debed845b76f8dc8100e39f48e023ed34ea07eece52b9f92b3c46344442a6d1785e6fa190b6d6", 0x1000) r2 = syz_open_dev$sndtimer(&(0x7f0000ea5000)='/dev/snd/timer\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f00002c7000)=0x2000000000000000) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00002e0000)='/selinux/enforce\x00', 0x0, 0x0) fcntl$getown(r0, 0x9) r4 = gettid() r5 = getpid() tgkill(r4, r5, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00006b8000)={0x0, 0x200}, &(0x7f000037a000-0x4)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000df3000-0xa0)={r6, @in6={{0xa, 0x0, 0x1, @loopback={0x0, 0x1}}}, 0x4, 0x7, 0x0, 0x40, 0x80}, 0xa0) sendmsg$kcm(r3, &(0x7f00004f7000)={0x0, 0x0, &(0x7f00002c3000-0x8)=[{&(0x7f0000b33000-0x7d)="68d1c5af29af187f22e398df292d08695295cddff278b35cb27c05d19c3a1d3ce4da40417c41695ba6e4c28e8c0109952737e5c6109f6c231e6aae1befc49781ff4a85678099859520b8e22b75f78532bdc324dd2d72333270de1366cc555e04243c1e48a2843b868e3846a5be213c3c574a845e3b68e123c0997fb1cb", 0x7d}], 0x1, &(0x7f0000364000-0x70)=[{0x70, 0x117, 0xfffffffffffffff9, "76d8e0fe38560d3ca56d2219911e850a4c808fa5913b651fbe7e73e3ded8e78a94daa03b846cb49e9cf312083f304e7f0f65e994eb3e4fd52a2215e72495b69a001986a9a33341ff0d8b07542502345d1d4de4ea1efbcf7f257b360abe93b5e2e805"}], 0x70, 0x4}, 0x20000000) sendmsg$nl_netfilter(r3, &(0x7f0000e20000-0x1c)={&(0x7f0000ea1000-0xc)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00006b2000-0x8)={&(0x7f0000965000)={0x41c, 0x3, 0x9, 0x400, 0x2, 0x1, {0xa, 0x0, 0x4}, [@typed={0xc, 0x87, @pid=r5}, @generic="befbdf82fad91322d69353453413b61963c05142e4bc77c9c76f5d4b6047ede10eaf7f613aef2ff14b64bf5b0687d437039f2b907a9dd9913e3784b990f77058877a1fe61027efbd", @generic="e7c780a5989d3c6ff28a6469537b38516bc7148dbbafe79510d4a162a4c2e5e0328a4c2cd04ad3f3f582d3aa41f8", @generic="b093c52566635582424f519ae1f5bdf967c7cae3b254910b265129593ce589daec0d82c146d8a26db3e3f30f1bcfead5b47096a95c22af5c5294572b59ed74d219e841b728a4", @typed={0xc, 0x1, @u32=0x4}, @typed={0xc, 0x66, @pid=r4}, @nested={0x268, 0x3, [@generic, @generic="cabff4b3e693894cd9aeba47e342a2b735ebf2b7bce66c3e5973ee7e7bf71e8925eee17c8039df9c3810bdcb2bcd1d7cccea0b9954a27956d9ea15b290dcd33c62d164bf28949f7f794cd5a85e885e8f73eef427", @typed={0x10, 0x35, @u64=0x7f}, @generic="984afdc156c6e57178813a1e03755fd6309782", @generic="56aaec953a0dbe054faf759881765ff36d1eb1b031a207defce33e08bf81ee9f8fb5a08c3eaa54b9ae752b79afbc119b87476e7de68ee7bb4709a8587b141688ada87c9365115cbdac32273450f9fbbe723b67c38f", @generic="68fd6aa085ab1dade58a21b0313ca11c1bc35fe7c2ab151a642fd5de895d781fd8a2c2ef22e545a810f756a00275d9bbef8fcfe954ce6f1841edcd5474b8b4bb980b621b52fc46ee152ac3a42b7a610fa5f0a531d311fbf10dd97b3515913bc44e90283b9d6da0ef51ba56f398911e020378ca8e562a97570fae2089eec4d68431152e94bee10a5de9ce0986404c32dd293bf213f7aa8bcb6057e6a8e2f72a3b519395922310e42c5a38b6ad94f0386636b1181454fa5731c4b4", @generic="27efcdb5cf11b087b167ab572d7ab83806d90a7e2774b8a699122dd6146f3183af02db33cd5b3ba09f7a578bb62e36fe8c2785f8b6fb32bce56891c1ff1344a7f3cd0ba54243fbd5b29dbea3536df210bb6dc68e5bf3ec7430ec169310d0d143f76108807045a2371346f60f22293da553412b736aade8414b3f828e9ad142ad84361f9391fd82cd47dd8be72bc281c50b6111dd4867b5afaa289fdc8afcdd8c6c318ab4c312122ad37091b413cb5f966c898585f34a97d8cdcfc313ae741d33c17941f5c6d5e1a866e1f6cb8ab47554adb9896bc49f7b6d6d9c5241"]}, @generic="bb2c3fea9a0fa8306d6a990a4658766fcdd0d9a6bc8b7231cb33cdb057275633797ffcd2bbd82a6fee3e100ac1a18732aeae8caef5496f9029d486100adf8c092b27fa002c34abd9afbb2de060fddc2a120005b6efcb1858fdf76560c8043769540202865b294e7ec1253bbe3cad944e5266f91dbb1adac57135a60bdc55039f94179a69aacc63b36d62cf7ccc339c0f7c97b0107dabeaf55f49afce3d7ea00fcc8d0f89341bc229fd57d3ec2b0a2d37540942e252bac54d7bc80650c64fef52"]}, 0x41c}, 0x1, 0x0, 0x0, 0x48000}, 0x4800) ioctl$KVM_SMI(r2, 0xaeb7) 2018/02/04 21:33:39 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000001000)='/dev/amidi#\x00', 0x7, 0x80100) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000001000)=0x3, 0x4) modify_ldt$read_default(0x2, &(0x7f0000001000-0x59)=""/89, 0x59) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000001000-0x4)=0x0) sched_getparam(r1, &(0x7f0000001000)) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000001000)=0x14) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001000)='/dev/sequencer2\x00', 0x18000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r2, 0x40405514, &(0x7f0000001000)={0x100000001, 0x1, 0x3, 0x4, "c306fe5bb0cdb032fd8dd4992010d38fee412a6422a1671414cb0fbaf18975ec1ea58eb264ed6a0ef11e501f", 0xffffffff}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f0000003000-0xc)={0x0, 0x80000, r0}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000002000)={r3, 0x80000, r0}) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000001000)={0x200, 0xcf, 0x8, 0x519c, 0x6}, 0xfffffffffffffccb) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x84, 0x19, &(0x7f0000004000-0x2c0)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000), {{{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@uncond, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@uncond, 0x0, 0x70, 0x98, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@uncond, 0x0, 0x70, 0xfffffffffffffeca, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}]}}, 0x2) [ 91.749692] binder: 12366:12385 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 91.779911] binder_alloc: 12372: binder_alloc_buf, no vma [ 91.785712] binder: 12372:12377 transaction failed 29189/-3, size 24-8 line 2957 [ 91.808108] binder: 12372:12381 ioctl c1105517 2025def4 returned -22 [ 91.830344] binder: 12372:12399 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 91.855457] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/04 21:33:39 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00009c8000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:39 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000000) r0 = mq_open(&(0x7f0000000000)='-$\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000665000-0x40)={0x0, 0x1, 0x2}) mq_timedsend(r0, &(0x7f0000a5c000), 0x0, 0x0, 0x0) mq_timedsend(r0, &(0x7f00007b9000)="f2fd7e4b7d027966ad252740d53a066696cc9d27cf952316dbd68bbac286ff1657aed4fb35ec2bc14a23fc17a0635db6c175945690bc830a3b00f958191e0780be8eac9c1721f9830664d34d25f1e4dd2ac9", 0x52, 0xff, &(0x7f00008df000-0x8)={0x77359400}) ioctl$int_in(r0, 0x5421, &(0x7f0000b4c000)=0x7ff) mq_timedsend(r0, &(0x7f000066c000), 0x0, 0x0, &(0x7f000058f000-0x10)={0x77359400}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000455000)='/dev/sequencer2\x00', 0x2002, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00007ba000-0xe8)={{{@in6=@ipv4={[], [], @multicast1}, @in=@dev, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@dev}}, &(0x7f000019b000)=0xe8) bind$can_raw(r1, &(0x7f00007c9000-0x4)={0x1d, r2}, 0x10) 2018/02/04 21:33:39 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r1}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x2, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:39 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) r1 = getpid() r2 = getpgrp(0xffffffffffffffff) kcmp(r1, r2, 0x0, r0, r0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000297000)='/dev/qat_adf_ctl\x00', 0xa00, 0x0) ioctl$KDGETLED(r3, 0x4b31, &(0x7f00007b5000)) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0086426, &(0x7f0000c32000)={0x6, &(0x7f00005ed000-0x30)=[{}, {}, {}, {}, {}, {}]}) ptrace$getregset(0x4204, r2, 0x7, &(0x7f0000e89000-0x8)={&(0x7f0000944000)=""/63, 0x3f}) fstatfs(r0, &(0x7f000024f000)=""/159) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000f86000)={0x2, 0x4, 0x0, 0x0, 0xe, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}, @sadb_sa={0x2, 0x1}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @dev={0xfe, 0x80}}}]}, 0x70}, 0x1}, 0x0) 2018/02/04 21:33:39 executing program 7: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000380000)=0x9, 0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f000000e000)='\x00 ', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000055000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000f07000-0x8c)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f7a3a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r3, 0xc02c5341, &(0x7f0000e23000)={0x0, 0x0, 0x0, {0x0, 0x0}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f0000483000)={0x0, 0x1000000000004, 0x8000, {0x77359400, r4}}) 2018/02/04 21:33:39 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f00003fd000)='/dev/vcsa#\x00', 0x1, 0x8000) ioctl$DRM_IOCTL_AGP_INFO(r0, 0x80206433, &(0x7f0000c76000)=""/167) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f000027b000+0xdc1)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000bc0000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003ba000-0x24)) set_tid_address(&(0x7f0000c08000)) r2 = syz_open_pts(r1, 0x801) writev(r2, &(0x7f0000cd1000+0x620)=[{&(0x7f0000956000)="fb8cc460d6c11fc02816bf6b2a166b77989caa542daec0ef7d851f2b9845e28d31b2133dfcc73ed0bd095be5377317397f8d9902299c1051482f2d0ffa642815a3f45fdbc86757030ec0f5d9908f6f7c66bbdb75306807c1f1bc6895a27e932ef3ec97f7011b523636b5b73a0f288fc5d706b77c0acd77bc25e3f10cffb8a76a0d19f937b059dbe94b2d16a1f79db736af96e7ce67d3c1649ae84ccfb13cf9095c43d98bcd48119c16ed704672c461aa3616ecef21df1c79f731394664d21d540825d09bdca537e52e9afb085b8495a1823f8ac6220f76c42c14b1c9772e0db850ac628ea8e975f619a0638a89865cc0fd4db3b32b920ac972d224da75b0b972c17bdd3e6c02f10b5584530cd306fc06822c21eee07e0e78dd9e69a0909d7d8526d6589c5defc4b7d0bbcddbb51c4c1bf6da8496e5fdbfd3e5c3f0f0d8e87d40ecd71d349bffc77b021ab89efa99a8f461df0ca96163f0d898c5774da30cce2d2a5e110c08ad1c7f154d3f04772e126e83be2b12ccbd6981cedab2acfa137d3c437cacf1ffe3b9c496dd09fc24840ed3bc61b0f24188d48a863640af051c552439c8c07652777507b03fff21da13fca86e2271ab63c037edcc3852acacf9e14bb519feaa3afd012e535a3a86e0c0dc2d0de51d3a5697c72366899af36872175db00d4360bd01a6867ae6466c8205f079d497b401bdc3acf67db9af6f6b7a044b2728cc55e884a7e005055b904b9c45e815d640463cc7aee0065712d4cad1d8e560469633aa731e4b98858ddd5d5a71b5e586b03c5046dc884611a90fb1fd4216515139ffb86389c5402648cbbb2485acbd4387c09da1e04b1b35c08741c4b1a4802540e26b802318ef5830a2630e8367c9d4b33fbac89d9a053578d84959bb432096fb28da0b8e278a29bfe920114dfdc9dc7fd58d0f3502f3c3ed03604d99b1c71c3d7959988be24a7b0fd13f7499bcdf143ef1de593967c419d5a1a06e41ef95051a72c6b5f66da3847362d43cbeb8516d950878b2ba26124466393f872bea46071ccd94328013507c2b929020a9c7f398dcab337f66406ec6b5f8a97c0e4dbdad238149cf60c2e4ed002233cd243b621317ee3504fd9e123e4cbf6269f04d0ee6711deb73addd7a015f6d5960735a25ea0db94220384a60494e040c6b12c26247155826c63cf629a99c32960ebd3f6305046491c32dfc986500bd7c749646289b81f3c28ead36cf6e41948d3dcb34d1a11420607af901b658f8c13fe194aa3d2271102e7f806d55d2102df49675b21da52de0269ade73ea7a1998d29d5239d4e6101ad5548b371cab62e79d0941fb91d3c69edc4a7124a7c2c9b2dd0ea2c31bf121469ffbd84eb4031d4cd0b2dcc5adc018e6302f37c54855316d7551780234fe5e95ec327650041b418bbe4e5ae74bf6f95e5669bc0749902c30aee644e390b40e2e23a98616806ee8900ba5247c6f2e58864180bc2cfb379aad1b1418da5560bd52ec363250f94dc52c7f3e96fe322b21c8b4b397136615f5c8df71bd2367694bcabae9a6b330a7b6d109fce5e65a1648d31cd2bcbab0d91807ad9b59e467305bede839a43201f4f54c5ac15dac1d69e1bdbb716eb38ee1430c6665222b7a68d5be947fc691874336561cb1967931ee5fc1560b08c67ffee2c22b37acc60356a4e644af601f9a3246d5bc574a107c5ba7aebbb59fa76ddd33a3ac4faec220d1b6311fff62607cd8642cc061756c98ce30dc0f3c95dd842ddb67a68cf5fd5ba9e9f3f1be56c1ee083f517fc34e42deb3d4eba521346913f11fa2d857ff2203897053f7e14c078359616ca548a223f8cfa6ed885c104b30561089fe4d95b9818aa11f3c38ee60b06e996ee9dacd6a47ea693604a65d45945f8704b4aa29dd054ff9b5fa35c6e79091a786e88939b0bc44147e492029157ae69f604d174aa2947d9791a27c95a0a8b0fc4cd4d2d6bbf87e1f90f1e5d7b7714eb357b54a0e6b928e87cd31684ee9b5ed4f9c6cd9bf4816872117dfccca26dbd64843c12e73f8c046478587930132701b3179d0e97610cc08ba36a971abf9849bf0c24a539e73abfe4f6a3d69eb6f15ae72c0e07883806435f217ab180119b9759aa40e540cb38f0ade5e5c8fa9eab0955bd0fe1b3e13a2898a0f8dd032403c08a111eed2fd2229efcea9403058511575d9bdac1a5291f6c9274c9d6905f3ca4c0c3f7b480cbd15191645e860abc44e4da2e03bdb12437a9a70d24f73fd37b5e1dc0fc062dd0269a68055687af66260d6ea45520e9275d4ffae4f1fb73c1078bdc2556c2d6cc965cb723728d037aa836376ab067293bad1ed04d9125fa990d7425d1861edac2b1cb5d10bc72436d104367a33964b494197b3573b81c87cb5feaab62f0d29fd27b16252db008680fbce91a75140a615cd0f09196458444db10c8922de152acedd4127f6a36f4ea4aded7ae74a83a7ffbbdd8dbb0adbac1c7a5159bbd82503a4fde839f4869671aa885df0cbb655a5ce3da1eecc346a655629e993578607aae24269466fcebfedefcc7382de5d6939e27a7ed09e8a5fe0d7c62f4919860c5adc7363acfb464bffca82cc2e79cda1f1b5a58b45f625817e3e2ff12ab5496c31d86eec638d6290a535ec3ff5325cd20fa5bbb63d9225769de40a538078c39c523096fe4452a6316bbfbf69da2a679e0f5064990bb8fa94381b670094ec75f99b2c1544730c411101bf5aff", 0x789}], 0x1) 2018/02/04 21:33:39 executing program 5: r0 = socket(0x2, 0x806, 0x4) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000001000-0x8)=0x1) ioctl$fiemap(r0, 0xc020660b, &(0x7f0000001000-0xc8)={0xfd5e, 0x9, 0x4, 0xff, 0x3, [{0x1ff, 0x100000000, 0x52, 0x0, 0x0, 0x80}, {0x3c6, 0x4011, 0x6f1, 0x0, 0x0, 0x3}, {0x7, 0x2, 0x718, 0x0, 0x0, 0x2401}]}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f000079f000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) setrlimit(0x1, &(0x7f0000011000)={0x1, 0x80}) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000ac4000)=""/245) add_key(&(0x7f00000ff000)='big_key\x00', &(0x7f0000281000)={0x73, 0x79, 0x7a}, &(0x7f0000282000-0x1000)="034ec15bd6e1bfceda673463c8cb6ab1dba433ddb91280dd2795ef4e45daa6325c1dfe872f81ca3c38754b41da295a9b3b16c031661c4b7e06656d00a228f773e3dc43dff5e02738ac35942836869efd9fffcdd09bb40fc67124ddf53e8b57d3ae76a68ad00e70aba950c60af4ccbc39964c6d74ad558d4a1a5972ed5564cb67488119e44ec270573cbbddad8db56ee1da6633f0a7151651d2eb233d76fea7f85ff32ddc5cefb13e692700f9e4c6090799f664da7683bfbddce0686a99da5e2f082e17608bb98a509894f4de417522f00d42b17bf3fd12cf527dba11f3b067e6d8a1bb28dc637423be5fe02b787d69efe7a2c0df12287cecc9e6e918454671746a675238b0d27d19ea851cd326ac25c18e2104eb8a4c65278a136fb8ed13a053e1e5571951ee5699bc5aa711ae1f21fae0a81fd3cb73570fdacfebd4cba2c3be0877f1aac7eba9087df55a5d5d72c7f34bcece655e75da1ec039edf9d6ae0960c47bb86cc8e6bb84e8499a3ba0a92d33b265d554db6cbb46ff763d30c537d3f71358f55cc86cd8237721a20c07a754220bd8a15c9926f0fbdf4c6582b55636e94edbd82701487ce06506fc6e952efe73ca885af6c92933140e8b90a13e7ce63bd4b2398e887820657eaea2b9a5f4f169617055f6a3b1aea0ae55ac84a8c7d72fc749554b6e433f9aba91d6c12f8aced03ea8272bced4b7040122931f89f66ea12c4990bdc0398db3b73ea30d2f1edddb1cc886889dc700b6ddff797b8e9e9a557e7b05a18e3d08082ccb8001f98f7c4aa0fe3180b7bf45791a0a1c9d3e00297d88a95dab3772a2d7c15d121513779ba8f58bfe352418671f5d161ceb3073e2cb410d2aa5471e43b485f49cb5c5405fe405f859717e48c3e31ad898df1647db8950b0ed05d5a5a8f3bc4bb7175920d30e0dd38a5c7914ebde89e5214435ff1a37fe4fb8973dc05f9d3174749c085354d5e91bac74dc110fed0443fb3af9ed01acea70122a0439d5dd64d596856dfbb57c884226e7e315c23bbef19cf81e715c3aea7b55a4b81309ea5b8b02393a16a8b195fb3afc6184941185decf4cbfd7822dc36c84841b7f13212c011c77e593fe0898912307417ff669931fa93de78d4ee609332811422818994bd1debbf0b08fa89730f7f89fa10d5b85e7dd73b2607655eb5c270de42ce204d9fb35951aa7ef102048886fd3b45e6bbeab75575c84ec050f48c4af08a23151a57aea4397563470ec46f8b5f1ac45cec8f5ad8ac8659441ca5d11aa60d5e17f3ec1e947ff3741bc327083b8782db582c2a81f83ba1ddfdb86ff7d5147221c68d3e3427fb7fdf26606ccb5170c18df1fd61e6d4b4a11b41851a187745a9895f7379f7e9ce32720b412bfc5ed97c080d453a1055cbc41f2c9d57d9fee53bb393a5c60fea39f729368138cd7eecba90fe837c10eb89070fff78d6e223c45dd65fa18814d647abd4a4cb51e624ead4e9322adbca35bf4cbced3bad120ab7f61e4751836d84f31d9f7af575f29ccc3f0c9c6eef7568682c8e057f1ed7c653bde3cc7ec5ba80dfe8031b5fd1388f6e29b31e4266d1abf8b89491c59b00548a8616715aa61b8a475396008ce96d0627708590f511ef578e231abb3ecf1e787f2fab5729a49f6a61a45b03540fbdec969a54efc8a5a5e274728b5ca658f1cbb2a1b0477e0d4be33fa55c5d4678434a26aae427a7fefce73f299c833733071fc3550cc651473d3338ca9f6ba11", 0x4d1, 0xfffffffffffffffb) uname(&(0x7f0000045000-0x74)=""/116) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000ae1000-0x10)='/selinux/member\x00', 0x2, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f000068e000-0xcf)={r1, r0, 0xff, 0x8, &(0x7f00006e9000-0x37)="9cd5547c2db2d8c1e0c6f882274aaad9fc7e5265e53df1b120f1270e9ae147d2241a076f4a4bcabec5c8745d52a48e5dc7905b7e58921b", 0x7f, 0x6, 0x7, 0x2, 0xc531, 0xfffffffffffffbff, 0xfffffffffffffffd, "bdb14fa6ac2ef5ffb10239fafb28fe6fb9779206abae715325309dc6c04e6c9c87b1c024b944b8965be48427da6c3c2a967b510669ef3fd2e046c0260976605cdd987715fc19781fcbe3018c4785e66922bc2c9e497c23c0908a6084f9f9c19c25d103dc9b0d3c3b3983af28d5924e1eaa57041482f57363b7baf967d1a3af8149dd91908fb17062bcf4d7302e3a39a44946a1e87fbdfc08bd074552f8c1bc752e670256801f2b4e96e541d251c681"}) modify_ldt$write2(0x11, &(0x7f00003a2000-0x10)={0xf14, 0x20000800, 0x3000, 0x3, 0x80000001, 0x8, 0x7, 0x3, 0x7fffffff}, 0x10) r2 = getpid() syz_open_procfs(r2, &(0x7f000066f000-0x9)='net/stat\x00') 2018/02/04 21:33:39 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000000a000)={0x2, 0xfffffffffffffcc9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffffffffffff}, 0x800000a00000400, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000b49000-0x8)={0x0}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f000084d000)=[@in6={0xa, 0x1, 0x4, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x3, 0x7, @empty, 0x800}, @in={0x2, 0x3, @loopback=0x7f000001}], 0x48) mkdir(&(0x7f0000f4d000)='./file0\x00', 0x3) mount(&(0x7f00008df000-0x8)='./file0\x00', &(0x7f0000344000-0x8)='./file0\x00', &(0x7f00007fc000)='nfs\x00', 0x0, &(0x7f000000a000)) r1 = add_key$user(&(0x7f0000b08000)='user\x00', &(0x7f0000f3e000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000c78000-0xfa)="94fb15f5b02fc58dc27f9d5e18e704e9d75277cda78f731fe8fbdb3ad98cefdd6c7fcfeb17af88f54e9f900479d70db7582ee3c1b56f984988bba8b8add0b059692b8946013e170b0a6c9452675e116e4240ffcaf65bf34d0258c23ea75ca5e8114c088f79046f0d56f3deca14af66507878a224ab08a660d16509cb9a9e80182fadaacb3c230bcf2da585cf93c386672160c155c8f319f5a0250dfceda3731369726ad7fbc9ad7977de1467f8abe7e6028965a2790f52bd0a255504d38e1bdf6d0437ad87641fb63019c321524326353d92e2cd3f37b9e28b3657e8b4c2f8ed62024de1d61ee65b3d0a0a19498babcaa5e7c3fba43395e3e081", 0xfa, 0xfffffffffffffff9) r2 = add_key$keyring(&(0x7f0000eab000)='keyring\x00', &(0x7f0000027000)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$unlink(0x9, r1, r2) [ 92.271585] QAT: Invalid ioctl [ 92.280038] binder: 12401:12411 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 92.286526] QAT: Invalid ioctl [ 92.294903] binder_alloc: binder_alloc_mmap_handler: 12403 20000000-20002000 already mapped failed -16 [ 92.307973] binder: BINDER_SET_CONTEXT_MGR already set [ 92.315359] binder: 12403:12412 ioctl 40046207 0 returned -16 2018/02/04 21:33:40 executing program 7: gettid() mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000971000)='./file0\x00', 0x4000, 0x138) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f00001df000-0xc)={0x7, 0xffffffffffffffff}) r2 = dup2(r0, r1) request_key(&(0x7f00004c7000-0xd)='dns_resolver\x00', &(0x7f0000404000-0x5)={0x73, 0x79, 0x7a}, &(0x7f0000997000)='/selinux/checkreqprot\x00', 0xffffffffffffffff) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f000025a000)='/selinux/checkreqprot\x00', 0x200000, 0x0) syz_open_pts(r2, 0x8000) 2018/02/04 21:33:40 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00004bb000)='[security\x00', 0x0) r1 = timerfd_create(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) dup3(r0, r1, 0x80000) [ 92.331718] binder: 12401:12424 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 92.354086] QAT: Invalid ioctl [ 92.355983] binder_alloc: 12403: binder_alloc_buf, no vma [ 92.361744] QAT: Invalid ioctl [ 92.363085] binder: 12403:12412 transaction failed 29189/-3, size 24-8 line 2957 2018/02/04 21:33:40 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = memfd_create(&(0x7f0000b36000-0x8)="757365727d25bc00", 0x2) socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000255000-0x8)={0x0, 0x0}) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000671000)={@common='teql0\x00', @ifru_addrs=@nfc={0x27, 0x8, 0xfffffffffffffff8, 0x6}}) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000926000-0x4)='tls\x00', 0x4) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00008d2000-0x39)={@generic="e43248fafc3bf20c30774169fa720cda", @ifru_names=@common='yam0\x00'}) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0xffffffffffffff0d, 0x200007ff, &(0x7f0000deb000-0x10)={0x2, 0x3, @local={0xac, 0x14, 0x0, 0xaa}}, 0x10) ioctl$TUNSETOFFLOAD(r2, 0x400454d0, &(0x7f0000b92000)=0x5) sendto$inet(r0, &(0x7f0000855000)="c3", 0x1, 0x0, &(0x7f000071e000)={0x2, 0xffffffffffffffff, @empty}, 0x10) close(r0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000d48000)=@raw={'raw\x00', 0x9, 0x4, 0x344, 0x23c, 0xffffffff, 0xffffffff, 0x16c, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x4, &(0x7f00006f1000-0x40), {{{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0x16c}}, [{{@uncond, 0x0, 0x94, 0xd8, 0x0, {}, [@unspec=@rpfilter={0x24, 'rpfilter\x00', 0x0, {0x8}}]}, @unspec=@CT0={0x40, 'CT\x00', 0x0, {0x1, 0x8000, 0x0, 0x8000, '\x00', 0x6}}}, {{@uncond, 0x0, 0x70, 0xd0, 0x0, {}, [@unspec=@void, @unspec=@void]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x8b, [0x9, 0x3, 0xc6, 0x6, 0x0, 0x8], 0x400, 0x4, 0x7}, {0x73deabd100000000, [0xc1e, 0x80000000, 0x200, 0x4, 0x7, 0x81], 0x3, 0x10001, 0x4}}}}, {{@ip={@broadcast=0xffffffff, @local={0xac, 0x14, 0x0, 0xaa}, 0x0, 0xffffffff, @generic="0e9c96bbba4079435dead0ca9e1b8a1d", @common='gre0\x00', {0xff}, {0xff}, 0x16, 0x1, 0x8}, 0x0, 0xe4, 0x108, 0x0, {}, [@common=@icmp={0x24, 'icmp\x00', 0x0, {0xf, 0x4, 0x8001, 0x6}}, @common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0x6, 0x6, 0x2}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}]}}, 0x3a0) 2018/02/04 21:33:40 executing program 0: mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000005000-0xd)='/selinux/mls\x00', 0x0, 0x0) r0 = syz_open_dev$urandom(&(0x7f0000009000-0xd)='/dev/urandom\x00', 0x0, 0x204) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) 2018/02/04 21:33:40 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000c20000-0xb)='/dev/audio\x00', 0x80, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:40 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001aa000)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000f3d000)='/dev/dsp\x00', 0x0, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000a01000)='/dev/dsp\x00', 0x4a580, 0x0) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000d82000-0x8)={0x3, r2}) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000055000-0x24)={0x800, 0xfffffffffffffffc, 0x1, 0x101, 0x1da, 0x2, 0x8, 0x40, 0x173, 0x3, 0x74c2, 0x40}) ioctl$TCXONC(r0, 0x540a, 0x1) [ 92.380572] binder: 12403:12417 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:40 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000d59000-0x15)='/proc/self/net/pfkey\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f00007a9000)={0x0, 0x80000000}, &(0x7f00000dd000-0x4)=0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000549000-0x16)={r1, 0x5, 0x7, [0xa45, 0x6, 0x4, 0x4, 0x1, 0x2, 0x1f3f]}, 0x16) r2 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r3}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:40 executing program 7: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000239000)='/dev/audio\x00', 0x4040, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000aa6000)=@security={'security\x00', 0xe, 0x4, 0x39c, 0xffffffff, 0x94, 0x18c, 0x18c, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000-0x40), {{{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0x18c}}, [{{@uncond, 0x0, 0x94, 0xf8, 0x0, {}, [@common=@ah={0x24, 'ah\x00', 0x0, {0x0, 0x0, 0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x401, [0x3ff, 0x5, 0x8, 0x800, 0x9], 0x2, 0x0, 0xe416}, {0x0, [0x2113, 0x1ff, 0x6, 0x6, 0x100, 0x5], 0x37d, 0xffffffffffffff5f, 0x100000000}}}}, {{@ip={@remote={0xac, 0x14, 0x0, 0xbb}, @dev={0xac, 0x14, 0x0, 0xe}, 0xff000000, 0xffffff00, @syzn={0x73, 0x79, 0x7a, 0x0}, @generic="c088471e2821cd461267c57d73ea21cc", {0xff}, {}, 0x6f, 0x3, 0x20}, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz1\x00', 0xccc6, 0x0, 0x0, 0x2}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x74, [0x2, 0x400, 0x0, 0xfffffffffffffcb4, 0xfffffffffffffff7, 0x5], 0x9, 0x200, 0x3}, {0xffff, [0xcc2, 0x8000, 0x0, 0x5, 0x2, 0x1ff], 0xfffffffffffff777, 0x100000000, 0x6}}}}, {{@uncond, 0x0, 0x94, 0xf0, 0x0, {}, [@common=@unspec=@socket1={0x24, 'socket\x00', 0x1, 0x1}]}, @common=@CLUSTERIP={0x5c, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0x9, 0x4e, [0x0, 0x9, 0x3, 0x49f, 0x3, 0x2, 0x400000004000000, 0x1ff, 0x2, 0x80000000, 0x80, 0x7, 0x4, 0xc8eb, 0x5, 0x2b71], 0x2, 0xfff, 0xfffffffffffffffa}}}]}}, 0x3f8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket(0x1000000010, 0x802, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000174000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) sendmsg$nl_route(r1, &(0x7f000022b000)={&(0x7f0000f83000)={0x10}, 0x2e2, &(0x7f0000f76000-0x10)={&(0x7f0000f86000-0x58)=@newneigh={0x28, 0x1c, 0x303, 0xffffffffffffffff, 0xffffffffffffffff, {0x100000000000007, 0x0, 0x0, r2}, [@NDA_LLADDR={0xa, 0x2, @link_local={0x1, 0x80, 0xc2}}]}, 0x392}, 0x1}, 0x0) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f000044b000)={@empty, @rand_addr}, &(0x7f0000146000-0x4)=0xc) 2018/02/04 21:33:40 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000ad4000-0xd)='/selinux/mls\x00', 0x0, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f0000339000-0x1000)=""/4096, &(0x7f0000000000)=0x1000) 2018/02/04 21:33:40 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000ed5000-0x10)=[{&(0x7f0000a1f000)="110000001100094701bb61e1c30500ff07", 0x11}], 0x1) r1 = accept4$inet6(0xffffffffffffffff, &(0x7f00006f4000-0x1c)={0x0, 0xffffffffffffffff, 0x0, @empty}, &(0x7f0000eba000-0x4)=0x1c, 0x80800) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000776000-0x14)={@remote}, &(0x7f0000e67000)=0x14) [ 92.430906] binder: undelivered TRANSACTION_ERROR: 29189 [ 92.436923] binder: release 12403:12412 transaction 315 out, still active [ 92.443974] binder: undelivered TRANSACTION_COMPLETE [ 92.449210] binder: send failed reply for transaction 315, target dead [ 92.467748] binder: 12441:12442 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 92.519448] binder: 12441:12452 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 92.522681] binder: BINDER_SET_CONTEXT_MGR already set [ 92.542298] binder: 12446:12459 ioctl 40046207 0 returned -16 [ 92.555187] binder_alloc: 12446: binder_alloc_buf, no vma [ 92.560882] binder: 12446:12465 transaction failed 29189/-3, size 24-8 line 2957 2018/02/04 21:33:40 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f0000db6000-0x38)={&(0x7f00004ae000+0xb5c)=@generic={0x10000000001e, "030000000000000000000001e526cc573c5bf86c483724c71e14dd6a739effea1b48007be61ffe06d79f00000000000000076c3f010039d8f986ff01000000000000af06d5fe32c419d67bcbc7e3ad316a198356edb9b7341c1fd45624281e27800ece70b076c3979ac40000bd767e2e78a1dfd300881a1565b3b16d7436"}, 0x80, &(0x7f0000b96000)=[], 0x0, &(0x7f00002d4000)=[]}, 0x0) sendmsg$netlink(r0, &(0x7f000078e000-0x38)={0x0, 0x0, &(0x7f0000014000-0x40)=[], 0x0, &(0x7f0000b8c000)=[]}, 0x0) recvmsg$kcm(r0, &(0x7f0000a28000-0x38)={0x0, 0x0, &(0x7f0000999000-0x20)=[{&(0x7f0000780000)=""/1, 0x1}], 0x1, &(0x7f00005ee000-0xa4)}, 0x0) recvmsg(r0, &(0x7f0000d1f000)={&(0x7f00007d5000-0x10)=@ethernet={0x0, @broadcast}, 0x10, &(0x7f0000f3c000)=[{&(0x7f0000b3a000-0x43)=""/67, 0x43}, {&(0x7f00002b5000)=""/166, 0xa6}, {&(0x7f0000a20000)=""/59, 0x3b}, {&(0x7f00006fa000)=""/133, 0x85}, {&(0x7f0000cff000-0x18)=""/24, 0x18}, {&(0x7f00005c3000-0xfd)=""/253, 0xfd}, {&(0x7f0000b06000)=""/155, 0x9b}, {&(0x7f000065a000-0xaf)=""/175, 0xaf}, {&(0x7f00006be000-0xa3)=""/163, 0xa3}, {&(0x7f000024e000)=""/175, 0xaf}], 0xa}, 0x122) 2018/02/04 21:33:40 executing program 2: mmap(&(0x7f0000000000/0xffb000)=nil, 0xffb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00001b8000-0x9)='/dev/rtc\x00', 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00004a6000-0x28)={'vcan0\x00', 0x0}) mmap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000f3c000-0x2)=0x5) mmap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000ffc000-0x8)={0x0, 0x0}) mmap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r1, &(0x7f0000ffc000-0x1c)={&(0x7f0000ffb000)={0x1d, r2}, 0x10, &(0x7f0000ffb000)={&(0x7f0000ffc000-0x34)={0x7, 0x80a, 0x1, {r3, r4/1000+30000}, {}, {0x2, 0xf6, 0x3, 0x100000000}, 0x1, @can={{0x0, 0xfffffffffffffffd, 0x5, 0x3}, 0x5, 0x3, 0x0, 0x0, "2c273481ff7f9cd7"}}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x24004084) sendmsg$nl_generic(r0, &(0x7f0000589000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f000000d000+0x379)={&(0x7f0000001000)={0x14, 0x12, 0x301, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) recvmsg(r0, &(0x7f0000004000-0x38)={0x0, 0x0, &(0x7f0000ff8000-0x20)=[], 0x0, &(0x7f000000d000-0x72)=""/114, 0x72}, 0x0) recvmsg(r0, &(0x7f0000010000)={&(0x7f000000f000)=@alg, 0x58, &(0x7f00002e4000-0x40)=[{&(0x7f0000006000)=""/220, 0xdc}, {&(0x7f0000109000-0x80)=""/128, 0x80}, {&(0x7f0000ff8000)=""/4096, 0x1000}], 0x3}, 0x0) 2018/02/04 21:33:40 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000986000-0x1)='\x00', 0xfffffffffffffffe) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f000079c000-0x70)={0x22d7, {0x2, 0x2, @multicast2=0xe0000002}, {0x2, 0x3, @loopback=0x7f000001}, {0x2, 0x3, @local={0xac, 0x14, 0x0, 0xaa}}, 0x206, 0x7, 0x38df456f, 0x9, 0x20, &(0x7f00004a8000-0x10)=@generic="b5c62ca3597fb637c7f9d7c9ade4f293", 0x4, 0x8001, 0xffffffffffffff80}) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f0000d02000-0x8)={0x1, &(0x7f00009c7000)=[{}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) openat$vcs(0xffffffffffffff9c, &(0x7f00008a9000)='/dev/vcs\x00', 0x80, 0x0) 2018/02/04 21:33:40 executing program 7: mmap(&(0x7f0000000000/0x4e000)=nil, 0x4e000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000004e000-0x2)='!\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000028000-0xd)='/dev/snd/seq\x00', 0x0, 0x20005) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndseq(&(0x7f000000a000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x4058534c, &(0x7f00009dd000-0x58)={0x80, 0x0, 0xc8}) r3 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000037000)={0x0, 0x0, 0x0, "9ede7a8c5ae95e48000000000000007f4f13eeab650000000000007fffde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa0500000074dbcfa6c14d"}) clock_gettime(0x0, &(0x7f0000044000)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000004000)={0x0, 0x0}) write$sndseq(r0, &(0x7f0000015000-0x38)=[{0x8, 0x0, 0x7, 0xfffffffffffffffd, @time={r4, r5+30000000}, {0xfff, 0x9}, {0x1, 0x10001}, @ext={0x0, &(0x7f0000026000-0x62)="477ae9bb7f890daa20c02f57c39a7f6070c6b870335b1a35a80a5b9d9b5b3baa26f40fd4400833925315e5b2c2de2442765c19450b3d83f9bf9eac60aacc9f82cd7e9b3e3af0ee492b83efc646e512eddd35aa0f5b55f968de140e9b45f54342b104"}}, {0x3, 0x400, 0xffffffff, 0xfff, @time={r6, r7+30000000}, {0x7fffffff, 0x10001}, {0x18, 0x1}, @note={0x5, 0x9, 0x31124fda, 0xaea, 0x40}}], 0xfd10) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000044000-0x50)={0x343, @tick}) 2018/02/04 21:33:40 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f000009c000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000dbd000-0x50)={@common='ip_vti0\x00', @ifru_map={0x3, 0x3, 0x3a0b, 0x3f, 0xd7bc, 0x5}}) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000ca9000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000a80000+0x2ae)='GPL.\x00', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000951000)='/dev/snd/seq\x00', 0x0, 0x0) r3 = dup2(r2, r1) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r3) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f00000e0000-0x8c)={0x96f3, 0x0, 0x0, 'queue1\x00'}) 2018/02/04 21:33:40 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ftruncate(r0, 0x8) r1 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x73622a85, 0x0, r1}], &(0x7f0000379000)=[0x0]}}], 0x0, 0x0, &(0x7f000061c000)}) fcntl$setstatus(r0, 0x4, 0x4000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) r2 = socket$nfc_llcp(0x27, 0x3, 0x1) vmsplice(r2, &(0x7f0000ef2000)=[{&(0x7f00003f7000-0x45)="bb00f31803ea07c53835dfcad65dd26e239b89e53c5498955ab3ad64d7696d6fa18ff6a933be00862e6b212682ba50970d5a367f1246865672d719b1e6963f1dbc62382924", 0x45}, {&(0x7f00008d6000)="88224a46f6b653388efb0698198e264559062ad51002dc8fd0ac63fe014537cb3cd430fefeeea6c2ecad23f34ae8acecfafd05ee5f7359d17d1c850fbdebe01f78dcb55f06a79ff59f50ac89028f38992dc51e21c1cbfdc8c57404e2b0494ab51138a3d14b9b476236eb29e8b02b56fe8d65536b4d187044b080c1d99acde631ccd0a25b9a3c506ab93c5f6efe5d9db07c0e062920301ffbdc0faa56dc8ecb481f12081901bb8227fbb34a02d8", 0xad}, {&(0x7f0000a9f000-0xb3)="a4d9ddc59fe0ecd9c9e665cf1e7e9fcb8bd1bfec02269acdaf2ed4698018b8b91f7f7e320745460f197328f9bbd081b9d5ea4afa082e3be9dd3a047427916ba12ac6bfdbedf7f0c16f46703647c87391f31118bcee2df648fb148e7db87535b073e70943a77f17cbbb6c0b1fcee3af4f603df07f4edf870d4cf3cfe8bf1733e9f4f19f18f5524d4e15689ed119ed1b6e359adc0b45440957fe49ecd6727514b97e9bf07ce262e852879c93b7e2f3fb79deca15", 0xb3}, {&(0x7f0000c20000)="c33385bdedbd7ef971456ac3fe2826d6b6dc0afcef1dd2f90b3916150a3f6e1c9ad8adc49620e1c01cd86758d86dbfc10b29c69d2f1ffb42ccded2d2c0e88dbb73610caf3715caebc8a2d6f46488328ad8033f3b467ae767eda80516d4f75f397677fc7ad76e327c8eb8419e0abed821b1f187c8bc2f077167d50dd06acd6be9635c8b42f33087759d95b476d8c628098f800cbf30e14001fdf55577c6f55cdef659dc47df70f22039cc18af0731e14fc04cc35c824b9282e2", 0xb9}, {&(0x7f000019e000)="6b6450c6becc33ba18bcd0df7f75f713460ed3213a0ae599ed3a8cfef94f756594d56cdb75eacbd3b1ad52573f436e692cb29dc77a84fa975fff755243b5705eeeeba12bbafd3cfa264feecdf20bcbc6584eba086b51fac2ee7cf75feb2db0ab4c1a209e89f7f7ec22c0597e92e89326c47dda85b9cc3c72d540c6c3775cf8291a49c49b625fcbf53d1d0398dc9a9834ec706cbdabc1c170b89c3763ea382b4fb11b3a03593dc9acce53b506194ac755b939d4445d2d46a7108d17", 0xbb}, {&(0x7f0000663000-0x46)="1d461f0e8f3844cb35319198f508ad7a78c2c5f128d4620538a0775818db718b112be14ca9a1f0e3851adfc3953563a0be4244c6785be7abfcc3e026cf3f4ad4e00f242acddb", 0x46}], 0x6, 0x0) 2018/02/04 21:33:40 executing program 5: r0 = socket(0xe, 0x800, 0x1ff) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x1, 0x4) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000001000-0x12)='/dev/input/mouse#\x00', 0xb0, 0x40400) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000943000-0x78)=""/120, &(0x7f000011f000-0x4)=0x78) ioctl$KVM_ASSIGN_DEV_IRQ(r1, 0x4040ae70, &(0x7f0000af8000-0x10)={0x8001, 0x9, 0x3, 0x4}) r2 = syz_open_procfs(0x0, &(0x7f000029a000-0xd)='net/fib_trie\x00') setsockopt$inet6_dccp_int(r1, 0x21, 0x1b, &(0x7f00008ea000), 0x4) sendfile(r2, r2, &(0x7f00004eb000)=0x26, 0x9fb) r3 = syz_open_dev$sg(&(0x7f0000734000-0x9)='/dev/sg#\x00', 0x0, 0x80080) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r2) ioctl$TUNGETVNETHDRSZ(r2, 0x800454d7, &(0x7f0000c2b000)) socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r3, 0x80045300, &(0x7f0000f43000)) 2018/02/04 21:33:40 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000708000-0x10)={0x0, 0x10, &(0x7f0000f3f000-0x10)=[@in={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}]}, &(0x7f000045c000)=0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) shutdown(r0, 0x2000000000000002) socket$nfc_raw(0x27, 0x1, 0x0) [ 92.582572] binder: undelivered TRANSACTION_ERROR: 29189 [ 92.594127] binder: release 12446:12448 transaction 320 out, still active [ 92.601188] binder: undelivered TRANSACTION_COMPLETE [ 92.606342] binder: send failed reply for transaction 320, target dead [ 92.623252] binder: 12472 invalid dec weak, ref 327 desc 1 s 1 w 0 2018/02/04 21:33:40 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r0, 0xc074510c, &(0x7f0000004000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 2018/02/04 21:33:40 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000fe0000)='./file0\x00', 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000b28000-0x4)=0x6) set_mempolicy(0x4, &(0x7f0000a21000), 0x4) [ 92.627803] binder: 12467:12475 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 92.649736] binder_alloc: binder_alloc_mmap_handler: 12472 20000000-20002000 already mapped failed -16 [ 92.665973] binder: BINDER_SET_CONTEXT_MGR already set [ 92.675646] binder: 12472:12479 ioctl 40046207 0 returned -16 2018/02/04 21:33:40 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x2, 0x10000000000) times(&(0x7f0000a3c000-0x10)) close(r0) r1 = syz_open_dev$vcsn(&(0x7f0000879000)='/dev/vcs#\x00', 0x5, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc2c45513, &(0x7f00007aa000-0x4c0)={{0x6, 0x0, 0xfffffffffffffff7, 0x0, "70b95c22d13a764f8e2308287d467d6e053fd992eb033d3bb74110c7c8078bb922de4adb359425979fdb2742", 0x1}, 0x8, [0xec, 0x80000001, 0x20, 0x513cf1f4, 0xfffffffffffffffe, 0x0, 0x8, 0x9, 0x1, 0x4, 0x6, 0x516, 0x46, 0x10001, 0xd2, 0x8, 0x2, 0x8a13, 0x4, 0x3f, 0x7, 0x7, 0x6, 0x3, 0x7, 0x5, 0x8, 0x3, 0x1, 0x81, 0x37, 0x1000, 0xffffffffffffff80, 0xfffffffffffff000, 0xdb, 0x5945, 0xffffffff, 0xfffffffffffffff8, 0x2, 0x3792, 0xa1d, 0x5, 0x2, 0x8b00000000, 0x101, 0x40, 0x5, 0xc1, 0x7fffffff, 0x5, 0x7, 0x7f, 0xffffffff00000000, 0x4, 0xffc, 0x5, 0x0, 0x6, 0x8, 0x4, 0x5, 0x241, 0x1, 0x3, 0x4, 0xd2, 0x1, 0x8, 0x15c1, 0x400, 0x9, 0x101, 0x1, 0x0, 0x7, 0x9, 0x401, 0x20, 0x7fffffff, 0x5, 0x0, 0x96, 0x81, 0x7ff, 0x9, 0x8, 0x96, 0x6, 0x5, 0x0, 0xb47, 0x8, 0x8, 0x40, 0x7, 0x3fe2, 0x89a7, 0x100000001, 0x8, 0xe858, 0x9, 0x200, 0x8, 0x6, 0x4, 0x80000001, 0x5, 0x1, 0x4, 0x3, 0xfff, 0x8152, 0x5, 0x5, 0x8, 0x20000000200000, 0x100, 0x6, 0x8, 0x40, 0xffff, 0x7, 0x2ce, 0x5, 0x1, 0x2, 0x9], {0x0, 0x989680}}) accept4$ipx(r0, 0x0, &(0x7f0000b9f000), 0x80800) getsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000023000-0x4)=0x7, &(0x7f0000c0e000-0x4)=0x4) r2 = syz_open_dev$vcsa(&(0x7f0000d89000-0xb)='/dev/vcsa#\x00', 0x81, 0x400000) getpeername$llc(r2, &(0x7f0000458000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000942000-0x4)=0x10) [ 92.689728] binder_alloc: 12472: binder_alloc_buf, no vma [ 92.695408] binder: 12472:12494 transaction failed 29189/-3, size 24-8 line 2957 [ 92.709499] binder: 12467:12475 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 92.710284] binder: 12472:12488 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:40 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x423, &(0x7f000018f000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0xffffffffffffffff, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001, {[]}}, @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d73cde", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) r0 = syz_open_dev$midi(&(0x7f000012a000)='/dev/midi#\x00', 0xa0, 0xcccf867918da29db) getsockname$packet(0xffffffffffffff9c, &(0x7f00003e1000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty}, &(0x7f0000cf9000)=0x14) setsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f00008be000)={@mcast1={0xff, 0x1, [], 0x1}, r1}, 0x14) 2018/02/04 21:33:40 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = fcntl$dupfd(r0, 0x0, r0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x3f, &(0x7f0000001000-0x81)=""/129, &(0x7f0000188000)=0x81) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000001000)={0x0}, &(0x7f0000001000)=0x6) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000002000-0x20)={0x946, 0x16, 0x4, 0xfffffffffffffeff, 0x22d, 0x5, 0xa06, 0x100000000, r2}, 0x20) mmap(&(0x7f0000000000/0xfd0000)=nil, 0xfd0000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$KIOCSOUND(r1, 0x4b2f, 0x10001) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000fd1000)={0x0, @in={{0x2, 0xffffffffffffffff, @multicast2=0xe0000002}}}, &(0x7f0000952000)=0x108) 2018/02/04 21:33:40 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = fcntl$getown(0xffffffffffffff9c, 0x9) ptrace$setsig(0x4203, r0, 0x200, &(0x7f0000372000-0x10)={0x1b, 0x9ed, 0x10000, 0x4}) r1 = open(&(0x7f0000003000)='./file0\x00', 0x40, 0x0) lremovexattr(&(0x7f000055d000)='./file0\x00', &(0x7f0000809000)=@known='security.capability\x00') ioctl$TIOCLINUX2(r1, 0x40305828, &(0x7f0000002000-0xc)={0x2, 0xfffffffffffffefd}) 2018/02/04 21:33:40 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x31, &(0x7f0000006000-0x341)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000012000), {{{[], 0x0, 0xa8, 0x2fc}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@ipv6={@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @empty, [], [], @generic="28447731605bfefb40ca55d89ccefcf6", @generic="b09f4c0f65a437e1937917274a593f7a"}, 0x0, 0xa8, 0xd0, 0x0, {}, []}, @REJECT={0x28, 'REJECT\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, []}, @REJECT={0xffffff44, 'REJECT\x00'}}]}}, 0x1) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000d21000)='/dev/vcs\x00', 0xada14be525e6737, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00007a1000)={{{@in6=@mcast2, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in=@dev}}, &(0x7f0000000000)=0xe8) 2018/02/04 21:33:40 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) 2018/02/04 21:33:40 executing program 6: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000bdc000-0xb)='/dev/audio\x00', 0x10000, 0x0) mknodat(r0, &(0x7f000008b000-0x8)='./file0\x00', 0x8000, 0x8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:40 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsn(&(0x7f00000f9000)='/dev/vcs#\x00', 0xd51f, 0x200000) ioctl$TCSBRK(r1, 0x5409, 0xff) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, r2}], &(0x7f00003a6000-0x8)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:40 executing program 2: r0 = socket$can_raw(0x1d, 0x3, 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001000-0xd)='/selinux/mls\x00', 0x0, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000cb4000-0xa)='/dev/vcs#\x00', 0x334, 0x2102) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$ION_IOC_HEAP_QUERY(r1, 0xc0184908, &(0x7f0000000000)={0x4, 0x11, 0x0, r2}) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$midi(&(0x7f0000001000)='/dev/midi#\x00', 0x401, 0x2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fgetxattr(r0, &(0x7f00004e5000-0x14)=@known='security.capability\x00', &(0x7f0000000000)=""/100, 0x64) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000008000)='/dev/ion\x00', 0x0, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000833000-0x9)='/dev/dsp\x00', 0x0, 0x0) r5 = dup(r4) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f00001cb000-0x4)=0x4, 0x4) ioctl$TUNGETFEATURES(r5, 0x800454cf, &(0x7f0000208000)) ioctl$KVM_SET_SIGNAL_MASK(r5, 0x4004ae8b, &(0x7f0000302000)={0x46, "046769c0b7b6aada2626bdc76a0b72525067ff3cf6c1e089fc051ead48cf42f75418e9a873466847328d2ac3a75c82ad3a83dd0010981fd3f0a5abfab5f2eaef759bba23a85a"}) ioctl$PERF_EVENT_IOC_QUERY_BPF(r5, 0xc004240a, &(0x7f0000fb4000-0x14)={0x3, 0x0, [0x0, 0x0, 0x0]}) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000010000)={0x8004, 0x1a, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x6012, r6, 0x0) pivot_root(&(0x7f00004a7000-0x8)='./file0\x00', &(0x7f0000641000-0x8)='./file0\x00') [ 92.766958] binder: undelivered TRANSACTION_ERROR: 29189 [ 92.775348] binder: release 12472:12479 transaction 325 out, still active [ 92.782343] binder: unexpected work type, 4, not freed [ 92.787656] binder: undelivered TRANSACTION_COMPLETE [ 92.792810] binder: send failed reply for transaction 325, target dead [ 92.807458] binder: 12511:12519 DecRefs 0 refcount change on invalid ref 0 ret -22 2018/02/04 21:33:40 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000002000-0x50)={@mcast1={0xff, 0x1, [], 0x1}, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @loopback={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x5}) r0 = socket(0xa, 0x2, 0x5) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f000027c000)={0x8, {{0x2, 0x1, @local={0xac, 0x14, 0x0, 0xaa}}}, 0x0, 0x4, [{{0x2, 0x0, @multicast2=0xe0000002}}, {{0x2, 0x1, @loopback=0x7f000001}}, {{0x2, 0x3, @empty}}, {{0x2, 0x1, @dev={0xac, 0x14, 0x0, 0x13}}}]}, 0x2b8) bpf$PROG_LOAD(0x5, &(0x7f0000be8000)={0x1, 0x5, &(0x7f0000002000-0x28)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x6c}, [@ldst={0x5, 0x0, 0xfffffffffffffffe}], {0x95}}, &(0x7f0000e34000)='syzkaller\x00', 0x5, 0xc3, &(0x7f000063e000)=""/195}, 0x48) [ 92.829658] binder: 12511:12522 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 92.837978] ion_mmap: failure mapping buffer to userspace [ 92.845231] audit: type=1400 audit(1517780020.567:104): avc: denied { setfcap } for pid=12507 comm="syz-executor7" capability=31 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 2018/02/04 21:33:40 executing program 6: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001000)='/dev/cuse\x00', 0x1053ff, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) r1 = accept4(0xffffffffffffff9c, &(0x7f0000001000-0x10)=@in={0x0, 0xffffffffffffffff, @remote}, &(0x7f0000d0b000-0x4)=0x10, 0x7ccfecceea7ed615) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000001000-0x8)) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000002000)) tee(r1, r0, 0x3f, 0x8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f000036f000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000ea5000)}) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000c2f000-0x10)='/selinux/status\x00', 0x0, 0x0) dup3(r3, r3, 0x80000) ioctl$TIOCNXCL(r3, 0x540d) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000e40000-0x4)=0xf, 0x4) 2018/02/04 21:33:40 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f000032d000-0x9)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = eventfd2(0x1f, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00005f7000)={r2, 0x0, 0x7fffffff, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000c96000-0x1f)={r3, 0x0, 0x2, r2}) 2018/02/04 21:33:40 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getpgid(0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) ioctl$KVM_GET_ONE_REG(r0, 0x4010aeab, &(0x7f0000010000)={0x7, 0x80000000}) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000d75000-0x8)=[0x100, 0x400]) r1 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) dup2(r1, r0) write$sndseq(r0, &(0x7f0000e70000-0x30)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xfffffffffffffffe}, @note}], 0x1c) [ 92.876726] binder: BINDER_SET_CONTEXT_MGR already set [ 92.878162] binder: 12512:12527 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 92.882550] binder: 12512:12515 ioctl 40046207 0 returned -16 [ 92.892125] binder_alloc: 12512: binder_alloc_buf, no vma [ 92.901217] ion_mmap: failure mapping buffer to userspace [ 92.901360] binder: 12512:12523 transaction failed 29189/-3, size 24-8 line 2957 2018/02/04 21:33:40 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000c19000)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000e08000)='/dev/dmmidi#\x00', 0x9, 0x40) ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000ecd000-0xdf)={0xb600000, 0xd7, "f1ea250d69b1f82ee1f6f1713143a6da454ab1b6dd7c7e555b45d308337f92f68fe7eeafa3f17b997f3f6929e1a127e861522567f84500495a9ba5d98ccc1b2389357254118108f44d28672d657f24e21917082970e6acbf57400d0210646ab6f03a35ec24d1a160e92df100434d4d7c64a415ea2e2188f01cd74b73c3e5d9692dc3da35ba40404fc919278b7c21c5d9fd22f59201abf28a0b1dadd2e80ee57db87e85383c188d76bfd5622e99bb41c074daea80001f0679adb689c1aa4edfb3e69b16cb3421ea01ae517c008fdebe4c9e1c06258d0477"}) mmap$binder(&(0x7f000030d000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006b0000)={0x8, 0x0, &(0x7f0000a4e000)=[@decrefs={0x40046307, 0x1}], 0x0, 0x0, &(0x7f0000ea5000)}) 2018/02/04 21:33:40 executing program 2: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000002000-0x9)='/dev/rtc\x00', 0xc80, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000004000-0xd)='/dev/snd/seq\x00', 0x0, 0xfffffffffffffffe) setsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f0000001000)=0x4329840e, 0x4) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$netrom_NETROM_T4(r0, 0x103, 0x6, &(0x7f0000004000-0x4)=0x9, &(0x7f0000003000)=0x4) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000002000-0x8c)={0x0, 0x0, 0x0, 'queue1\x00'}) 2018/02/04 21:33:40 executing program 0: r0 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @dev, @local}, &(0x7f00003b3000)=0xc) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000000)={@mcast2={0xff, 0x2, [], 0x1}, 0x6, r1}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f000021e000-0xc)='/dev/sequencer2\x00', 0x400000000000003, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r2, 0x40085112, &(0x7f000021e000-0x50)={{0xff, 0x3}}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000f71000)={@mcast2={0xff, 0x2, [], 0x1}, 0x6324, 0x2, 0xff, 0x0, 0x0, 0x2}, 0x20) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000702000)) [ 92.949956] binder: undelivered TRANSACTION_ERROR: 29189 [ 92.955787] binder: release 12512:12515 transaction 330 out, still active [ 92.962822] binder: undelivered TRANSACTION_COMPLETE [ 92.967976] binder: send failed reply for transaction 330, target dead 2018/02/04 21:33:40 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x7, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x1}, 0x10) r1 = socket(0x1b, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000abb000)=@req3={0x7fff, 0x2000000000, 0x6, 0x8000, 0x8, 0x2000, 0x2af}, 0x1c) close(r1) 2018/02/04 21:33:40 executing program 4: r0 = getpgrp(0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ptrace$setregs(0xf, r0, 0x1ff, &(0x7f0000001000-0xb1)="bde01f91c87722591586eaabcffe124717be9952043dee7590696fc72128c83b0bc42cc102d7bde816c8a240583076722151efdb5a6de7e77660f995e46b0ae527398c8fe0d90176ef42d5a86d38a484f2910ecdef552039b1f8e28414f7b52fa717b8e8f3053c444adfb83a4c4d4d86ec725b848cd1458220870949295a789c756e2c608d25675f51242aac41ed9d863287fc054a2b62d32090034e7baa3b8eae2fe373a9fde3714b638a0b2f4b0983a9") mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0xc8, &(0x7f000086a000)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) io_submit(r1, 0x1, &(0x7f00001b2000)=[&(0x7f0000a43000-0x40)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f00000bd000-0xc1), 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}]) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x5, 0x32, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f000026c000)='./file0\x00', 0x0) ioctl$TIOCOUTQ(r3, 0x5411, &(0x7f00008bb000)) io_getevents(r1, 0x0, 0x1, &(0x7f0000e73000-0x20)=[{}], &(0x7f00009ca000)) 2018/02/04 21:33:40 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000673000-0x9)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000a98000-0x48)={0x40000, 0x0, [0x1000]}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000fc2000)=0x3) getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000701000)={@dev}, &(0x7f0000c29000-0x4)=0x14) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2018/02/04 21:33:40 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x800000000002f, &(0x7f0000a5c000)=0xffffffff, 0x4) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000080000)={0x4, 0x5}, 0x8) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00004dd000-0xb)='/dev/hwrng\x00', 0x101000, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f000016d000)=0x0) prctl$setptracer(0x59616d61, r2) [ 92.997883] binder: 12538:12545 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 93.035115] binder: 12551:12556 DecRefs 0 refcount change on invalid ref 1 ret -22 2018/02/04 21:33:40 executing program 7: mmap(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000005000-0x38)={0x0, 0x0, &(0x7f0000004000)=[], 0x0, 0x0}, 0x0) [ 93.067521] binder: 12538:12545 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 93.095400] binder_alloc: binder_alloc_mmap_handler: 12551 20000000-20002000 already mapped failed -16 [ 93.116315] binder: BINDER_SET_CONTEXT_MGR already set [ 93.123348] binder: 12551:12556 ioctl 40046207 0 returned -16 [ 246.751192] INFO: task syz-executor3:12518 blocked for more than 120 seconds. [ 246.758563] Not tainted 4.15.0+ #207 [ 246.762836] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 246.770829] syz-executor3 D25120 12518 4215 0x20020004 [ 246.776487] Call Trace: [ 246.779090] __schedule+0x8eb/0x2060 [ 246.782839] ? __sched_text_start+0x8/0x8 [ 246.787035] ? mark_held_locks+0xaf/0x100 [ 246.791202] ? _raw_spin_unlock_irqrestore+0x31/0xba [ 246.796337] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 246.801368] ? trace_hardirqs_on+0xd/0x10 [ 246.805536] ? prepare_to_wait_event+0x1dc/0xba0 [ 246.810305] ? prepare_to_wait_exclusive+0x530/0x530 [ 246.815439] schedule+0xf5/0x430 [ 246.818816] ? __schedule+0x2060/0x2060 [ 246.822820] ? lock_release+0xa40/0xa40 [ 246.826812] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 246.832720] ? dl_cpu_busy+0x370/0x370 [ 246.836619] ? __might_sleep+0x95/0x190 [ 246.840617] blk_mq_freeze_queue_wait+0x1bb/0x400 [ 246.845482] ? blk_mq_poll_stats_fn+0x1f0/0x1f0 [ 246.850172] ? hctx_unlock+0xcc/0x120 [ 246.853984] ? blk_mq_run_work_fn+0xa0/0xa0 [ 246.858326] ? percpu_ref_kill_and_confirm+0x1f3/0x3b0 [ 246.863609] ? prepare_to_wait+0x4d0/0x4d0 [ 246.867875] blk_freeze_queue+0x4a/0x80 [ 246.871869] blk_mq_freeze_queue+0x15/0x20 [ 246.876126] lo_ioctl+0x10ce/0x1b70 [ 246.879776] lo_compat_ioctl+0xab/0x140 [ 246.883778] ? lo_ioctl+0x1b70/0x1b70 [ 246.887592] compat_blkdev_ioctl+0x3ae/0x1840 [ 246.892108] ? bfq_create_group_hierarchy+0x110/0x110 [ 246.897346] ? security_file_ioctl+0x7d/0xb0 [ 246.901769] ? security_file_ioctl+0x89/0xb0 [ 246.906211] compat_SyS_ioctl+0x151/0x2a30 [ 246.910465] ? do_fast_syscall_32+0x156/0xf9d [ 246.914972] ? bfq_create_group_hierarchy+0x110/0x110 [ 246.920183] ? do_ioctl+0x60/0x60 [ 246.923646] do_fast_syscall_32+0x3ee/0xf9d [ 246.927989] ? do_int80_syscall_32+0x9d0/0x9d0 [ 246.932599] ? syscall_return_slowpath+0x2ad/0x550 [ 246.937753] ? prepare_exit_to_usermode+0x340/0x340 [ 246.942795] ? sysret32_from_system_call+0x5/0x3b [ 246.947677] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 246.952541] entry_SYSENTER_compat+0x54/0x63 [ 246.956968] RIP: 0023:0xf7f4ec79 [ 246.960344] RSP: 002b:00000000f774a08c EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 246.968077] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000004c06 [ 246.975366] RDX: 0000000000000013 RSI: 0000000000000000 RDI: 0000000000000000 [ 246.982665] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 246.989957] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 246.997245] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 247.004550] [ 247.004550] Showing all locks held in the system: [ 247.010900] 2 locks held by khungtaskd/757: [ 247.015315] #0: (rcu_read_lock){....}, at: [<0000000067398bd4>] watchdog+0x1c5/0xd60 [ 247.023417] #1: (tasklist_lock){.+.+}, at: [<000000000167583e>] debug_show_all_locks+0xd3/0x3d0 [ 247.032474] 1 lock held by rsyslogd/4009: [ 247.036632] #0: (&f->f_pos_lock){+.+.}, at: [<00000000baee7cc8>] __fdget_pos+0x12b/0x190 [ 247.045062] 2 locks held by getty/4130: [ 247.049050] #0: (&tty->ldisc_sem){++++}, at: [<00000000af56324b>] ldsem_down_read+0x37/0x40 [ 247.057739] #1: (&ldata->atomic_read_lock){+.+.}, at: [<00000000a285bbb6>] n_tty_read+0x2ef/0x1a00 [ 247.067041] 2 locks held by getty/4131: [ 247.071036] #0: (&tty->ldisc_sem){++++}, at: [<00000000af56324b>] ldsem_down_read+0x37/0x40 [ 247.079731] #1: (&ldata->atomic_read_lock){+.+.}, at: [<00000000a285bbb6>] n_tty_read+0x2ef/0x1a00 [ 247.089037] 2 locks held by getty/4132: [ 247.093028] #0: (&tty->ldisc_sem){++++}, at: [<00000000af56324b>] ldsem_down_read+0x37/0x40 [ 247.101713] #1: (&ldata->atomic_read_lock){+.+.}, at: [<00000000a285bbb6>] n_tty_read+0x2ef/0x1a00 [ 247.111032] 2 locks held by getty/4133: [ 247.115029] #0: (&tty->ldisc_sem){++++}, at: [<00000000af56324b>] ldsem_down_read+0x37/0x40 [ 247.123716] #1: (&ldata->atomic_read_lock){+.+.}, at: [<00000000a285bbb6>] n_tty_read+0x2ef/0x1a00 [ 247.133034] 2 locks held by getty/4134: [ 247.137030] #0: (&tty->ldisc_sem){++++}, at: [<00000000af56324b>] ldsem_down_read+0x37/0x40 [ 247.145729] #1: (&ldata->atomic_read_lock){+.+.}, at: [<00000000a285bbb6>] n_tty_read+0x2ef/0x1a00 [ 247.155037] 2 locks held by getty/4135: [ 247.159022] #0: (&tty->ldisc_sem){++++}, at: [<00000000af56324b>] ldsem_down_read+0x37/0x40 [ 247.167709] #1: (&ldata->atomic_read_lock){+.+.}, at: [<00000000a285bbb6>] n_tty_read+0x2ef/0x1a00 [ 247.177028] 2 locks held by getty/4136: [ 247.181021] #0: (&tty->ldisc_sem){++++}, at: [<00000000af56324b>] ldsem_down_read+0x37/0x40 [ 247.189713] #1: (&ldata->atomic_read_lock){+.+.}, at: [<00000000a285bbb6>] n_tty_read+0x2ef/0x1a00 [ 247.199055] 1 lock held by syz-executor3/12518: [ 247.203728] #0: (&lo->lo_ctl_mutex/1){+.+.}, at: [<00000000986b7cd5>] lo_ioctl+0x8b/0x1b70 [ 247.212337] 1 lock held by syz-executor3/12529: [ 247.217031] #0: (&lo->lo_ctl_mutex/1){+.+.}, at: [<00000000986b7cd5>] lo_ioctl+0x8b/0x1b70 [ 247.225632] [ 247.227258] ============================================= [ 247.227258] [ 247.234296] NMI backtrace for cpu 0 [ 247.237934] CPU: 0 PID: 757 Comm: khungtaskd Not tainted 4.15.0+ #207 [ 247.244485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 247.253812] Call Trace: [ 247.256375] dump_stack+0x194/0x257 [ 247.259975] ? arch_local_irq_restore+0x53/0x53 [ 247.264613] ? debug_show_all_locks+0x2f3/0x3d0 [ 247.269258] ? nmi_cpu_backtrace+0x1be/0x210 [ 247.273650] ? lapic_can_unplug_cpu+0xa0/0xa0 [ 247.278120] nmi_cpu_backtrace+0x1d2/0x210 [ 247.282330] ? lapic_can_unplug_cpu+0xa0/0xa0 [ 247.286803] nmi_trigger_cpumask_backtrace+0x122/0x180 [ 247.292053] arch_trigger_cpumask_backtrace+0x14/0x20 [ 247.297223] watchdog+0x90c/0xd60 [ 247.300656] ? reset_hung_task_detector+0xa0/0xa0 [ 247.305470] ? complete+0x62/0x80 [ 247.308913] ? __schedule+0x2060/0x2060 [ 247.312859] ? do_wait_intr_irq+0x3e0/0x3e0 [ 247.317166] ? __lockdep_init_map+0xe4/0x650 [ 247.321568] ? do_raw_spin_trylock+0x190/0x190 [ 247.326123] ? lockdep_init_map+0x9/0x10 [ 247.330156] ? _raw_spin_unlock_irqrestore+0x31/0xba [ 247.335230] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 247.340217] ? trace_hardirqs_on+0xd/0x10 [ 247.344336] ? __kthread_parkme+0x175/0x240 [ 247.348629] kthread+0x33c/0x400 [ 247.351966] ? reset_hung_task_detector+0xa0/0xa0 [ 247.356776] ? kthread_stop+0x7a0/0x7a0 [ 247.360726] ret_from_fork+0x3a/0x50 [ 247.364484] Sending NMI from CPU 0 to CPUs 1: [ 247.368997] NMI backtrace for cpu 1 [ 247.369003] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.15.0+ #207 [ 247.369005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 247.369014] RIP: 0010:reschedule_interrupt+0x0/0xb0 [ 247.369016] RSP: 0018:ffff8801d9f1fc88 EFLAGS: 00000086 [ 247.369020] RAX: dffffc0000000000 RBX: 1ffff1003b3e3f99 RCX: 0000000000000000 [ 247.369022] RDX: 1ffffffff0d59280 RSI: 0000000000000001 RDI: ffffffff86ac9400 [ 247.369024] RBP: ffff8801d9f1fcb0 R08: 0000000000000000 R09: 0000000000000000 [ 247.369026] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 247.369028] R13: ffff8801d9f1fd68 R14: ffffffff87268d60 R15: 0000000000000000 [ 247.369031] FS: 0000000000000000(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000 [ 247.369033] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 247.369035] CR2: 00007fa48287c710 CR3: 0000000006a22005 CR4: 00000000001606e0 [ 247.369039] Call Trace: [ 247.369044] ? native_safe_halt+0x6/0x10 [ 247.369049] default_idle+0xbf/0x430 [ 247.369053] ? __sched_text_end+0x4/0x4 [ 247.369059] ? rcu_eqs_special_set+0x1e0/0x1e0 [ 247.369063] ? tsc_verify_tsc_adjust+0xf6/0x3e0 [ 247.369068] ? set_cpu_sd_state_idle+0x1dc/0x2d0 [ 247.369072] ? mark_tsc_async_resets+0x30/0x30 [ 247.369077] arch_cpu_idle+0xa/0x10 [ 247.369080] default_idle_call+0x36/0x90 [ 247.369083] do_idle+0x24a/0x3b0 [ 247.369088] cpu_startup_entry+0x104/0x120 [ 247.369091] ? cpu_in_idle+0x20/0x20 [ 247.369096] start_secondary+0x40a/0x590 [ 247.369100] ? set_cpu_sibling_map+0x1660/0x1660 [ 247.369108] secondary_startup_64+0xa5/0xb0 [ 247.369112] Code: 25 54 ed 01 00 75 12 65 48 89 3c 25 f8 7f 00 00 65 48 8b 24 25 58 ed 01 00 57 e8 db 2c 60 fb e8 67 2b 00 00 e9 db e8 ff ff 66 90 <0f> 1f 00 68 02 ff ff ff fc f6 44 24 10 03 74 0b 0f 01 f8 0f 1f [ 247.369997] Kernel panic - not syncing: hung_task: blocked tasks [ 247.545868] CPU: 0 PID: 757 Comm: khungtaskd Not tainted 4.15.0+ #207 [ 247.552419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 247.561743] Call Trace: [ 247.564307] dump_stack+0x194/0x257 [ 247.567908] ? arch_local_irq_restore+0x53/0x53 [ 247.572564] ? vsnprintf+0x1ed/0x1900 [ 247.576345] panic+0x1e4/0x41c [ 247.579509] ? refcount_error_report+0x214/0x214 [ 247.584244] ? nmi_trigger_cpumask_backtrace+0xef/0x180 [ 247.589586] watchdog+0x91d/0xd60 [ 247.593022] ? reset_hung_task_detector+0xa0/0xa0 [ 247.597838] ? complete+0x62/0x80 [ 247.601273] ? __schedule+0x2060/0x2060 [ 247.605220] ? do_wait_intr_irq+0x3e0/0x3e0 [ 247.609513] ? __lockdep_init_map+0xe4/0x650 [ 247.613901] ? do_raw_spin_trylock+0x190/0x190 [ 247.618465] ? lockdep_init_map+0x9/0x10 [ 247.622499] ? _raw_spin_unlock_irqrestore+0x31/0xba [ 247.627577] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 247.632566] ? trace_hardirqs_on+0xd/0x10 [ 247.636696] ? __kthread_parkme+0x175/0x240 [ 247.640993] kthread+0x33c/0x400 [ 247.644333] ? reset_hung_task_detector+0xa0/0xa0 [ 247.649145] ? kthread_stop+0x7a0/0x7a0 [ 247.653092] ret_from_fork+0x3a/0x50 [ 247.657500] Dumping ftrace buffer: [ 247.661100] (ftrace buffer empty) [ 247.664786] Kernel Offset: disabled [ 247.668389] Rebooting in 86400 seconds..