action={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  246.074524] binder: 2364 RLIMIT_NICE not set
[  246.075967] binder_alloc: 2086: binder_alloc_buf, no vma
[  246.075994] binder: 2341:2350 transaction failed 29189/-3, size 0-0 line 2870
[  246.086647] binder: 2341:2350 ioctl c0306201 20002fd0 returned -14
[  246.093617] binder: 2341:2364 BC_FREE_BUFFER u0000000000000000 no match
[  246.093654] binder: 2341:2364 IncRefs 0 refcount change on invalid ref 1 ret -22
2017/12/02 09:23:01 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0xc4, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:01 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000b2a000)={0xffffffffffffffff, &(0x7f0000a82000)="", &(0x7f0000adb000)=""}, 0x18)
ioctl$TCXONC(r0, 0x540a, 0x1)
ioctl$TCXONC(r0, 0x540a, 0x0)
syz_open_dev$loop(&(0x7f0000851000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
2017/12/02 09:23:01 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
write(r2, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x1)
[  246.093663] binder: 2341:2364 got transaction to invalid handle
[  246.093675] binder: 2341:2364 transaction failed 29201/-22, size 0-8 line 2755
[  246.114830] binder: BINDER_SET_CONTEXT_MGR already set
2017/12/02 09:23:01 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x0, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  246.114839] binder: 2372:2373 ioctl 40046207 0 returned -16
[  246.114932] binder: 2372:2373 ERROR: BC_REGISTER_LOOPER called without request
[  246.114940] binder: 2373 RLIMIT_NICE not set
[  246.131437] binder: BINDER_SET_CONTEXT_MGR already set
[  246.131445] binder: 2374:2375 ioctl 40046207 0 returned -16
[  246.131715] binder: 2374:2375 ERROR: BC_REGISTER_LOOPER called without request
[  246.131723] binder: 2375 RLIMIT_NICE not set
2017/12/02 09:23:01 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {0xffffffffffffffff, 0x0, 0x0}, {r2, 0x42, 0x0}], 0x3, 0x299f)
write(0xffffffffffffffff, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1)
2017/12/02 09:23:01 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:01 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
write(r2, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r2, 0x540a, 0x2)
ioctl$TCXONC(r2, 0x540a, 0x1)
[  246.136857] binder_alloc: 2089: binder_alloc_buf, no vma
[  246.136882] binder: 2372:2382 transaction failed 29189/-3, size 0-0 line 2870
[  246.145249] binder: 2372:2382 ioctl c0306201 20002fd0 returned -14
[  246.160322] binder_alloc: 2086: binder_alloc_buf, no vma
[  246.160351] binder: 2374:2387 transaction failed 29189/-3, size 0-0 line 2870
2017/12/02 09:23:01 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000071f000-0x78)={0x0, 0x78, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xffffffffffff8000, 0x400000000, 0x0, 0x0, 0x2408000000, 0x2, 0x0, 0x0, 0x0, 0x2ba69649, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffffff, 0x1ff, 0xffffffffffffff9c, 0x8)
perf_event_open(&(0x7f00008a8000-0x78)={0x4000000002, 0x78, 0xa2, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000390000)=0x0)
r0 = getpgid(0x0)
gettid()
r1 = getpgrp(r0)
perf_event_open(&(0x7f00006d1000)={0x2, 0x78, 0xc30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f00008ab000-0x8)=0x8000000074)
r2 = memfd_create(&(0x7f0000e5f000-0x3)="405b00", 0x2)
ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0086426, &(0x7f00004ab000)={0x3, &(0x7f00006b6000-0x18)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$sock_int(r3, 0x1, 0x800000008, &(0x7f0000f8f000-0x4)=0x0, 0x4)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xd4e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2001000000000f6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000cc5000)="2e2f66696c653000", 0x10000, 0x0)
r5 = socket(0x11, 0x3, 0x0)
bind(r5, &(0x7f00005a2000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679c00800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c000100000000e9ffff48740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000122000)={{{@in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, @in6=@local={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {{@in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0}, 0x0, @in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f00001a1000)=0xe8)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f00009d5000-0x4)=0x10000, 0x4)
socket$inet(0x2, 0x0, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0x100})
2017/12/02 09:23:01 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x0, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:01 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x0}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  246.162653] binder: 2372:2382 ioctl c0306201 20005fd0 returned -14
[  246.164174] binder: 2372:2382 ioctl c018620b 2000dfe8 returned -14
[  246.184848] binder: 2372:2382 ioctl 40046205 0 returned -22
[  246.192595] binder: 2374:2387 ioctl c0306201 20002fd0 returned -14
[  246.210292] binder: BINDER_SET_CONTEXT_MGR already set
[  246.210300] binder: 2372:2382 ioctl 40046207 0 returned -16
[  246.215374] binder: 2372:2389 ERROR: BC_REGISTER_LOOPER called without request
2017/12/02 09:23:01 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:01 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r2, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x1)
[  246.215386] binder: 2389 RLIMIT_NICE not set
[  246.216654] binder_alloc: 2089: binder_alloc_buf, no vma
[  246.216676] binder: 2372:2382 transaction failed 29189/-3, size 0-0 line 2870
[  246.231176] binder: 2372:2382 unknown command 0
[  246.231185] binder: 2372:2382 ioctl c0306201 20002fd0 returned -22
2017/12/02 09:23:01 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0)
write(0xffffffffffffffff, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1)
2017/12/02 09:23:01 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
write(r2, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x2)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:01 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
write(r2, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x2)
ioctl$TCXONC(r2, 0x540a, 0x1)
[  246.239946] binder: 2374:2387 ioctl c018620b 2000dfe8 returned -14
[  246.254555] binder: 2372:2389 ioctl c018620b 2000dfe8 returned -14
[  246.254704] binder: 2372:2382 BC_FREE_BUFFER uffffffffffffffff no match
[  246.254747] binder: 2372:2382 IncRefs 0 refcount change on invalid ref 1 ret -22
2017/12/02 09:23:01 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r2=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r2}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r1, 0x0, 0x0, 0x0})
2017/12/02 09:23:01 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[], 0x0, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:01 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:01 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
write(r2, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r2, 0x540a, 0x2)
ioctl$TCXONC(r2, 0x540a, 0x1)
[  246.254757] binder: 2372:2382 got transaction to invalid handle
[  246.254769] binder: 2372:2382 transaction failed 29201/-22, size 0-8 line 2755
[  246.254788] binder: 2372:2382 ioctl c0306201 20005fd0 returned -14
[  246.255671] binder: 2374:2387 ioctl 40046205 0 returned -22
2017/12/02 09:23:01 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {0xffffffffffffffff, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(0xffffffffffffffff, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1)
2017/12/02 09:23:01 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000071f000-0x78)={0x0, 0x78, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xffffffffffff8000, 0x400000000, 0x0, 0x0, 0x2408000000, 0x2, 0x0, 0x0, 0x0, 0x2ba69649, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffffff, 0x1ff, 0xffffffffffffff9c, 0x8)
perf_event_open(&(0x7f00008a8000-0x78)={0x4000000002, 0x78, 0xa2, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000390000)=0x0)
r0 = getpgid(0x0)
gettid()
r1 = getpgrp(r0)
perf_event_open(&(0x7f00006d1000)={0x2, 0x78, 0xc30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f00008ab000-0x8)=0x8000000074)
r2 = memfd_create(&(0x7f0000e5f000-0x3)="405b00", 0x2)
ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0086426, &(0x7f00004ab000)={0x3, &(0x7f00006b6000-0x18)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$sock_int(r3, 0x1, 0x800000008, &(0x7f0000f8f000-0x4)=0x0, 0x4)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xd4e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2001000000000f6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000cc5000)="2e2f66696c653000", 0x10000, 0x0)
r5 = socket(0x11, 0x3, 0x0)
bind(r5, &(0x7f00005a2000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679c00800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c000100000000e9ffff48740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000122000)={{{@in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, @in6=@local={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {{@in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0}, 0x0, @in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f00001a1000)=0xe8)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f00009d5000-0x4)=0x10000, 0x4)
socket$inet(0x2, 0x80a, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0x100})
2017/12/02 09:23:01 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  246.271752] binder: BINDER_SET_CONTEXT_MGR already set
[  246.271762] binder: 2374:2387 ioctl 40046207 0 returned -16
[  246.271806] binder: 2374:2404 ERROR: BC_REGISTER_LOOPER called without request
[  246.271816] binder: 2404 RLIMIT_NICE not set
[  246.273396] binder_alloc: 2086: binder_alloc_buf, no vma
[  246.273428] binder: 2374:2387 transaction failed 29189/-3, size 0-0 line 2870
[  246.287888] binder: 2374:2387 ioctl c0306201 20002fd0 returned -14
[  246.289969] binder: BINDER_SET_CONTEXT_MGR already set
[  246.289977] binder: 2408:2411 ioctl 40046207 0 returned -16
[  246.290156] binder: 2408:2411 ERROR: BC_REGISTER_LOOPER called without request
[  246.290163] binder: 2411 RLIMIT_NICE not set
[  246.314102] binder: 2374:2404 BC_FREE_BUFFER u0000000000000000 no match
2017/12/02 09:23:01 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:01 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[], 0x0}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:01 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:01 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r1, 0x540a, 0x0)
write(r1, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r1, 0x540a, 0x2)
ioctl$TCXONC(r1, 0x540a, 0x1)
[  246.314145] binder: 2374:2404 IncRefs 0 refcount change on invalid ref 1 ret -22
[  246.314156] binder: 2374:2404 got transaction to invalid handle
[  246.314169] binder: 2374:2404 transaction failed 29201/-22, size 0-8 line 2755
[  246.318206] binder_alloc: 2089: binder_alloc_buf, no vma
[  246.318232] binder: 2408:2412 transaction failed 29189/-3, size 0-0 line 2870
2017/12/02 09:23:02 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r2, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x1)
[  246.334539] binder: 2408:2412 ioctl c0306201 20002fd0 returned -14
[  246.349321] binder: BINDER_SET_CONTEXT_MGR already set
[  246.349330] binder: 2415:2419 ioctl 40046207 0 returned -16
[  246.349427] binder: 2415:2419 ERROR: BC_REGISTER_LOOPER called without request
[  246.349437] binder: 2419 RLIMIT_NICE not set
[  246.351176] binder: 2408:2412 ioctl c0306201 20005fd0 returned -14
2017/12/02 09:23:02 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x0, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.352612] binder: 2408:2412 ioctl c018620b 2000dfe8 returned -14
[  246.368417] binder: 2408:2412 ioctl 40046205 0 returned -22
[  246.373954] binder: BINDER_SET_CONTEXT_MGR already set
[  246.373963] binder: 2408:2412 ioctl 40046207 0 returned -16
[  246.373998] binder: 2408:2424 ERROR: BC_REGISTER_LOOPER called without request
[  246.374291] binder: 2424 RLIMIT_NICE not set
[  246.376272] binder_alloc: 2089: binder_alloc_buf, no vma
2017/12/02 09:23:02 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
write(r2, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x2)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, &(0x7f0000006000)=[], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000071f000-0x78)={0x0, 0x78, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xffffffffffff8000, 0x400000000, 0x0, 0x0, 0x2408000000, 0x2, 0x0, 0x0, 0x0, 0x2ba69649, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffffff, 0x1ff, 0xffffffffffffff9c, 0x8)
perf_event_open(&(0x7f00008a8000-0x78)={0x4000000002, 0x78, 0xa2, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000390000)=0x0)
r0 = getpgid(0x0)
gettid()
r1 = getpgrp(r0)
perf_event_open(&(0x7f00006d1000)={0x2, 0x78, 0xc30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f00008ab000-0x8)=0x8000000074)
r2 = memfd_create(&(0x7f0000e5f000-0x3)="405b00", 0x2)
ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0086426, &(0x7f00004ab000)={0x3, &(0x7f00006b6000-0x18)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$sock_int(r3, 0x1, 0x800000008, &(0x7f0000f8f000-0x4)=0x0, 0x4)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xd4e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2001000000000f6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000cc5000)="2e2f66696c653000", 0x10000, 0x0)
r5 = socket(0x11, 0x3, 0x0)
bind(r5, &(0x7f00005a2000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679c00800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c000100000000e9ffff48740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000122000)={{{@in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, @in6=@local={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {{@in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0}, 0x0, @in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f00001a1000)=0xe8)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f00009d5000-0x4)=0x10000, 0x4)
socket$inet(0x2, 0x80a, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0x0})
[  246.376297] binder: 2408:2412 transaction failed 29189/-3, size 0-0 line 2870
[  246.379775] binder: 2408:2412 ioctl c0306201 20002fd0 returned -14
[  246.385742] binder: 2408:2412 BC_FREE_BUFFER uffffffffffffffff no match
[  246.385779] binder: 2408:2412 IncRefs 0 refcount change on invalid ref 1 ret -22
2017/12/02 09:23:02 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x0, 0x10, &(0x7f0000008000)=[], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r2, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x0, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  246.385787] binder: 2408:2412 got transaction to invalid handle
[  246.385798] binder: 2408:2412 transaction failed 29201/-22, size 0-8 line 2755
[  246.385818] binder: 2408:2412 ioctl c0306201 20005fd0 returned -14
[  246.385854] binder: 2408:2424 ioctl c018620b 2000dfe8 returned -14
[  246.386208] binder_alloc: 2086: binder_alloc_buf, no vma
[  246.386236] binder: 2415:2429 transaction failed 29189/-3, size 0-0 line 2870
2017/12/02 09:23:02 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
close(0xffffffffffffffff)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r2=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r2}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f000000e000-0x18)={r1, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.403702] binder: 2415:2429 ioctl c0306201 20002fd0 returned -14
[  246.428264] binder: 2415:2429 ioctl c018620b 2000dfe8 returned -14
[  246.458876] binder: 2415:2429 ioctl 40046205 0 returned -22
[  246.464959] binder: BINDER_SET_CONTEXT_MGR already set
[  246.464967] binder: 2435:2437 ioctl 40046207 0 returned -16
[  246.465172] binder: 2435:2437 ERROR: BC_REGISTER_LOOPER called without request
2017/12/02 09:23:02 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x1080003)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  246.465183] binder: 2437 RLIMIT_NICE not set
[  246.470819] binder: BINDER_SET_CONTEXT_MGR already set
[  246.470829] binder: 2415:2429 ioctl 40046207 0 returned -16
[  246.470863] binder: 2415:2439 ERROR: BC_REGISTER_LOOPER called without request
[  246.470872] binder: 2439 RLIMIT_NICE not set
[  246.473525] binder_alloc: 2086: binder_alloc_buf, no vma
[  246.473550] binder: 2415:2429 transaction failed 29189/-3, size 0-0 line 2870
[  246.477624] binder: 2415:2429 ioctl c0306201 20002fd0 returned -14
2017/12/02 09:23:02 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x10, 0x1a, 0x11, 0x0, 0x0, ""}], 0x10}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:02 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x0, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  246.483926] binder: 2415:2439 BC_FREE_BUFFER u0000000000000000 no match
[  246.483959] binder: 2415:2439 IncRefs 0 refcount change on invalid ref 1 ret -22
[  246.483967] binder: 2415:2439 got transaction to invalid handle
[  246.483977] binder: 2415:2439 transaction failed 29201/-22, size 0-8 line 2755
2017/12/02 09:23:02 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.499830] binder_alloc: 2089: binder_alloc_buf, no vma
[  246.499860] binder: 2435:2450 transaction failed 29189/-3, size 0-0 line 2870
[  246.510252] binder: 2435:2450 ioctl c0306201 20002fd0 returned -14
[  246.512202] binder: 2435:2450 ioctl c0306201 2000afd0 returned -14
[  246.513216] binder: BINDER_SET_CONTEXT_MGR already set
[  246.513225] binder: 2452:2453 ioctl 40046207 0 returned -16
2017/12/02 09:23:02 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
syz_open_dev$usbmon(&(0x7f00001c7000-0xd)="2f6465762f7573626d6f6e2300", 0x0, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x2)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000b2a000)={0xffffffffffffffff, &(0x7f0000a82000)="3b", &(0x7f0000adb000)=""}, 0x18)
ioctl$TCXONC(r2, 0x540a, 0x1)
ioctl$TCXONC(r2, 0x540a, 0x0)
syz_open_dev$loop(&(0x7f0000851000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x200)
2017/12/02 09:23:02 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  246.513421] binder: 2452:2453 ERROR: BC_REGISTER_LOOPER called without request
[  246.513430] binder: 2453 RLIMIT_NICE not set
[  246.532758] binder: 2435:2450 ioctl c0306201 20005fd0 returned -14
[  246.541571] binder: 2435:2450 ioctl c018620b 2000dfe8 returned -14
[  246.548461] binder_alloc: 2086: binder_alloc_buf, no vma
2017/12/02 09:23:02 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x0, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x13, 0x1a, 0x11, 0x0, 0x0, "0a0404"}], 0x13}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:02 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.548490] binder: 2452:2461 transaction failed 29189/-3, size 0-0 line 2870
[  246.572947] binder: 2452:2461 ioctl c0306201 20002fd0 returned -14
[  246.573058] binder: 2435:2450 ioctl 40046205 0 returned -22
[  246.580150] binder: BINDER_SET_CONTEXT_MGR already set
[  246.580160] binder: 2435:2450 ioctl 40046207 0 returned -16
2017/12/02 09:23:02 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x1080003)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(0xffffffffffffffff)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.580197] binder: 2435:2463 ERROR: BC_REGISTER_LOOPER called without request
[  246.580205] binder: 2463 RLIMIT_NICE not set
[  246.582133] binder_alloc: 2089: binder_alloc_buf, no vma
[  246.582159] binder: 2435:2450 transaction failed 29189/-3, size 0-0 line 2870
[  246.585454] binder: 2435:2450 ioctl c0306201 20002fd0 returned -14
[  246.585486] binder: 2435:2463 ioctl c0306201 2000afd0 returned -14
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.592456] binder: 2435:2450 ioctl c0306201 20005fd0 returned -14
[  246.592488] binder: 2435:2463 ioctl c018620b 2000dfe8 returned -14
[  246.593952] binder: 2452:2461 ioctl c018620b 2000dfe8 returned -14
[  246.608882] binder: 2452:2461 ioctl 40046205 0 returned -22
[  246.637857] binder: BINDER_SET_CONTEXT_MGR already set
[  246.637868] binder: 2452:2461 ioctl 40046207 0 returned -16
[  246.638899] binder: 2452:2471 ERROR: BC_REGISTER_LOOPER called without request
[  246.638908] binder: 2471 RLIMIT_NICE not set
2017/12/02 09:23:02 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x14, 0x1a, 0x11, 0x0, 0x0, "0a040408"}], 0x14}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:02 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
syz_open_dev$usbmon(&(0x7f00001c7000-0xd)="2f6465762f7573626d6f6e2300", 0x0, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x2)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000b2a000)={0xffffffffffffffff, &(0x7f0000a82000)="3b", &(0x7f0000adb000)=""}, 0x18)
ioctl$TCXONC(r2, 0x540a, 0x1)
ioctl$TCXONC(r2, 0x540a, 0x0)
syz_open_dev$loop(&(0x7f0000851000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x200)
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(0xffffffffffffffff, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x0}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  246.640150] binder_alloc: 2086: binder_alloc_buf, no vma
[  246.640176] binder: 2452:2461 transaction failed 29189/-3, size 0-0 line 2870
[  246.643923] binder: 2452:2461 ioctl c0306201 20002fd0 returned -14
[  246.650195] binder: 2452:2471 BC_FREE_BUFFER u0000000000000000 no match
[  246.650227] binder: 2452:2471 IncRefs 0 refcount change on invalid ref 1 ret -22
2017/12/02 09:23:02 executing program 6:
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.650235] binder: 2452:2471 got transaction to invalid handle
[  246.650246] binder: 2452:2471 transaction failed 29201/-22, size 0-8 line 2755
[  246.655514] binder: BINDER_SET_CONTEXT_MGR already set
[  246.655523] binder: 2473:2475 ioctl 40046207 0 returned -16
[  246.671369] binder: 2473:2475 ERROR: BC_REGISTER_LOOPER called without request
[  246.671379] binder: 2475 RLIMIT_NICE not set
2017/12/02 09:23:02 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="", 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 3:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x1080003)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.682694] binder_alloc: 2089: binder_alloc_buf, no vma
[  246.682720] binder: 2473:2484 transaction failed 29189/-3, size 0-0 line 2870
[  246.698276] binder: BINDER_SET_CONTEXT_MGR already set
[  246.698285] binder: 2479:2481 ioctl 40046207 0 returned -16
2017/12/02 09:23:02 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
syz_open_dev$usbmon(&(0x7f00001c7000-0xd)="2f6465762f7573626d6f6e2300", 0x0, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x2)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000b2a000)={0xffffffffffffffff, &(0x7f0000a82000)="3b", &(0x7f0000adb000)=""}, 0x18)
ioctl$TCXONC(r2, 0x540a, 0x1)
ioctl$TCXONC(r2, 0x540a, 0x0)
syz_open_dev$loop(&(0x7f0000851000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x200)
2017/12/02 09:23:02 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x10, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.698373] binder: 2479:2481 ERROR: BC_REGISTER_LOOPER called without request
[  246.698381] binder: 2481 RLIMIT_NICE not set
[  246.723337] binder: 2473:2484 ioctl c0306201 20005fd0 returned -14
[  246.724895] binder: 2473:2484 ioctl c018620b 2000dfe8 returned -14
[  246.731168] binder_alloc: 2086: binder_alloc_buf, no vma
2017/12/02 09:23:02 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x1080003)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:02 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x0, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.731193] binder: 2479:2495 transaction failed 29189/-3, size 0-0 line 2870
[  246.740299] binder: 2479:2495 ioctl c0306201 20002fd0 returned -14
[  246.746843] binder: 2473:2484 ioctl 40046205 0 returned -22
[  246.755643] binder: 2479:2495 ioctl c018620b 2000dfe8 returned -14
[  246.757224] binder: BINDER_SET_CONTEXT_MGR already set
[  246.757232] binder: 2473:2484 ioctl 40046207 0 returned -16
2017/12/02 09:23:02 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x1080003)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.757723] binder: 2473:2498 ERROR: BC_REGISTER_LOOPER called without request
[  246.757732] binder: 2498 RLIMIT_NICE not set
[  246.758946] binder_alloc: 2089: binder_alloc_buf, no vma
[  246.758972] binder: 2473:2484 transaction failed 29189/-3, size 0-0 line 2870
[  246.768213] binder: 2473:2484 BC_FREE_BUFFER uffffffffffffffff no match
[  246.768249] binder: 2473:2484 IncRefs 0 refcount change on invalid ref 1 ret -22
2017/12/02 09:23:02 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1)
2017/12/02 09:23:02 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
syz_open_dev$usbmon(&(0x7f00001c7000-0xd)="2f6465762f7573626d6f6e2300", 0x0, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x2)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000b2a000)={0xffffffffffffffff, &(0x7f0000a82000)="3b", &(0x7f0000adb000)=""}, 0x18)
ioctl$TCXONC(r2, 0x540a, 0x1)
ioctl$TCXONC(r2, 0x540a, 0x0)
syz_open_dev$loop(&(0x7f0000851000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x200)
[  246.768260] binder: 2473:2484 got transaction to invalid handle
[  246.768271] binder: 2473:2484 transaction failed 29201/-22, size 0-8 line 2755
[  246.768291] binder: 2473:2484 ioctl c0306201 20005fd0 returned -14
[  246.768464] binder: 2473:2498 ioctl c018620b 2000dfe8 returned -14
[  246.789143] binder: 2479:2495 ioctl 40046205 0 returned -22
[  246.799041] binder: BINDER_SET_CONTEXT_MGR already set
[  246.799051] binder: 2479:2495 ioctl 40046207 0 returned -16
2017/12/02 09:23:02 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x0, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:02 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x0, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:02 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
r1 = epoll_create1(0x1080003)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r2=>0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r2}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
[  246.799090] binder: 2479:2504 ERROR: BC_REGISTER_LOOPER called without request
[  246.799099] binder: 2504 RLIMIT_NICE not set
[  246.800648] binder_alloc: 2086: binder_alloc_buf, no vma
[  246.800677] binder: 2479:2495 transaction failed 29189/-3, size 0-0 line 2870
[  246.802742] binder: BINDER_SET_CONTEXT_MGR already set
[  246.802751] binder: 2506:2509 ioctl 40046207 0 returned -16
2017/12/02 09:23:03 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x0)
2017/12/02 09:23:03 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.802870] binder: 2506:2509 ERROR: BC_REGISTER_LOOPER called without request
[  246.802880] binder: 2509 RLIMIT_NICE not set
[  246.804236] binder: 2479:2495 ioctl c0306201 20002fd0 returned -14
[  246.813379] binder: 2479:2504 BC_FREE_BUFFER u0000000000000000 no match
[  246.813413] binder: 2479:2504 IncRefs 0 refcount change on invalid ref 1 ret -22
[  246.813422] binder: 2479:2504 got transaction to invalid handle
2017/12/02 09:23:03 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:03 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:03 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  246.813434] binder: 2479:2504 transaction failed 29201/-22, size 0-8 line 2755
[  246.856396] binder_alloc: 2089: binder_alloc_buf, no vma
[  246.856430] binder: 2506:2520 transaction failed 29189/-3, size 0-0 line 2870
[  246.863928] binder: BINDER_SET_CONTEXT_MGR already set
[  246.863937] binder: 2516:2518 ioctl 40046207 0 returned -16
[  246.864063] binder: 2516:2518 ERROR: BC_REGISTER_LOOPER called without request
[  246.864072] binder: 2518 RLIMIT_NICE not set
2017/12/02 09:23:03 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x10, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:03 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
syz_open_dev$usbmon(&(0x7f00001c7000-0xd)="2f6465762f7573626d6f6e2300", 0x0, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x2)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000b2a000)={0xffffffffffffffff, &(0x7f0000a82000)="3b", &(0x7f0000adb000)=""}, 0x18)
ioctl$TCXONC(r2, 0x540a, 0x1)
ioctl$TCXONC(r2, 0x540a, 0x0)
2017/12/02 09:23:03 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  246.865696] binder: 2506:2520 ioctl c0306201 20002fd0 returned -14
[  246.886648] binder: 2506:2520 ioctl c0306201 20005fd0 returned -14
[  246.887236] binder_alloc: 2086: binder_alloc_buf, no vma
[  246.887267] binder: 2516:2525 transaction failed 29189/-3, size 0-0 line 2870
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
2017/12/02 09:23:03 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x0, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  246.887941] binder: 2506:2520 ioctl c018620b 2000dfe8 returned -14
[  246.912914] binder: 2506:2520 ioctl 40046205 0 returned -22
[  246.916172] binder: 2516:2525 ioctl c0306201 20002fd0 returned -14
[  246.921754] binder: BINDER_SET_CONTEXT_MGR already set
[  246.921763] binder: 2506:2520 ioctl 40046207 0 returned -16
[  246.926249] binder: 2506:2528 ERROR: BC_REGISTER_LOOPER called without request
[  246.926260] binder: 2528 RLIMIT_NICE not set
2017/12/02 09:23:03 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:03 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  246.928057] binder_alloc: 2089: binder_alloc_buf, no vma
[  246.928084] binder: 2506:2520 transaction failed 29189/-3, size 0-0 line 2870
[  246.929811] binder: 2506:2528 ioctl c0306201 20002fd0 returned -14
[  246.938794] binder: 2506:2520 BC_FREE_BUFFER uffffffffffffffff no match
[  246.938826] binder: 2506:2520 IncRefs 0 refcount change on invalid ref 1 ret -22
[  246.938835] binder: 2506:2520 got transaction to invalid handle
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
2017/12/02 09:23:03 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x0, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  246.938845] binder: 2506:2520 transaction failed 29201/-22, size 0-8 line 2755
[  246.938862] binder: 2506:2520 ioctl c0306201 20005fd0 returned -14
[  246.938894] binder: 2506:2528 ioctl c018620b 2000dfe8 returned -14
[  246.939083] binder: 2516:2525 ioctl c018620b 2000dfe8 returned -14
[  246.964865] binder: 2516:2525 ioctl 40046205 0 returned -22
2017/12/02 09:23:03 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:03 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
syz_open_dev$usbmon(&(0x7f00001c7000-0xd)="2f6465762f7573626d6f6e2300", 0x0, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x2)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000b2a000)={0xffffffffffffffff, &(0x7f0000a82000)="3b", &(0x7f0000adb000)=""}, 0x18)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x0, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  246.978541] binder: BINDER_SET_CONTEXT_MGR already set
[  246.978553] binder: 2516:2525 ioctl 40046207 0 returned -16
[  246.978702] binder: 2516:2538 ERROR: BC_REGISTER_LOOPER called without request
[  246.978716] binder: 2538 RLIMIT_NICE not set
2017/12/02 09:23:03 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  246.979938] binder_alloc: 2086: binder_alloc_buf, no vma
[  246.979962] binder: 2516:2525 transaction failed 29189/-3, size 0-0 line 2870
[  246.983136] binder: 2516:2525 ioctl c0306201 20002fd0 returned -14
[  246.988298] binder: 2516:2538 BC_FREE_BUFFER u0000000000000000 no match
[  246.988337] binder: 2516:2538 IncRefs 0 refcount change on invalid ref 1 ret -22
[  246.988348] binder: 2516:2538 got transaction to invalid handle
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
2017/12/02 09:23:03 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  246.988359] binder: 2516:2538 transaction failed 29201/-22, size 0-8 line 2755
[  247.007948] binder: BINDER_SET_CONTEXT_MGR already set
[  247.007957] binder: 2545:2549 ioctl 40046207 0 returned -16
[  247.008114] binder: 2545:2549 ERROR: BC_REGISTER_LOOPER called without request
[  247.008121] binder: 2549 RLIMIT_NICE not set
2017/12/02 09:23:03 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x0, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:03 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x10, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:03 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:03 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
syz_open_dev$usbmon(&(0x7f00001c7000-0xd)="2f6465762f7573626d6f6e2300", 0x0, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x2)
ioctl$TCXONC(r2, 0x540a, 0x1)
[  247.013650] binder: BINDER_SET_CONTEXT_MGR already set
[  247.013658] binder: 2552:2553 ioctl 40046207 0 returned -16
[  247.017741] binder: 2552:2553 ERROR: BC_REGISTER_LOOPER called without request
[  247.017752] binder: 2553 RLIMIT_NICE not set
[  247.032077] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.032108] binder: 2545:2559 transaction failed 29189/-3, size 0-0 line 2870
2017/12/02 09:23:03 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
2017/12/02 09:23:03 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.046387] binder_alloc: 2086: binder_alloc_buf, no vma
[  247.046412] binder: 2552:2561 transaction failed 29189/-3, size 0-0 line 2870
[  247.053685] binder: 2545:2559 ioctl c0306201 20002fd0 returned -14
[  247.064850] binder: 2552:2561 ioctl c0306201 20002fd0 returned -14
2017/12/02 09:23:03 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
[  247.089619] binder: 2545:2559 ioctl c0306201 20005fd0 returned -14
[  247.089666] binder: 2552:2561 ioctl c018620b 2000dfe8 returned -14
[  247.091169] binder: 2545:2559 ioctl c018620b 2000dfe8 returned -14
[  247.108038] binder: 2552:2561 ioctl 40046205 0 returned -22
[  247.113161] binder: 2545:2559 ioctl 40046205 0 returned -22
[  247.127224] binder: BINDER_SET_CONTEXT_MGR already set
2017/12/02 09:23:03 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:03 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
[  247.127235] binder: 2545:2559 ioctl 40046207 0 returned -16
[  247.127293] binder: 2545:2575 ERROR: BC_REGISTER_LOOPER called without request
[  247.127303] binder: 2575 RLIMIT_NICE not set
[  247.133943] binder: BINDER_SET_CONTEXT_MGR already set
[  247.133954] binder: 2552:2561 ioctl 40046207 0 returned -16
[  247.134209] binder: 2552:2574 ERROR: BC_REGISTER_LOOPER called without request
2017/12/02 09:23:03 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
syz_open_dev$usbmon(&(0x7f00001c7000-0xd)="2f6465762f7573626d6f6e2300", 0x0, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x0]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:03 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:03 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.134218] binder: 2574 RLIMIT_NICE not set
[  247.135464] binder_alloc: 2086: binder_alloc_buf, no vma
[  247.135494] binder: 2552:2561 transaction failed 29189/-3, size 0-0 line 2870
[  247.135935] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.135962] binder: 2545:2559 transaction failed 29189/-3, size 0-0 line 2870
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
2017/12/02 09:23:03 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x2, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.138871] binder: 2552:2561 ioctl c0306201 20002fd0 returned -14
[  247.146998] binder: 2545:2575 ioctl c0306201 20002fd0 returned -14
[  247.150791] binder: 2552:2574 BC_FREE_BUFFER u0000000000000000 no match
[  247.150826] binder: 2552:2574 IncRefs 0 refcount change on invalid ref 1 ret -22
2017/12/02 09:23:03 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:03 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0x0, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:03 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
[  247.150836] binder: 2552:2574 got transaction to invalid handle
[  247.150848] binder: 2552:2574 transaction failed 29201/-22, size 0-8 line 2755
[  247.176717] binder: 2545:2559 BC_FREE_BUFFER uffffffffffffffff no match
[  247.176751] binder: 2545:2559 IncRefs 0 refcount change on invalid ref 1 ret -22
[  247.176761] binder: 2545:2559 got transaction to invalid handle
[  247.176775] binder: 2545:2559 transaction failed 29201/-22, size 0-8 line 2755
[  247.176805] binder: 2545:2559 ioctl c0306201 20005fd0 returned -14
2017/12/02 09:23:03 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x0, 0x0, &(0x7f0000004000-0x18)=[], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:03 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0x0, 0x0, &(0x7f0000010000-0xeb)=""})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.182176] binder: 2545:2575 ioctl c018620b 2000dfe8 returned -14
[  247.195392] binder: BINDER_SET_CONTEXT_MGR already set
[  247.195401] binder: 2578:2580 ioctl 40046207 0 returned -16
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
2017/12/02 09:23:03 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:03 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x42, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.195509] binder: 2578:2580 ERROR: BC_REGISTER_LOOPER called without request
[  247.195518] binder: 2580 RLIMIT_NICE not set
[  247.215955] binder: BINDER_SET_CONTEXT_MGR already set
[  247.215964] binder: 2585:2587 ioctl 40046207 0 returned -16
[  247.216087] binder: 2585:2587 ERROR: BC_REGISTER_LOOPER called without request
[  247.216097] binder: 2587 RLIMIT_NICE not set
2017/12/02 09:23:03 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x0})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
2017/12/02 09:23:03 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:03 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
[  247.221867] binder_alloc: 2086: binder_alloc_buf, no vma
[  247.221893] binder: 2578:2591 transaction failed 29189/-3, size 0-0 line 2870
[  247.245937] binder: 2578:2591 ioctl c0306201 20002fd0 returned -14
[  247.265933] binder: 2578:2591 ioctl c018620b 2000dfe8 returned -14
[  247.272935] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.272963] binder: 2585:2596 transaction failed 29189/-3, size 0-0 line 2870
[  247.285708] binder: 2578:2591 ioctl 40046205 0 returned -22
2017/12/02 09:23:03 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
2017/12/02 09:23:04 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x0, 0x0, &(0x7f0000009000)=""})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r2, 0x540a, 0x1)
[  247.291130] binder: 2585:2596 ioctl c0306201 20002fd0 returned -14
[  247.305060] binder: 2585:2596 ioctl c0306201 20005fd0 returned -14
[  247.305132] binder: BINDER_SET_CONTEXT_MGR already set
[  247.305142] binder: 2578:2591 ioctl 40046207 0 returned -16
[  247.306634] binder: 2585:2596 ioctl c018620b 2000dfe8 returned -14
2017/12/02 09:23:04 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(0xffffffffffffffff, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:04 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0x76, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
[  247.308093] binder: 2578:2607 ERROR: BC_REGISTER_LOOPER called without request
[  247.308105] binder: 2607 RLIMIT_NICE not set
[  247.309341] binder_alloc: 2086: binder_alloc_buf, no vma
[  247.309368] binder: 2578:2591 transaction failed 29189/-3, size 0-0 line 2870
2017/12/02 09:23:04 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x24, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade69"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x2, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
[  247.318465] binder: 2578:2591 ioctl c0306201 20002fd0 returned -14
[  247.322389] binder: 2585:2596 ioctl 40046205 0 returned -22
[  247.331881] binder: 2585:2604 ERROR: BC_REGISTER_LOOPER called without request
[  247.331891] binder: 2604 RLIMIT_NICE not set
[  247.331943] binder: BINDER_SET_CONTEXT_MGR already set
[  247.331952] binder: 2585:2596 ioctl 40046207 0 returned -16
[  247.333154] binder_alloc: 2089: binder_alloc_buf, no vma
2017/12/02 09:23:04 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x0, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:04 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
[  247.333178] binder: 2585:2596 transaction failed 29189/-3, size 0-0 line 2870
[  247.334986] binder: 2585:2604 ioctl c0306201 20002fd0 returned -14
[  247.341965] binder: 2578:2607 BC_FREE_BUFFER u0000000000000000 no match
[  247.342006] binder: 2578:2607 IncRefs 0 refcount change on invalid ref 1 ret -22
[  247.342053] binder: 2578:2607 got transaction to invalid handle
[  247.342066] binder: 2578:2607 transaction failed 29201/-22, size 0-8 line 2755
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
gettid()
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
[  247.345263] binder: 2585:2596 BC_FREE_BUFFER uffffffffffffffff no match
[  247.345295] binder: 2585:2596 IncRefs 0 refcount change on invalid ref 1 ret -22
[  247.345308] binder: 2585:2596 got transaction to invalid handle
[  247.345318] binder: 2585:2596 transaction failed 29201/-22, size 0-8 line 2755
[  247.345335] binder: 2585:2596 ioctl c0306201 20005fd0 returned -14
[  247.345367] binder: 2585:2604 ioctl c018620b 2000dfe8 returned -14
2017/12/02 09:23:04 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
2017/12/02 09:23:04 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x36, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d856"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.389427] binder: BINDER_SET_CONTEXT_MGR already set
[  247.389436] binder: 2624:2625 ioctl 40046207 0 returned -16
[  247.389518] binder: 2624:2625 ERROR: BC_REGISTER_LOOPER called without request
[  247.389526] binder: 2625 RLIMIT_NICE not set
[  247.392641] binder: BINDER_SET_CONTEXT_MGR already set
[  247.392650] binder: 2619:2622 ioctl 40046207 0 returned -16
2017/12/02 09:23:04 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xb1, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
2017/12/02 09:23:04 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x0, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
[  247.392747] binder: 2619:2622 ERROR: BC_REGISTER_LOOPER called without request
[  247.392755] binder: 2622 RLIMIT_NICE not set
[  247.419759] binder: 2624:2632 ioctl c0306201 20002fd0 returned -14
[  247.422866] binder_alloc: 2086: binder_alloc_buf, no vma
[  247.422892] binder: 2619:2633 transaction failed 29189/-3, size 0-0 line 2870
[  247.433099] binder: 2624:2632 got reply transaction with no transaction stack
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0x76, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.433109] binder: 2624:2632 transaction failed 29201/-71, size 24-8 line 2670
[  247.448005] binder: 2624:2632 ioctl c0306201 20005fd0 returned -14
[  247.449498] binder: 2624:2632 ioctl c018620b 2000dfe8 returned -14
[  247.451531] binder: 2619:2633 ioctl c0306201 20002fd0 returned -14
[  247.478056] binder: 2624:2632 ioctl 40046205 0 returned -22
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:04 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x3f, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b251"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  247.484779] binder: 2619:2633 ioctl c018620b 2000dfe8 returned -14
[  247.495913] binder: BINDER_SET_CONTEXT_MGR already set
[  247.495921] binder: 2624:2632 ioctl 40046207 0 returned -16
[  247.495964] binder: 2624:2640 ERROR: BC_REGISTER_LOOPER called without request
[  247.495984] binder: 2640 RLIMIT_NICE not set
[  247.504084] binder: 2624:2640 ioctl c0306201 20002fd0 returned -14
2017/12/02 09:23:04 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xce, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da2"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0x76, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
[  247.510832] binder: 2624:2632 BC_FREE_BUFFER uffffffffffffffff no match
[  247.510867] binder: 2624:2632 IncRefs 0 refcount change on invalid ref 1 ret -22
[  247.510877] binder: 2624:2632 got transaction to invalid handle
[  247.510888] binder: 2624:2632 transaction failed 29201/-22, size 0-8 line 2755
[  247.510907] binder: 2624:2632 ioctl c0306201 20005fd0 returned -14
2017/12/02 09:23:04 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x44, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.510943] binder: 2624:2640 ioctl c018620b 2000dfe8 returned -14
[  247.520588] binder: 2619:2633 ioctl 40046205 0 returned -22
[  247.538640] binder: BINDER_SET_CONTEXT_MGR already set
[  247.538653] binder: 2619:2633 ioctl 40046207 0 returned -16
[  247.538693] binder: 2619:2646 ERROR: BC_REGISTER_LOOPER called without request
[  247.538702] binder: 2646 RLIMIT_NICE not set
2017/12/02 09:23:04 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(0xffffffffffffffff, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {0xffffffffffffffff, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:04 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x0, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  247.540281] binder_alloc: 2086: binder_alloc_buf, no vma
[  247.540317] binder: 2619:2633 transaction failed 29189/-3, size 0-0 line 2870
[  247.543839] binder: 2619:2633 ioctl c0306201 20002fd0 returned -14
[  247.557507] binder: 2619:2646 BC_FREE_BUFFER u0000000000000000 no match
[  247.557545] binder: 2619:2646 IncRefs 0 refcount change on invalid ref 1 ret -22
[  247.557557] binder: 2619:2646 got transaction to invalid handle
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0x76, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.557597] binder: 2619:2646 transaction failed 29201/-22, size 0-8 line 2755
[  247.575573] binder: BINDER_SET_CONTEXT_MGR already set
[  247.575581] binder: 2652:2654 ioctl 40046207 0 returned -16
[  247.575736] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.575763] binder: 2652:2654 transaction failed 29189/-3, size 0-0 line 2870
[  247.576808] binder: 2652:2654 ioctl c0306201 20002fd0 returned -14
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:04 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xdd, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x46, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8c"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.577951] binder: 2652:2654 ioctl c0306201 20005fd0 returned -14
[  247.578271] binder: 2652:2654 ioctl c018620b 2000dfe8 returned -14
[  247.580120] binder: 2652:2654 ioctl 40046205 0 returned -22
[  247.580772] binder: BINDER_SET_CONTEXT_MGR already set
[  247.580779] binder: 2652:2654 ioctl 40046207 0 returned -16
2017/12/02 09:23:04 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(0xffffffffffffffff, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:04 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="", 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.580867] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.580937] binder: 2652:2654 transaction failed 29189/-3, size 0-0 line 2870
[  247.581804] binder: 2652:2654 ioctl c0306201 20002fd0 returned -14
[  247.582683] binder: 2652:2654 BC_FREE_BUFFER uffffffffffffffff no match
[  247.582713] binder: 2652:2654 IncRefs 0 refcount change on invalid ref 1 ret -22
2017/12/02 09:23:04 executing program 1:
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:04 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 1:
clock_gettime(0x0, &(0x7f00004eb000-0x8)={0x0, 0x0})
[  247.582721] binder: 2652:2654 got transaction to invalid handle
[  247.582729] binder: 2652:2654 transaction failed 29201/-22, size 0-8 line 2755
[  247.582745] binder: 2652:2654 ioctl c0306201 20005fd0 returned -14
[  247.582896] binder: 2652:2654 ioctl c018620b 2000dfe8 returned -14
[  247.605753] binder: BINDER_SET_CONTEXT_MGR already set
[  247.605763] binder: 2660:2663 ioctl 40046207 0 returned -16
2017/12/02 09:23:04 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r2, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0x76, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xe4, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(0xffffffffffffffff, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="", 0x0, 0x20000000, 0x0)
[  247.608714] binder: 2666:2667 ERROR: BC_REGISTER_LOOPER called without request
[  247.608726] binder: 2667 RLIMIT_NICE not set
[  247.608894] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.608909] binder: 2660:2663 ERROR: BC_REGISTER_LOOPER called without request
2017/12/02 09:23:04 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x47, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:04 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.608919] binder: 2666:2667 transaction failed 29189/-3, size 0-0 line 2870
[  247.608921] binder: 2663 RLIMIT_NICE not set
[  247.610774] binder: 2666:2667 ioctl c0306201 20002fd0 returned -14
[  247.611653] binder: 2666:2667 ioctl c0306201 20005fd0 returned -14
[  247.611812] binder: 2666:2667 ioctl c018620b 2000dfe8 returned -14
[  247.613890] binder: 2666:2667 ioctl 40046205 0 returned -22
[  247.619853] binder: 2666:2667 ERROR: BC_REGISTER_LOOPER called without request
2017/12/02 09:23:04 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:04 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="000000000000000000000000000000", 0xf, 0x20000000, 0x0)
[  247.619862] binder: 2667 RLIMIT_NICE not set
[  247.619935] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.619957] binder: 2666:2668 transaction failed 29189/-3, size 0-0 line 2870
[  247.636325] binder: 2666:2671 ioctl c0306201 20002fd0 returned -14
[  247.661457] binder_alloc: 2086: binder_alloc_buf, no vma
[  247.661485] binder: 2660:2673 transaction failed 29189/-3, size 0-0 line 2870
2017/12/02 09:23:04 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0x76, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785"})
2017/12/02 09:23:04 executing program 1:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x24, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade69"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.665605] binder: 2666:2668 BC_FREE_BUFFER uffffffffffffffff no match
[  247.665641] binder: 2666:2668 IncRefs 0 refcount change on invalid ref 1 ret -22
[  247.665652] binder: 2666:2668 got transaction to invalid handle
[  247.665665] binder: 2666:2668 transaction failed 29201/-22, size 0-8 line 2755
[  247.665686] binder: 2666:2668 ioctl c0306201 20005fd0 returned -14
[  247.665728] binder: 2666:2671 ioctl c018620b 2000dfe8 returned -14
2017/12/02 09:23:05 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="00000000000000000000000000000000000000000000", 0x16, 0x20000000, 0x0)
[  247.678190] binder: 2660:2673 ioctl c0306201 20002fd0 returned -14
[  247.698616] binder: 2660:2673 ioctl c018620b 2000dfe8 returned -14
[  247.713181] binder: BINDER_SET_CONTEXT_MGR already set
[  247.713188] binder: 2684:2688 ioctl 40046207 0 returned -16
[  247.713277] binder: 2684:2688 ERROR: BC_REGISTER_LOOPER called without request
[  247.713293] binder: 2684:2688 ioctl c0306201 20008fd0 returned -14
2017/12/02 09:23:05 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xe8, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:05 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.713715] binder: 2660:2673 ioctl 40046205 0 returned -22
[  247.720171] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.720195] binder: 2684:2688 transaction failed 29189/-3, size 0-0 line 2870
[  247.724156] binder: 2684:2688 ioctl c0306201 20002fd0 returned -14
[  247.725131] binder: 2684:2688 ioctl c0306201 20005fd0 returned -14
2017/12/02 09:23:05 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000", 0x1a, 0x20000000, 0x0)
2017/12/02 09:23:05 executing program 5:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000006000-0x2c)=[], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.725258] binder: BINDER_SET_CONTEXT_MGR already set
[  247.725266] binder: 2660:2673 ioctl 40046207 0 returned -16
[  247.725284] binder: 2684:2688 ioctl c018620b 2000dfe8 returned -14
[  247.725331] binder: 2660:2676 ERROR: BC_REGISTER_LOOPER called without request
[  247.725340] binder: 2676 RLIMIT_NICE not set
[  247.726803] binder_alloc: 2086: binder_alloc_buf, no vma
2017/12/02 09:23:05 executing program 1:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0x76, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785"})
2017/12/02 09:23:05 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.726824] binder: 2660:2673 transaction failed 29189/-3, size 0-0 line 2870
[  247.731813] binder: 2684:2688 ioctl 40046205 0 returned -22
[  247.734519] binder: 2660:2673 unknown command 0
[  247.734527] binder: 2660:2673 ioctl c0306201 20002fd0 returned -22
[  247.747223] binder: 2660:2676 BC_FREE_BUFFER u0000000000000000 no match
[  247.747262] binder: 2660:2676 IncRefs 0 refcount change on invalid ref 1 ret -22
2017/12/02 09:23:05 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="00000000000000000000000000000000000000000000000000000000", 0x1c, 0x20000000, 0x0)
2017/12/02 09:23:05 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xea, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.747279] binder: 2660:2676 got transaction to invalid handle
[  247.747291] binder: 2660:2676 transaction failed 29201/-22, size 0-8 line 2755
[  247.750686] binder: BINDER_SET_CONTEXT_MGR already set
[  247.750696] binder: 2684:2693 ioctl 40046207 0 returned -16
[  247.751944] binder: 2684:2688 ERROR: BC_REGISTER_LOOPER called without request
[  247.751962] binder: 2684:2688 ioctl c0306201 20008fd0 returned -14
2017/12/02 09:23:05 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 1:
mmap(&(0x7f0000001000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
[  247.752075] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.752100] binder: 2684:2693 transaction failed 29189/-3, size 0-0 line 2870
[  247.756066] binder: 2684:2693 ioctl c0306201 20002fd0 returned -14
[  247.768728] binder: 2684:2688 BC_FREE_BUFFER uffffffffffffffff no match
[  247.768766] binder: 2684:2688 IncRefs 0 refcount change on invalid ref 1 ret -22
[  247.768784] binder: 2684:2688 got transaction to invalid handle
2017/12/02 09:23:05 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x15, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x15}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x0, 0x0)
2017/12/02 09:23:05 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, 0x0})
2017/12/02 09:23:05 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.768796] binder: 2684:2688 transaction failed 29201/-22, size 0-8 line 2755
[  247.768814] binder: 2684:2688 ioctl c0306201 20005fd0 returned -14
[  247.768849] binder: 2684:2693 ioctl c018620b 2000dfe8 returned -14
[  247.808334] binder: BINDER_SET_CONTEXT_MGR already set
[  247.808343] binder: 2705:2707 ioctl 40046207 0 returned -16
[  247.808453] binder: 2705:2707 ERROR: BC_REGISTER_LOOPER called without request
2017/12/02 09:23:05 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x3, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.808462] binder: 2707 RLIMIT_NICE not set
[  247.808794] binder: BINDER_SET_CONTEXT_MGR already set
[  247.808804] binder: 2699:2703 ioctl 40046207 0 returned -16
[  247.808909] binder: 2699:2703 ERROR: BC_REGISTER_LOOPER called without request
[  247.808916] binder: 2703 RLIMIT_NICE not set
[  247.837202] binder_alloc: 2086: binder_alloc_buf, no vma
2017/12/02 09:23:05 executing program 1:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x0}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 0:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.837228] binder: 2699:2711 transaction failed 29189/-3, size 0-0 line 2870
[  247.842908] binder: 2699:2711 ioctl c0306201 20002fd0 returned -14
[  247.852925] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.852952] binder: 2705:2712 transaction failed 29189/-3, size 0-0 line 2870
[  247.861949] binder: 2705:2712 ioctl c0306201 20002fd0 returned -14
[  247.862220] binder: 2699:2711 ioctl c018620b 2000dfe8 returned -14
2017/12/02 09:23:05 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0xdf1})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x2, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  247.873036] binder: 2705:2712 ioctl c0306201 20005fd0 returned -14
[  247.874469] binder: 2705:2712 ioctl c018620b 2000dfe8 returned -14
[  247.875207] binder: 2699:2711 ioctl 40046205 0 returned -22
[  247.889902] binder: BINDER_SET_CONTEXT_MGR already set
[  247.889912] binder: 2699:2711 ioctl 40046207 0 returned -16
[  247.889955] binder: 2705:2712 ioctl 40046205 0 returned -22
2017/12/02 09:23:05 executing program 0:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.889991] binder: 2699:2722 ERROR: BC_REGISTER_LOOPER called without request
[  247.889999] binder: 2722 RLIMIT_NICE not set
[  247.899976] binder_alloc: 2086: binder_alloc_buf, no vma
[  247.900004] binder: 2699:2711 transaction failed 29189/-3, size 0-0 line 2870
[  247.904551] binder: 2699:2711 ioctl c0306201 20002fd0 returned -14
[  247.906044] binder: BINDER_SET_CONTEXT_MGR already set
[  247.906056] binder: 2705:2725 ioctl 40046207 0 returned -16
2017/12/02 09:23:05 executing program 2:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, 0x0}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 1:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>r2, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x42, 0x0}], 0x1, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.907346] binder: 2705:2712 ERROR: BC_REGISTER_LOOPER called without request
[  247.907354] binder: 2712 RLIMIT_NICE not set
[  247.907441] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.907464] binder: 2705:2725 transaction failed 29189/-3, size 0-0 line 2870
[  247.912578] binder: 2699:2722 BC_FREE_BUFFER u0000000000000000 no match
2017/12/02 09:23:05 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:05 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.912611] binder: 2699:2722 IncRefs 0 refcount change on invalid ref 1 ret -22
[  247.912619] binder: 2699:2722 got transaction to invalid handle
[  247.912630] binder: 2699:2722 transaction failed 29201/-22, size 0-8 line 2755
[  247.920177] binder: 2705:2728 ioctl c0306201 20002fd0 returned -14
[  247.931411] binder: 2705:2725 BC_FREE_BUFFER uffffffffffffffff no match
[  247.931450] binder: 2705:2725 IncRefs 0 refcount change on invalid ref 1 ret -22
2017/12/02 09:23:05 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x0, 0x0}, {0xffffffffffffffff, 0x42, 0x0}], 0x2, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.931460] binder: 2705:2725 got transaction to invalid handle
[  247.931471] binder: 2705:2725 transaction failed 29201/-22, size 0-8 line 2755
[  247.931490] binder: 2705:2725 ioctl c0306201 20005fd0 returned -14
[  247.931551] binder: 2705:2728 ioctl c018620b 2000dfe8 returned -14
[  247.949148] binder: BINDER_SET_CONTEXT_MGR already set
[  247.949157] binder: 2733:2734 ioctl 40046207 0 returned -16
2017/12/02 09:23:05 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000279000)={0x8000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
getsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r3 = epoll_create1(0x1080003)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000843000-0x24)={0x80000001, 0x5, 0x2, 0xdcf, 0x6, 0x0, 0xdc3, 0x1, 0x400, 0x80000001, 0x1, 0xdf1})
r4 = syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x800, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x2000, 0x0}, {r2, 0x0, 0x0}, {r3, 0x42, 0x0}], 0x3, 0x299f)
syz_open_dev$usbmon(&(0x7f00001c7000-0xd)="2f6465762f7573626d6f6e2300", 0x0, 0x0)
write(r2, &(0x7f0000caf000)="9c", 0x1)
ioctl$TCXONC(r2, 0x540a, 0x2)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0x10, 0x2, 0xc)
write(r4, &(0x7f0000014000)="1f0000000001ff49433bf000080000760f008fe0050000000000000000083c", 0x1f)
r5 = bpf$MAP_CREATE(0x0, &(0x7f000011c000)={0xf, 0x7, 0xffffffff, 0xd, 0x0, 0x0, 0x0}, 0x1c)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000b2a000)={r5, &(0x7f0000a82000)="3b", &(0x7f0000adb000)=""}, 0x18)
getsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f00001fe000)={@multicast1=0x0, @broadcast=0x0, @empty=0x0}, &(0x7f000077c000)=0xc)
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000441000)=0x401, 0x4)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00003f6000)={0x4, 0x0, 0x8, 0x1, 0x15})
ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000792000)=0x4)
ioctl$TCXONC(r2, 0x540a, 0x2)
ioctl$TCXONC(r2, 0x540a, 0x1)
ioctl$TCXONC(r2, 0x540a, 0x0)
syz_open_dev$loop(&(0x7f0000851000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x200)
llistxattr(&(0x7f0000222000)="2e2f66696c653000", &(0x7f00006fb000-0xaa)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0xaa)
2017/12/02 09:23:05 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
r0 = creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
write(r0, &(0x7f0000eb5000)="37078885694bd5f9d6a65c62038fd9e825a9e78a39ed0cb1b3d041e92434856d4da94306573016d1248f93a99c150a53419c396f0b48bb55f2d276460dea8e046c9bab741e6596381156adcd5b61b2bec88a53b912a788ba934e096a7e6e2b702255f575a4d8eac290", 0x69)
2017/12/02 09:23:05 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  247.949348] binder: 2733:2734 ERROR: BC_REGISTER_LOOPER called without request
[  247.949357] binder: 2734 RLIMIT_NICE not set
[  247.973209] binder: BINDER_SET_CONTEXT_MGR already set
[  247.973217] binder: 2736:2737 ioctl 40046207 0 returned -16
[  247.973678] binder: 2736:2737 ioctl c0306201 20008fd0 returned -14
[  247.973785] binder_alloc: 2089: binder_alloc_buf, no vma
2017/12/02 09:23:05 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
r1 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r1, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
r0 = creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
write(r0, &(0x7f0000eb5000)="37078885694bd5f9d6a65c62038fd9e825a9e78a39ed0cb1b3d041e92434856d4da94306573016d1248f93a99c150a53419c396f0b48bb55f2d276460dea8e046c9bab741e6596381156adcd5b61b2bec88a53b912a788ba934e096a7e6e2b702255f575a4d8eac290", 0x69)
2017/12/02 09:23:05 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.973805] binder: 2736:2737 transaction failed 29189/-3, size 0-0 line 2870
[  247.975730] binder: 2736:2737 ioctl c0306201 20002fd0 returned -14
[  247.978828] binder: 2736:2737 ioctl c0306201 20005fd0 returned -14
[  247.978972] binder: 2736:2737 ioctl c018620b 2000dfe8 returned -14
[  247.979593] binder: 2736:2737 ioctl 40046205 0 returned -22
2017/12/02 09:23:05 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
2017/12/02 09:23:05 executing program 0:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  247.984152] binder_alloc: 2086: binder_alloc_buf, no vma
[  247.984175] binder: 2733:2745 transaction failed 29189/-3, size 0-0 line 2870
[  247.984829] binder: 2736:2737 ioctl c0306201 20008fd0 returned -14
[  247.984894] binder_alloc: 2089: binder_alloc_buf, no vma
[  247.984915] binder: 2736:2744 transaction failed 29189/-3, size 0-0 line 2870
[  247.989183] binder: 2736:2744 ioctl c0306201 2000afd0 returned -14
2017/12/02 09:23:05 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x2000, 0x0}, {r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x3, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
r0 = creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
write(r0, &(0x7f0000eb5000)="37078885694bd5f9d6a65c62038fd9e825a9e78a39ed0cb1b3d041e92434856d4da94306573016d1248f93a99c150a53419c396f0b48bb55f2d276460dea8e046c9bab741e6596381156adcd5b61b2bec88a53b912a788ba934e096a7e6e2b702255f575a4d8eac290", 0x69)
2017/12/02 09:23:05 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  247.989844] binder: 2733:2745 ioctl c0306201 20002fd0 returned -14
[  248.007930] binder: 2736:2744 ioctl c018620b 2000dfe8 returned -14
[  248.015732] binder: 2733:2745 ioctl c018620b 2000dfe8 returned -14
[  248.042165] binder: 2733:2745 ioctl 40046205 0 returned -22
[  248.053940] binder: BINDER_SET_CONTEXT_MGR already set
[  248.053949] binder: 2758:2762 ioctl 40046207 0 returned -16
2017/12/02 09:23:05 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:05 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
[  248.054096] binder: 2758:2762 ERROR: BC_REGISTER_LOOPER called without request
[  248.054105] binder: 2762 RLIMIT_NICE not set
[  248.062569] binder: BINDER_SET_CONTEXT_MGR already set
[  248.062580] binder: 2733:2745 ioctl 40046207 0 returned -16
[  248.064303] binder: 2733:2759 ERROR: BC_REGISTER_LOOPER called without request
[  248.064315] binder: 2759 RLIMIT_NICE not set
[  248.065604] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.065633] binder: 2733:2745 transaction failed 29189/-3, size 0-0 line 2870
[  248.069246] binder: 2733:2745 ioctl c0306201 20002fd0 returned -14
[  248.089759] binder_alloc: 2089: binder_alloc_buf, no vma
[  248.089787] binder: 2758:2766 transaction failed 29189/-3, size 0-0 line 2870
[  248.091055] binder: 2733:2759 BC_FREE_BUFFER u0000000000000000 no match
[  248.091094] binder: 2733:2759 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.091104] binder: 2733:2759 got transaction to invalid handle
[  248.091117] binder: 2733:2759 transaction failed 29201/-22, size 0-8 line 2755
[  248.100283] binder: 2758:2766 ioctl c0306201 20002fd0 returned -14
[  248.133474] binder: 2758:2766 ioctl c0306201 20005fd0 returned -14
[  248.142700] binder: 2758:2766 ioctl c018620b 2000dfe8 returned -14
[  248.144496] binder: BINDER_SET_CONTEXT_MGR already set
[  248.144505] binder: 2773:2774 ioctl 40046207 0 returned -16
[  248.144607] binder: 2773:2774 ERROR: BC_REGISTER_LOOPER called without request
[  248.144616] binder: 2774 RLIMIT_NICE not set
[  248.167716] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.167756] binder: 2773:2783 transaction failed 29189/-3, size 0-0 line 2870
[  248.174141] binder: 2758:2766 ioctl 40046205 0 returned -22
[  248.200348] binder: BINDER_SET_CONTEXT_MGR already set
[  248.200360] binder: 2758:2781 ioctl 40046207 0 returned -16
[  248.200625] binder: 2773:2783 ioctl c0306201 20002fd0 returned -14
[  248.201647] binder_alloc: 2089: binder_alloc_buf, no vma
[  248.201670] binder: 2758:2781 transaction failed 29189/-3, size 0-0 line 2870
[  248.201705] binder: 2758:2766 ERROR: BC_REGISTER_LOOPER called without request
[  248.201714] binder: 2766 RLIMIT_NICE not set
[  248.212860] binder: 2758:2790 ioctl c0306201 20002fd0 returned -14
[  248.235779] binder: 2773:2783 ioctl c018620b 2000dfe8 returned -14
[  248.248362] binder: 2758:2781 BC_FREE_BUFFER uffffffffffffffff no match
[  248.248395] binder: 2758:2781 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.248405] binder: 2758:2781 got transaction to invalid handle
[  248.248414] binder: 2758:2781 transaction failed 29201/-22, size 0-8 line 2755
[  248.248430] binder: 2758:2781 ioctl c0306201 20005fd0 returned -14
[  248.248726] binder: 2758:2790 ioctl c018620b 2000dfe8 returned -14
[  248.254415] binder: 2773:2783 ioctl 40046205 0 returned -22
[  248.259586] binder: BINDER_SET_CONTEXT_MGR already set
[  248.259596] binder: 2773:2783 ioctl 40046207 0 returned -16
[  248.259636] binder: 2773:2797 ERROR: BC_REGISTER_LOOPER called without request
[  248.259645] binder: 2797 RLIMIT_NICE not set
[  248.268315] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.268345] binder: 2773:2783 transaction failed 29189/-3, size 0-0 line 2870
[  248.271335] binder: 2773:2783 ioctl c0306201 20002fd0 returned -14
[  248.276872] binder: 2773:2797 BC_FREE_BUFFER u0000000000000000 no match
[  248.276913] binder: 2773:2797 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.276924] binder: 2773:2797 got transaction to invalid handle
2017/12/02 09:23:06 executing program 2:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
mmap(&(0x7f0000fa7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
getgid()
mmap(&(0x7f0000fa8000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f000059a000)=0x0, &(0x7f00007a7000)=0x4)
mq_timedreceive(r5, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:06 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:06 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1)
2017/12/02 09:23:06 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
r0 = creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
write(r0, &(0x7f0000eb5000)="37078885694bd5f9d6a65c62038fd9e825a9e78a39ed0cb1b3d041e92434856d4da94306573016d1248f93a99c150a53419c396f0b48bb55f2d276460dea8e046c9bab741e6596381156adcd5b61b2bec88a53b912a788ba934e096a7e6e2b702255f575a4d8eac290", 0x69)
2017/12/02 09:23:06 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x8, 0x0, &(0x7f000000b000-0x4c)=[@increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:06 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x2, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:06 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
2017/12/02 09:23:06 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1)
[  248.276936] binder: 2773:2797 transaction failed 29201/-22, size 0-8 line 2755
[  248.320451] binder: 2801:2803 ioctl 40046205 0 returned -22
[  248.324686] binder: BINDER_SET_CONTEXT_MGR already set
[  248.324697] binder: 2801:2807 ioctl 40046207 0 returned -16
[  248.325918] binder: 2801:2803 ERROR: BC_REGISTER_LOOPER called without request
[  248.325929] binder: 2803 RLIMIT_NICE not set
2017/12/02 09:23:06 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
2017/12/02 09:23:06 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:06 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
2017/12/02 09:23:06 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
ioctl$TCXONC(r0, 0x540a, 0x0)
2017/12/02 09:23:06 executing program 2:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
mmap(&(0x7f0000fa7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
getgid()
mmap(&(0x7f0000fa8000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f000059a000)=0x0, &(0x7f00007a7000)=0x4)
mq_timedreceive(r5, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:06 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
close(0xffffffffffffffff)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
[  248.326043] binder_alloc: 2089: binder_alloc_buf, no vma
[  248.326072] binder: 2801:2807 transaction failed 29189/-3, size 0-0 line 2870
[  248.341336] binder: BINDER_SET_CONTEXT_MGR already set
[  248.341344] binder: 2806:2811 ioctl 40046207 0 returned -16
[  248.341432] binder: 2806:2811 ERROR: BC_REGISTER_LOOPER called without request
[  248.341441] binder: 2811 RLIMIT_NICE not set
[  248.342218] binder: 2801:2814 ioctl c0306201 20002fd0 returned -14
[  248.372614] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.372643] binder: 2806:2821 transaction failed 29189/-3, size 0-0 line 2870
[  248.378513] binder: 2806:2821 ioctl c0306201 20002fd0 returned -14
[  248.382304] binder: 2801:2807 BC_FREE_BUFFER uffffffffffffffff no match
[  248.382345] binder: 2801:2807 IncRefs 0 refcount change on invalid ref 1 ret -22
2017/12/02 09:23:06 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:06 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
2017/12/02 09:23:06 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mq_timedreceive(0xffffffffffffffff, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:06 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:06 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
[  248.382355] binder: 2801:2807 got transaction to invalid handle
[  248.382366] binder: 2801:2807 transaction failed 29201/-22, size 0-8 line 2755
[  248.382388] binder: 2801:2807 ioctl c0306201 20005fd0 returned -14
[  248.382448] binder: 2801:2814 ioctl c018620b 2000dfe8 returned -14
[  248.396045] binder: 2806:2821 ioctl c018620b 2000dfe8 returned -14
[  248.418273] binder: 2806:2821 ioctl 40046205 0 returned -22
2017/12/02 09:23:06 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$bt_l2cap(0x1f, 0x5, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000df8000-0x4)=0x0, &(0x7f0000ade000-0x4)=0x4)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
syz_open_dev$loop(&(0x7f0000e7a000-0xb)="2f6465762f6c6f6f702300", 0x0, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x0)
2017/12/02 09:23:06 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
[  248.434848] binder: BINDER_SET_CONTEXT_MGR already set
[  248.434858] binder: 2827:2830 ioctl 40046207 0 returned -16
[  248.435036] binder: 2827:2830 ERROR: BC_REGISTER_LOOPER called without request
[  248.435044] binder: 2830 RLIMIT_NICE not set
2017/12/02 09:23:06 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r1, 0x42, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:06 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:06 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
2017/12/02 09:23:06 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:06 executing program 2:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
mmap(&(0x7f0000fa7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
getgid()
mmap(&(0x7f0000fa8000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f000059a000)=0x0, &(0x7f00007a7000)=0x4)
mq_timedreceive(r5, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  248.443997] binder: BINDER_SET_CONTEXT_MGR already set
[  248.444008] binder: 2806:2821 ioctl 40046207 0 returned -16
[  248.444064] binder: 2806:2828 ERROR: BC_REGISTER_LOOPER called without request
[  248.444071] binder: 2828 RLIMIT_NICE not set
[  248.446091] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.446115] binder: 2806:2821 transaction failed 29189/-3, size 0-0 line 2870
[  248.449490] binder: 2806:2821 unknown command 0
[  248.449498] binder: 2806:2821 ioctl c0306201 20002fd0 returned -22
2017/12/02 09:23:06 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
2017/12/02 09:23:06 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r3, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:06 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:06 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(0xffffffffffffffff)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
[  248.463429] binder: 2806:2828 BC_FREE_BUFFER u0000000000000000 no match
[  248.463464] binder: 2806:2828 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.463475] binder: 2806:2828 got transaction to invalid handle
2017/12/02 09:23:06 executing program 4:
mmap(&(0x7f0000001000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f000000e000-0x18)={0x0, 0x0, 0x0, 0x0})
2017/12/02 09:23:06 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:06 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
2017/12/02 09:23:06 executing program 6:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f000000b000-0xd7)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>r2, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  248.463486] binder: 2806:2828 transaction failed 29201/-22, size 0-8 line 2755
[  248.463950] binder_alloc: 2089: binder_alloc_buf, no vma
[  248.463976] binder: 2827:2836 transaction failed 29189/-3, size 0-0 line 2870
[  248.487998] binder: 2827:2836 ioctl c0306201 20002fd0 returned -14
[  248.491374] binder: 2840:2841 ERROR: BC_REGISTER_LOOPER called without request
2017/12/02 09:23:06 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x0, &(0x7f000000a000)="")
r0 = creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0x0)
write(r0, &(0x7f0000eb5000)="37", 0x1)
r1 = open$dir(&(0x7f00004ba000-0xc)="2e2f66696c65302f62757300", 0x0, 0x0)
mmap(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x1, 0x0, r1, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
2017/12/02 09:23:06 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:06 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
r2 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r2, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  248.491384] binder: 2841 RLIMIT_NICE not set
[  248.511736] binder: 2827:2836 ioctl c0306201 20005fd0 returned -14
[  248.513567] binder: 2827:2836 ioctl c018620b 2000dfe8 returned -14
[  248.513954] binder: 2841 RLIMIT_NICE not set
[  248.514571] binder: BINDER_SET_CONTEXT_MGR already set
[  248.514579] binder: 2844:2848 ioctl 40046207 0 returned -16
[  248.514679] binder: 2844:2848 ERROR: BC_REGISTER_LOOPER called without request
[  248.514689] binder: 2848 RLIMIT_NICE not set
[  248.521866] binder: 2840:2841 ioctl c0306201 20002fd0 returned -14
[  248.522379] binder: 2841 RLIMIT_NICE not set
[  248.523295] binder: 2840:2841 BC_FREE_BUFFER u0000000000000000 no match
[  248.523442] binder: 2840:2841 got transaction with invalid offsets ptr
[  248.523474] binder: 2840:2841 transaction failed 29201/-14, size 0-8 line 2898
[  248.524961] binder: 2840:2841 ioctl c018620b 2000dfe8 returned -14
[  248.525475] binder: 2840:2841 ioctl 40046205 0 returned -22
[  248.536531] binder: BINDER_SET_CONTEXT_MGR already set
[  248.536564] binder: 2840:2841 ioctl 40046207 0 returned -16
[  248.539121] binder: 2840:2852 ERROR: BC_REGISTER_LOOPER called without request
[  248.539131] binder: 2852 RLIMIT_NICE not set
[  248.540718] binder_alloc: 2840: binder_alloc_buf, no vma
[  248.540744] binder: 2840:2841 transaction failed 29189/-3, size 0-0 line 2870
[  248.543642] binder: 2840:2841 ioctl c0306201 20002fd0 returned -14
[  248.549158] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.549219] binder: 2844:2856 transaction failed 29189/-3, size 0-0 line 2870
[  248.549348] binder: 2827:2836 ioctl 40046205 0 returned -22
[  248.553191] binder: 2840:2852 BC_FREE_BUFFER u0000000000000000 no match
[  248.553234] binder: 2840:2852 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.553244] binder: 2840:2852 got transaction to invalid handle
[  248.553256] binder: 2840:2852 transaction failed 29201/-22, size 0-8 line 2755
[  248.555072] binder: 2840:2841 ioctl c018620b 2000dfe8 returned -14
[  248.561974] binder: BINDER_SET_CONTEXT_MGR already set
[  248.561983] binder: 2827:2853 ioctl 40046207 0 returned -16
[  248.563715] binder: 2827:2836 ERROR: BC_REGISTER_LOOPER called without request
[  248.563725] binder: 2836 RLIMIT_NICE not set
[  248.563813] binder_alloc: 2089: binder_alloc_buf, no vma
[  248.563837] binder: 2827:2853 transaction failed 29189/-3, size 0-0 line 2870
[  248.563901] binder: 2844:2856 ioctl c0306201 20002fd0 returned -14
[  248.572932] binder: 2827:2862 ioctl c0306201 20002fd0 returned -14
[  248.582719] binder: 2844:2856 ioctl c018620b 2000dfe8 returned -14
[  248.596494] binder: 2827:2853 BC_FREE_BUFFER uffffffffffffffff no match
[  248.596530] binder: 2827:2853 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.596541] binder: 2827:2853 got transaction to invalid handle
[  248.596551] binder: 2827:2853 transaction failed 29201/-22, size 0-8 line 2755
[  248.596567] binder: 2827:2853 ioctl c0306201 20005fd0 returned -14
[  248.601644] binder: 2827:2862 ioctl c018620b 2000dfe8 returned -14
[  248.612392] binder: 2844:2856 ioctl 40046205 0 returned -22
[  248.624452] binder: BINDER_SET_CONTEXT_MGR already set
[  248.624461] binder: 2844:2856 ioctl 40046207 0 returned -16
[  248.625062] binder: 2844:2869 ERROR: BC_REGISTER_LOOPER called without request
[  248.625072] binder: 2869 RLIMIT_NICE not set
[  248.626317] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.626343] binder: 2844:2856 transaction failed 29189/-3, size 0-0 line 2870
[  248.630228] binder: 2844:2856 ioctl c0306201 20002fd0 returned -14
[  248.638517] binder: 2844:2869 BC_FREE_BUFFER u0000000000000000 no match
[  248.638557] binder: 2844:2869 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.638568] binder: 2844:2869 got transaction to invalid handle
[  248.638579] binder: 2844:2869 transaction failed 29201/-22, size 0-8 line 2755
[  248.664374] binder: BINDER_SET_CONTEXT_MGR already set
[  248.664382] binder: 2883:2885 ioctl 40046207 0 returned -16
[  248.664467] binder: 2883:2885 ERROR: BC_REGISTER_LOOPER called without request
[  248.664475] binder: 2885 RLIMIT_NICE not set
[  248.709691] binder_alloc: 2086: binder_alloc_buf, no vma
2017/12/02 09:23:07 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
r1 = epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{0xffffffffffffffff, 0x0, 0x0}, {r1, 0x42, 0x0}], 0x2, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:07 executing program 1:
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:07 executing program 2:
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0x6cc000)=nil, 0x6cc000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
mmap(&(0x7f0000fa7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
getgid()
mmap(&(0x7f0000fa8000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f000059a000)=0x0, &(0x7f00007a7000)=0x4)
mq_timedreceive(r5, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:07 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
2017/12/02 09:23:07 executing program 6:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f000000b000-0xd7)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>r2, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:07 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x0]}}, @increfs={0x40046304, 0x3}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:07 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38, 0x38]}}, @increfs={0x40046304, 0x3}], 0xd7, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a91473409183d7c9598d38198d78a26f849597345bea073ed"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>r2, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:07 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r2, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  248.709718] binder: 2883:2891 transaction failed 29189/-3, size 0-0 line 2870
[  248.723086] binder: 2883:2891 ioctl c0306201 20002fd0 returned -14
[  248.726153] binder: BINDER_SET_CONTEXT_MGR already set
[  248.726164] binder: 2895:2899 ioctl 40046207 0 returned -16
[  248.726273] binder: 2895:2899 ERROR: BC_REGISTER_LOOPER called without request
[  248.726282] binder: 2899 RLIMIT_NICE not set
[  248.736965] binder: 2883:2891 ioctl c018620b 2000dfe8 returned -14
[  248.750772] binder: 2883:2891 ioctl 40046205 0 returned -22
2017/12/02 09:23:07 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:07 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
gettid()
r1 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r1, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  248.755848] binder_alloc: 2089: binder_alloc_buf, no vma
[  248.755875] binder: 2895:2904 transaction failed 29189/-3, size 0-0 line 2870
[  248.759385] binder: BINDER_SET_CONTEXT_MGR already set
[  248.759397] binder: 2883:2891 ioctl 40046207 0 returned -16
[  248.759476] binder: 2883:2897 ERROR: BC_REGISTER_LOOPER called without request
[  248.759485] binder: 2897 RLIMIT_NICE not set
2017/12/02 09:23:07 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:07 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
[  248.761384] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.761408] binder: 2883:2891 transaction failed 29189/-3, size 0-0 line 2870
[  248.761550] binder: 2895:2904 ioctl c0306201 20002fd0 returned -14
[  248.766949] binder: 2883:2891 ioctl c0306201 20002fd0 returned -14
[  248.780593] binder: 2883:2897 BC_FREE_BUFFER u0000000000000000 no match
[  248.780628] binder: 2883:2897 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.780638] binder: 2883:2897 got transaction to invalid handle
2017/12/02 09:23:07 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
getgid()
getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f000059a000)=0x0, &(0x7f00007a7000)=0x4)
mq_timedreceive(r5, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:07 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:07 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000431000-0x10)=@generic="ff0149360dbbc55b00000000f0dd6cff")
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0xdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000c06000-0x8)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$lock(r1, 0x8000000000000007, &(0x7f0000002000)={0x1, 0x0, 0x0, 0x0, 0x0})
fcntl$lock(r1, 0x7, &(0x7f000079f000)={0x0, 0x8000000, 0x0, 0x1, 0x0})
2017/12/02 09:23:07 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r1, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  248.780649] binder: 2883:2897 transaction failed 29201/-22, size 0-8 line 2755
[  248.805321] binder: BINDER_SET_CONTEXT_MGR already set
[  248.805330] binder: 2910:2911 ioctl 40046207 0 returned -16
[  248.805427] binder: 2910:2911 ERROR: BC_REGISTER_LOOPER called without request
[  248.805437] binder: 2911 RLIMIT_NICE not set
[  248.820580] binder: BINDER_SET_CONTEXT_MGR already set
[  248.820588] binder: 2905:2908 ioctl 40046207 0 returned -16
[  248.820769] binder: 2905:2908 ERROR: BC_REGISTER_LOOPER called without request
[  248.820820] binder: 2908 RLIMIT_NICE not set
[  248.822170] binder: 2895:2904 ioctl c0306201 20005fd0 returned -14
[  248.823763] binder: 2895:2904 ioctl c018620b 2000dfe8 returned -14
[  248.840124] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.840153] binder: 2910:2918 transaction failed 29189/-3, size 0-0 line 2870
[  248.844244] binder: BINDER_SET_CONTEXT_MGR already set
[  248.844255] binder: 2895:2913 ioctl 40046207 0 returned -16
[  248.845942] binder: 2895:2904 ERROR: BC_REGISTER_LOOPER called without request
[  248.845950] binder: 2904 RLIMIT_NICE not set
[  248.846129] binder_alloc: 2089: binder_alloc_buf, no vma
[  248.846151] binder: 2895:2913 transaction failed 29189/-3, size 0-0 line 2870
[  248.846338] binder: 2910:2918 ioctl c0306201 20002fd0 returned -14
[  248.849177] binder_alloc: 2840: binder_alloc_buf, no vma
[  248.849203] binder: 2905:2921 transaction failed 29189/-3, size 0-0 line 2870
[  248.849842] binder: 2895:2913 ioctl c0306201 20002fd0 returned -14
[  248.857259] binder: 2895:2904 BC_FREE_BUFFER uffffffffffffffff no match
[  248.857295] binder: 2895:2904 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.857304] binder: 2895:2904 got transaction to invalid handle
2017/12/02 09:23:07 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:07 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000431000-0x10)=@generic="ff0149360dbbc55b00000000f0dd6cff")
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0xdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000c06000-0x8)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$lock(r1, 0x8000000000000007, &(0x7f0000002000)={0x1, 0x0, 0x0, 0x0, 0x0})
fcntl$lock(r1, 0x7, &(0x7f000079f000)={0x0, 0x8000000, 0x0, 0x1, 0x0})
2017/12/02 09:23:07 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x0, &(0x7f000000a000)="")
2017/12/02 09:23:07 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:07 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x44, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:07 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
getgid()
getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f000059a000)=0x0, &(0x7f00007a7000)=0x4)
2017/12/02 09:23:07 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:07 executing program 6:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x10, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38, 0x38]}}, @increfs={0x40046304, 0x3}], 0xd7, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a91473409183d7c9598d38198d78a26f849597345bea073ed"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>r2, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:07 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
[  248.857320] binder: 2895:2904 transaction failed 29201/-22, size 0-8 line 2755
[  248.857353] binder: 2895:2904 ioctl c0306201 20005fd0 returned -14
[  248.857523] binder: 2895:2913 ioctl c018620b 2000dfe8 returned -14
[  248.862206] binder: 2910:2918 ioctl c018620b 2000dfe8 returned -14
[  248.863987] binder: 2905:2921 ioctl c0306201 20002fd0 returned -14
[  248.884379] binder: 2910:2918 ioctl 40046205 0 returned -22
[  248.890563] binder: 2926:2929 ioctl 40046205 0 returned -22
2017/12/02 09:23:07 executing program 4:
r0 = syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000431000-0x10)=@generic="ff0149360dbbc55b00000000f0dd6cff")
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0xdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x0, 0x0}], 0x1, &(0x7f0000001000)={0x0, 0x0}, &(0x7f0000001000-0x8)={0x0}, 0x8)
socket$inet(0x2, 0x2007, 0xdd)
mmap(&(0x7f0000000000/0xeb5000)=nil, 0xeb5000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000f66000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
personality(0x610000e)
r1 = memfd_create(&(0x7f0000c66000-0x22)="00", 0x2)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r1, &(0x7f0000cd4000-0xc)={0x80002000, 0x0})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000d11000-0x20)={0x101ff, 0x3, 0x4, 0x1000, &(0x7f0000c6c000/0x1000)=nil})
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000ea5000)="2f6465762f7667615f6172626974657200", 0x0, 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
r2 = creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
write(r2, &(0x7f0000eb5000)="37078885694bd5f9d6a65c62038fd9e825a9e78a39ed0cb1b3d041e92434856d4da94306573016d1248f93a99c150a53419c396f0b48bb55f2d276460dea8e046c9bab741e6596381156adcd5b61b2bec88a53b912a788ba934e096a7e6e2b702255f575a4d8eac290", 0x69)
r3 = open$dir(&(0x7f00004ba000-0xc)="2e2f66696c65302f62757300", 0x8000, 0x0)
mmap(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x1, 0x100000000a012, r3, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
[  248.892604] binder: BINDER_SET_CONTEXT_MGR already set
[  248.892612] binder: 2926:2929 ioctl 40046207 0 returned -16
[  248.892740] binder: 2926:2929 ERROR: BC_REGISTER_LOOPER called without request
[  248.892749] binder: 2929 RLIMIT_NICE not set
[  248.893387] binder: 2905:2921 ioctl c0306201 20005fd0 returned -14
[  248.893514] binder: BINDER_SET_CONTEXT_MGR already set
2017/12/02 09:23:07 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_sctp(0xa, 0x805, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000224000-0x2c)=[@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}], 0x1c)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000ba0000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r1 = syz_open_dev$tun(&(0x7f00002d2000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000533000)={@generic="02000000040000000004008000e9bc22", @ifru_settings={0x10001, 0x0, @fr=&(0x7f0000013000-0x18)={0x0, 0x8000000000002, 0x3, 0xfffffffffffffffb, 0x81c7, 0x7fffffff, 0x26e}}})
r2 = socket(0x10, 0x3, 0x4000000000)
write(r2, &(0x7f00000b8000)="260000005e0009fff10000f83a0000000000000001000000ffffffee0000085b1ee9fb4b35ea", 0x26)
2017/12/02 09:23:07 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:07 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:07 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
getgid()
[  248.893520] binder: 2910:2918 ioctl 40046207 0 returned -16
[  248.893558] binder: 2910:2925 ERROR: BC_REGISTER_LOOPER called without request
2017/12/02 09:23:07 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x0}], 0xc4, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a9147340918"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:07 executing program 6:
r0 = syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000431000-0x10)=@generic="ff0149360dbbc55b00000000f0dd6cff")
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0xdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x0, 0x0}], 0x1, &(0x7f0000001000)={0x0, 0x0}, &(0x7f0000001000-0x8)={0x0}, 0x8)
socket$inet(0x2, 0x2007, 0xdd)
mmap(&(0x7f0000000000/0xeb5000)=nil, 0xeb5000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000f66000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
personality(0x610000e)
r1 = memfd_create(&(0x7f0000c66000-0x22)="00", 0x2)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r1, &(0x7f0000cd4000-0xc)={0x80002000, 0x0})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000d11000-0x20)={0x101ff, 0x3, 0x4, 0x1000, &(0x7f0000c6c000/0x1000)=nil})
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000ea5000)="2f6465762f7667615f6172626974657200", 0x0, 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
r2 = creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
mmap(&(0x7f0000eb5000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
write(r2, &(0x7f0000eb5000)="37078885694bd5f9d6a65c62038fd9e825a9e78a39ed0cb1b3d041e92434856d4da94306573016d1248f93a99c150a53419c396f0b48bb55f2d276460dea8e046c9bab741e6596381156adcd5b61b2bec88a53b912a788ba934e096a7e6e2b702255f575a4d8eac290", 0x69)
truncate(&(0x7f00003da000-0x12)="2e2f66696c65302f62757300", 0x800)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000c06000-0x8)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
fchdir(r3)
fcntl$lock(r4, 0x8000000000000007, &(0x7f0000002000)={0x1, 0x0, 0x0, 0x0, 0x0})
fcntl$lock(r4, 0x7, &(0x7f000079f000)={0x0, 0x8000000, 0x0, 0x1, 0x0})
close(r4)
mmap(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x1, 0x100000000a012, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
[  248.893566] binder: 2925 RLIMIT_NICE not set
[  248.894886] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.894908] binder: 2910:2918 transaction failed 29189/-3, size 0-0 line 2870
[  248.895199] binder: 2905:2921 ioctl c018620b 2000dfe8 returned -14
[  248.899060] binder: 2910:2918 unknown command 0
[  248.899068] binder: 2910:2918 ioctl c0306201 20002fd0 returned -22
[  248.907646] binder: 2910:2925 BC_FREE_BUFFER u0000000000000000 no match
[  248.907677] binder: 2910:2925 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.907685] binder: 2910:2925 got transaction to invalid handle
[  248.907695] binder: 2910:2925 transaction failed 29201/-22, size 0-8 line 2755
[  248.913566] binder: 2905:2921 ioctl 40046205 0 returned -22
[  248.923125] binder_alloc: 2089: binder_alloc_buf, no vma
2017/12/02 09:23:07 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x0)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:07 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000b32000)="2f6465762f73672300", 0x0, 0x0)
perf_event_open(&(0x7f0000001000-0x78)={0x5, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x666, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000431000-0x10)=@generic="ff0149360dbbc55b00000000f0dd6cff")
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0xdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x0, 0x0}], 0x1, &(0x7f0000001000)={0x0, 0x0}, &(0x7f0000001000-0x8)={0x0}, 0x8)
r1 = socket$inet(0x2, 0x2007, 0xdd)
personality(0x610000e)
r2 = memfd_create(&(0x7f0000c66000-0x22)="00", 0x2)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r2, &(0x7f0000cd4000-0xc)={0x80002000, 0x0})
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000d11000-0x20)={0x101ff, 0x3, 0x4, 0x1000, &(0x7f0000c6c000/0x1000)=nil})
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000ea5000)="2f6465762f7667615f6172626974657200", 0x0, 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
r3 = creat(&(0x7f0000f67000-0xc)="2e2f66696c65302f62757300", 0xffffffffffffffff)
write(r3, &(0x7f0000eb5000)="37078885694bd5f9d6a65c62038fd9e825a9e78a39ed0cb1b3d041e92434856d4da94306573016d1248f93a99c150a53419c396f0b48bb55f2d276460dea8e046c9bab741e6596381156adcd5b61b2bec88a53b912a788ba934e096a7e6e2b702255f575a4d8eac290", 0x69)
truncate(&(0x7f00003da000-0x12)="2e2f66696c65302f62757300", 0x800)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000c06000-0x8)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
fchdir(r4)
fcntl$lock(r5, 0x8000000000000007, &(0x7f0000002000)={0x1, 0x0, 0x0, 0x0, 0x0})
fcntl$lock(r5, 0x7, &(0x7f000079f000)={0x0, 0x8000000, 0x0, 0x1, 0x0})
close(r5)
r6 = open$dir(&(0x7f00004ba000-0xc)="2e2f66696c65302f62757300", 0x8000, 0x0)
mmap(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x1, 0x100000000a012, r6, 0x0)
setsockopt$inet_int(r1, 0x0, 0x12, &(0x7f0000605000-0x1)=0x100000000000f8, 0x4)
2017/12/02 09:23:07 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_sctp(0xa, 0x805, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000224000-0x2c)=[@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}], 0x1c)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000ba0000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r1 = syz_open_dev$tun(&(0x7f00002d2000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000141000)=0x101)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000533000)={@generic="02000000040000000004008000e9bc22", @ifru_settings={0x10001, 0x0, @fr=&(0x7f0000013000-0x18)={0x0, 0x8000000000002, 0x3, 0xfffffffffffffffb, 0x81c7, 0x7fffffff, 0x26e}}})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000dd6000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r2 = syz_open_dev$evdev(&(0x7f0000cc3000-0x12)="2f6465762f696e7075742f6576656e742300", 0x1, 0x80)
fallocate(r2, 0x3, 0x700000, 0x0)
syz_open_dev$tun(&(0x7f0000b1f000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
r3 = socket(0x10, 0x3, 0x4000000000)
write(r3, &(0x7f00000b8000)="260000005e0009fff10000f83a0000000000000001000000ffffffee0000085b1ee9fb4b35ea", 0x26)
2017/12/02 09:23:07 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:07 executing program 5:
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:07 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f000000b000-0xd7)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:07 executing program 6:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x10, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38, 0x38]}}, @increfs={0x40046304, 0x3}], 0xd7, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a91473409183d7c9598d38198d78a26f849597345bea073ed"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>r2, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:07 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:07 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
[  248.923150] binder: 2926:2935 transaction failed 29189/-3, size 0-0 line 2870
[  248.940802] binder: 2926:2935 ioctl c0306201 20002fd0 returned -14
[  248.942400] binder: BINDER_SET_CONTEXT_MGR already set
[  248.942408] binder: 2905:2921 ioctl 40046207 0 returned -16
[  248.942449] binder: 2905:2933 ERROR: BC_REGISTER_LOOPER called without request
[  248.942457] binder: 2933 RLIMIT_NICE not set
[  248.943825] binder_alloc: 2840: binder_alloc_buf, no vma
2017/12/02 09:23:07 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:07 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x6)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
[  248.943852] binder: 2905:2921 transaction failed 29189/-3, size 0-0 line 2870
[  248.943877] binder: BINDER_SET_CONTEXT_MGR already set
[  248.943885] binder: 2938:2939 ioctl 40046207 0 returned -16
[  248.943975] binder: 2938:2939 ERROR: BC_REGISTER_LOOPER called without request
[  248.943983] binder: 2939 RLIMIT_NICE not set
2017/12/02 09:23:07 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:07 executing program 4:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x18010, r0, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x10, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38, 0x38]}}, @increfs={0x40046304, 0x3}], 0xd7, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a91473409183d7c9598d38198d78a26f849597345bea073ed"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>r2, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:07 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:07 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
2017/12/02 09:23:07 executing program 6:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x18010, r0, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x10, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38, 0x38]}}, @increfs={0x40046304, 0x3}], 0xd7, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec8bb513321b1fb1ffa2a15ae46b07737f3e7ab54b61dcc69cfe0f16606bbc551932aaedabbbec011fadbf577a53d7f4a6ce628529daf9440fda485e065204aea12c933a53bd3634c86c10cea724a3d541f812dd8e23a94c54bc1484606a91473409183d7c9598d38198d78a26f849597345bea073ed"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>r2, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  248.946173] binder: 2905:2933 ioctl c0306201 20002fd0 returned -14
[  248.953220] binder: 2905:2921 BC_FREE_BUFFER uffffffffffffffff no match
[  248.953253] binder: 2905:2921 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.953263] binder: 2905:2921 got transaction to invalid handle
[  248.953273] binder: 2905:2921 transaction failed 29201/-22, size 0-8 line 2755
[  248.953290] binder: 2905:2921 ioctl c0306201 20005fd0 returned -14
[  248.953341] binder: 2905:2933 ioctl c018620b 2000dfe8 returned -14
[  248.959784] binder: 2926:2935 BC_FREE_BUFFER uffffffffffffffff no match
[  248.959820] binder: 2926:2935 IncRefs 0 refcount change on invalid ref 1 ret -22
[  248.959830] binder: 2926:2935 got transaction to invalid handle
[  248.959841] binder: 2926:2935 transaction failed 29201/-22, size 0-8 line 2755
[  248.959858] binder: 2926:2935 ioctl c0306201 20005fd0 returned -14
[  248.961228] binder: 2926:2935 ioctl c018620b 2000dfe8 returned -14
[  248.961672] device lo left promiscuous mode
[  248.972116] binder_alloc: 2086: binder_alloc_buf, no vma
[  248.972144] binder: 2938:2947 transaction failed 29189/-3, size 0-0 line 2870
[  248.982266] binder: 2926:2950 ioctl 40046205 0 returned -22
[  248.988536] binder: BINDER_SET_CONTEXT_MGR already set
[  248.988545] binder: 2946:2949 ioctl 40046207 0 returned -16
[  248.988823] binder: 2946:2949 ERROR: BC_REGISTER_LOOPER called without request
[  248.988833] binder: 2949 RLIMIT_NICE not set
[  248.994344] binder: BINDER_SET_CONTEXT_MGR already set
[  248.994352] binder: 2926:2950 ioctl 40046207 0 returned -16
[  248.995555] binder: 2926:2935 ERROR: BC_REGISTER_LOOPER called without request
[  248.995563] binder: 2935 RLIMIT_NICE not set
[  248.995645] binder_alloc: 2089: binder_alloc_buf, no vma
2017/12/02 09:23:08 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(0xffffffffffffffff, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:08 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  248.995668] binder: 2926:2950 transaction failed 29189/-3, size 0-0 line 2870
[  249.001295] binder: 2926:2950 ioctl c0306201 20002fd0 returned -14
[  249.002901] binder: 2938:2947 ioctl c0306201 20002fd0 returned -14
[  249.015406] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.015434] binder: 2946:2955 transaction failed 29189/-3, size 0-0 line 2870
[  249.016787] binder: 2926:2935 BC_FREE_BUFFER uffffffffffffffff no match
[  249.016821] binder: 2926:2935 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.016829] binder: 2926:2935 got transaction to invalid handle
[  249.016840] binder: 2926:2935 transaction failed 29201/-22, size 0-8 line 2755
[  249.016856] binder: 2926:2935 ioctl c0306201 20005fd0 returned -14
[  249.016888] binder: 2926:2950 ioctl c018620b 2000dfe8 returned -14
[  249.025690] binder: 2946:2955 ioctl c0306201 20002fd0 returned -14
[  249.051830] binder: 2946:2955 ioctl c018620b 2000dfe8 returned -14
[  249.065347] binder: 2938:2947 ioctl c018620b 2000dfe8 returned -14
[  249.072051] binder: 2946:2955 ioctl 40046205 0 returned -22
[  249.078605] binder: BINDER_SET_CONTEXT_MGR already set
[  249.078614] binder: 2958:2967 ioctl 40046207 0 returned -16
[  249.085685] binder: 2958:2967 ioctl c0306201 20002fd0 returned -14
[  249.086225] binder: 2938:2947 ioctl 40046205 0 returned -22
[  249.096209] binder: 2958:2960 BC_FREE_BUFFER uffffffffffffffff no match
[  249.096245] binder: 2958:2960 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.096254] binder: 2958:2960 got transaction to invalid handle
[  249.096265] binder: 2958:2960 transaction failed 29201/-22, size 0-8 line 2755
[  249.096281] binder: 2958:2960 ioctl c0306201 20005fd0 returned -14
[  249.099388] binder: BINDER_SET_CONTEXT_MGR already set
[  249.099397] binder: 2946:2955 ioctl 40046207 0 returned -16
[  249.099437] binder: 2946:2964 ERROR: BC_REGISTER_LOOPER called without request
[  249.099447] binder: 2964 RLIMIT_NICE not set
[  249.105370] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.105397] binder: 2946:2955 transaction failed 29189/-3, size 0-0 line 2870
[  249.113181] binder: BINDER_SET_CONTEXT_MGR already set
[  249.113190] binder: 2938:2947 ioctl 40046207 0 returned -16
[  249.113232] binder: 2938:2972 ERROR: BC_REGISTER_LOOPER called without request
[  249.113241] binder: 2972 RLIMIT_NICE not set
[  249.120737] binder: 2946:2955 ioctl c0306201 20002fd0 returned -14
[  249.120879] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.120906] binder: 2938:2947 transaction failed 29189/-3, size 0-0 line 2870
[  249.137570] binder: 2938:2947 ioctl c0306201 20002fd0 returned -14
[  249.147876] binder: 2946:2964 BC_FREE_BUFFER u0000000000000000 no match
[  249.147914] binder: 2946:2964 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.147924] binder: 2946:2964 got transaction to invalid handle
[  249.147937] binder: 2946:2964 transaction failed 29201/-22, size 0-8 line 2755
[  249.151303] binder: 2938:2972 BC_FREE_BUFFER u0000000000000000 no match
[  249.151337] binder: 2938:2972 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.151346] binder: 2938:2972 got transaction to invalid handle
[  249.151358] binder: 2938:2972 transaction failed 29201/-22, size 0-8 line 2755
[  249.179886] binder: BINDER_SET_CONTEXT_MGR already set
[  249.179894] binder: 2976:2980 ioctl 40046207 0 returned -16
[  249.181420] binder: 2976:2980 ioctl c0306201 20002fd0 returned -14
[  249.185225] binder: 2976:2980 ioctl c0306201 20005fd0 returned -14
[  249.194598] binder: BINDER_SET_CONTEXT_MGR already set
[  249.194606] binder: 2986:2989 ioctl 40046207 0 returned -16
[  249.195389] binder: 2986:2989 ERROR: BC_REGISTER_LOOPER called without request
[  249.195396] binder: 2989 RLIMIT_NICE not set
[  249.196745] binder: BINDER_SET_CONTEXT_MGR already set
[  249.196753] binder: 2987:2990 ioctl 40046207 0 returned -16
[  249.196921] binder: 2987:2990 ERROR: BC_REGISTER_LOOPER called without request
[  249.196928] binder: 2990 RLIMIT_NICE not set
[  249.221221] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.221247] binder: 2986:3000 transaction failed 29189/-3, size 0-0 line 2870
[  249.237884] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.237908] binder: 2987:3004 transaction failed 29189/-3, size 0-0 line 2870
[  249.240706] binder: 2986:3000 ioctl c0306201 20002fd0 returned -14
[  249.244807] binder: BINDER_SET_CONTEXT_MGR already set
[  249.244815] binder: 2995:2997 ioctl 40046207 0 returned -16
[  249.245145] binder: 2987:3004 ioctl c0306201 20002fd0 returned -14
[  249.249621] binder: 2995:2997 ioctl c0306201 20002fd0 returned -14
[  249.255613] binder: 2986:3000 ioctl c018620b 2000dfe8 returned -14
[  249.256223] binder: 2995:2998 ioctl c0306201 20005fd0 returned -14
[  249.257889] binder: 2987:3004 ioctl c0306201 20005fd0 returned -14
[  249.261520] binder: 2987:3004 ioctl c018620b 2000dfe8 returned -14
[  249.275080] binder: 2986:3000 ioctl 40046205 0 returned -22
[  249.280959] binder: BINDER_SET_CONTEXT_MGR already set
[  249.280967] binder: 2986:3000 ioctl 40046207 0 returned -16
[  249.281060] binder: 2987:3004 ioctl 40046205 0 returned -22
[  249.282142] binder: 2986:3010 ERROR: BC_REGISTER_LOOPER called without request
[  249.282153] binder: 3010 RLIMIT_NICE not set
[  249.283577] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.283602] binder: 2986:3000 transaction failed 29189/-3, size 0-0 line 2870
[  249.287078] binder: 2986:3000 ioctl c0306201 20002fd0 returned -14
[  249.288443] binder: BINDER_SET_CONTEXT_MGR already set
[  249.288450] binder: 2987:3004 ioctl 40046207 0 returned -16
[  249.288541] binder: 2987:3011 ERROR: BC_REGISTER_LOOPER called without request
[  249.288548] binder: 3011 RLIMIT_NICE not set
[  249.291469] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.291491] binder: 2987:3004 transaction failed 29189/-3, size 0-0 line 2870
[  249.294324] binder: 2987:3004 ioctl c0306201 20002fd0 returned -14
[  249.294543] binder: 2986:3010 BC_FREE_BUFFER u0000000000000000 no match
[  249.294572] binder: 2986:3010 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.294612] binder: 2986:3010 got transaction to invalid handle
[  249.294622] binder: 2986:3010 transaction failed 29201/-22, size 0-8 line 2755
[  249.307423] binder: 2987:3004 BC_FREE_BUFFER uffffffffffffffff no match
[  249.307452] binder: 2987:3004 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.307459] binder: 2987:3004 got transaction to invalid handle
[  249.307467] binder: 2987:3004 transaction failed 29201/-22, size 0-8 line 2755
[  249.307483] binder: 2987:3004 ioctl c0306201 20005fd0 returned -14
[  249.307512] binder: 2987:3011 ioctl c018620b 2000dfe8 returned -14
[  249.313336] binder: BINDER_SET_CONTEXT_MGR already set
[  249.313344] binder: 3009:3013 ioctl 40046207 0 returned -16
[  249.321335] binder: BINDER_SET_CONTEXT_MGR already set
[  249.321343] binder: 3018:3023 ioctl 40046207 0 returned -16
[  249.321433] binder: 3018:3023 ERROR: BC_REGISTER_LOOPER called without request
[  249.321440] binder: 3023 RLIMIT_NICE not set
[  249.322104] binder: 3009:3013 ioctl c0306201 20002fd0 returned -14
[  249.333326] binder: 3009:3016 ioctl c0306201 20005fd0 returned -14
[  249.359203] binder: BINDER_SET_CONTEXT_MGR already set
[  249.359210] binder: 3026:3030 ioctl 40046207 0 returned -16
[  249.359363] binder: 3026:3030 ERROR: BC_REGISTER_LOOPER called without request
[  249.359370] binder: 3030 RLIMIT_NICE not set
[  249.360585] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.360607] binder: 3018:3033 transaction failed 29189/-3, size 0-0 line 2870
[  249.371392] binder: 3034:3036 ioctl 40046205 0 returned -22
[  249.372289] binder: BINDER_SET_CONTEXT_MGR already set
[  249.372296] binder: 3034:3036 ioctl 40046207 0 returned -16
[  249.372369] binder: 3034:3036 ERROR: BC_REGISTER_LOOPER called without request
[  249.372375] binder: 3036 RLIMIT_NICE not set
[  249.374568] binder: 3018:3033 ioctl c0306201 20002fd0 returned -14
[  249.384707] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.384730] binder: 3026:3041 transaction failed 29189/-3, size 0-0 line 2870
[  249.394184] binder: 3018:3033 ioctl c018620b 2000dfe8 returned -14
[  249.396854] binder_alloc: 2089: binder_alloc_buf, no vma
[  249.396878] binder: 3034:3043 transaction failed 29189/-3, size 0-0 line 2870
[  249.399635] binder: 3026:3041 ioctl c0306201 20002fd0 returned -14
[  249.410216] binder: 3018:3033 ioctl 40046205 0 returned -22
[  249.414333] binder: 3026:3041 ioctl c0306201 20005fd0 returned -14
[  249.415651] binder: 3026:3041 ioctl c018620b 2000dfe8 returned -14
[  249.417497] binder: BINDER_SET_CONTEXT_MGR already set
[  249.417504] binder: 3018:3033 ioctl 40046207 0 returned -16
[  249.417535] binder: 3018:3046 ERROR: BC_REGISTER_LOOPER called without request
[  249.417541] binder: 3046 RLIMIT_NICE not set
[  249.418744] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.418761] binder: 3018:3033 transaction failed 29189/-3, size 0-0 line 2870
[  249.420797] binder: 3034:3043 ioctl c0306201 20002fd0 returned -14
[  249.421521] binder: 3018:3033 ioctl c0306201 20002fd0 returned -14
[  249.427005] binder: 3018:3046 BC_FREE_BUFFER u0000000000000000 no match
[  249.427255] binder: 3018:3046 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.427263] binder: 3018:3046 got transaction to invalid handle
[  249.427275] binder: 3018:3046 transaction failed 29201/-22, size 0-8 line 2755
[  249.435357] binder: 3026:3041 ioctl 40046205 0 returned -22
[  249.453523] binder: BINDER_SET_CONTEXT_MGR already set
[  249.453531] binder: 3026:3041 ioctl 40046207 0 returned -16
[  249.459572] binder: 3026:3059 ERROR: BC_REGISTER_LOOPER called without request
[  249.459581] binder: 3059 RLIMIT_NICE not set
[  249.460623] binder: 3034:3043 BC_FREE_BUFFER uffffffffffffffff no match
[  249.460666] binder: 3034:3043 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.460675] binder: 3034:3043 got transaction to invalid handle
[  249.460686] binder: 3034:3043 transaction failed 29201/-22, size 0-8 line 2755
[  249.460703] binder: 3034:3043 ioctl c0306201 20005fd0 returned -14
[  249.461762] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.461812] binder: 3026:3041 transaction failed 29189/-3, size 0-0 line 2870
[  249.462051] binder: 3034:3043 ioctl c018620b 2000dfe8 returned -14
[  249.462833] binder: BINDER_SET_CONTEXT_MGR already set
[  249.462841] binder: 3066:3068 ioctl 40046207 0 returned -16
[  249.462932] binder: 3066:3068 ERROR: BC_REGISTER_LOOPER called without request
[  249.462939] binder: 3068 RLIMIT_NICE not set
[  249.471994] binder: 3026:3041 ioctl c0306201 20002fd0 returned -14
[  249.494749] binder: 3034:3043 ioctl 40046205 0 returned -22
[  249.495885] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.495909] binder: 3066:3075 transaction failed 29189/-3, size 0-0 line 2870
[  249.502162] binder: 3026:3041 BC_FREE_BUFFER uffffffffffffffff no match
[  249.502193] binder: 3026:3041 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.502202] binder: 3026:3041 got transaction to invalid handle
[  249.502211] binder: 3026:3041 transaction failed 29201/-22, size 0-8 line 2755
[  249.502231] binder: 3026:3041 ioctl c0306201 20005fd0 returned -14
[  249.503826] binder: 3026:3059 ioctl c018620b 2000dfe8 returned -14
[  249.504220] binder: BINDER_SET_CONTEXT_MGR already set
[  249.504228] binder: 3034:3043 ioctl 40046207 0 returned -16
[  249.504277] binder: 3034:3071 ERROR: BC_REGISTER_LOOPER called without request
[  249.504284] binder: 3071 RLIMIT_NICE not set
[  249.505487] binder_alloc: 2089: binder_alloc_buf, no vma
[  249.505507] binder: 3034:3043 transaction failed 29189/-3, size 0-0 line 2870
[  249.509638] binder: 3034:3043 ioctl c0306201 20002fd0 returned -14
[  249.517506] binder: 3066:3075 ioctl c0306201 20002fd0 returned -14
[  249.523654] binder: 3034:3071 BC_FREE_BUFFER uffffffffffffffff no match
[  249.523684] binder: 3034:3071 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.523692] binder: 3034:3071 got transaction to invalid handle
[  249.523701] binder: 3034:3071 transaction failed 29201/-22, size 0-8 line 2755
[  249.523716] binder: 3034:3071 ioctl c0306201 20005fd0 returned -14
[  249.546289] binder: 3066:3075 ioctl c018620b 2000dfe8 returned -14
[  249.549475] binder: BINDER_SET_CONTEXT_MGR already set
[  249.549483] binder: 3089:3095 ioctl 40046207 0 returned -16
[  249.549679] binder: 3089:3095 ERROR: BC_REGISTER_LOOPER called without request
[  249.549688] binder: 3095 RLIMIT_NICE not set
[  249.559973] binder: BINDER_SET_CONTEXT_MGR already set
[  249.559980] binder: 3096:3099 ioctl 40046207 0 returned -16
[  249.560133] binder: 3096:3099 ERROR: BC_REGISTER_LOOPER called without request
[  249.560148] binder: 3099 RLIMIT_NICE not set
[  249.561255] binder: 3066:3075 ioctl 40046205 0 returned -22
[  249.585308] binder: BINDER_SET_CONTEXT_MGR already set
[  249.585316] binder: 3066:3075 ioctl 40046207 0 returned -16
[  249.585575] binder: 3066:3102 ERROR: BC_REGISTER_LOOPER called without request
[  249.585581] binder: 3102 RLIMIT_NICE not set
[  249.585703] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.585725] binder: 3089:3107 transaction failed 29189/-3, size 0-0 line 2870
[  249.586775] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.586793] binder: 3066:3075 transaction failed 29189/-3, size 0-0 line 2870
[  249.590301] binder: 3066:3075 ioctl c0306201 20002fd0 returned -14
[  249.595354] binder_alloc: 2089: binder_alloc_buf, no vma
[  249.595377] binder: 3096:3110 transaction failed 29189/-3, size 0-0 line 2870
[  249.595524] binder: 3066:3102 BC_FREE_BUFFER u0000000000000000 no match
[  249.595549] binder: 3066:3102 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.595556] binder: 3066:3102 got transaction to invalid handle
[  249.595567] binder: 3066:3102 transaction failed 29201/-22, size 0-8 line 2755
[  249.601272] binder: 3089:3107 ioctl c0306201 20002fd0 returned -14
[  249.614048] binder: 3096:3110 ioctl c0306201 20002fd0 returned -14
[  249.616650] binder: 3089:3107 ioctl c0306201 20005fd0 returned -14
[  249.618361] binder: 3089:3107 ioctl c018620b 2000dfe8 returned -14
[  249.638809] binder: 3089:3107 ioctl 40046205 0 returned -22
[  249.644458] binder: BINDER_SET_CONTEXT_MGR already set
[  249.644467] binder: 3116:3118 ioctl 40046207 0 returned -16
[  249.644554] binder: 3116:3118 ERROR: BC_REGISTER_LOOPER called without request
[  249.644559] binder: 3118 RLIMIT_NICE not set
[  249.644641] binder: 3096:3110 ioctl c0306201 20005fd0 returned -14
[  249.645913] binder: 3096:3110 ioctl c018620b 2000dfe8 returned -14
[  249.652091] binder: BINDER_SET_CONTEXT_MGR already set
[  249.652099] binder: 3089:3107 ioctl 40046207 0 returned -16
[  249.652137] binder: 3089:3122 ERROR: BC_REGISTER_LOOPER called without request
[  249.652144] binder: 3122 RLIMIT_NICE not set
[  249.653334] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.653354] binder: 3089:3107 transaction failed 29189/-3, size 0-0 line 2870
[  249.656519] binder: 3089:3107 unknown command 0
[  249.656526] binder: 3089:3107 ioctl c0306201 20002fd0 returned -22
[  249.668990] binder: 3089:3107 BC_FREE_BUFFER uffffffffffffffff no match
[  249.669039] binder: 3089:3107 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.669046] binder: 3089:3107 got transaction to invalid handle
[  249.669054] binder: 3089:3107 transaction failed 29201/-22, size 0-8 line 2755
[  249.669070] binder: 3089:3107 ioctl c0306201 20005fd0 returned -14
[  249.669099] binder: 3089:3122 ioctl c018620b 2000dfe8 returned -14
[  249.670170] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.670189] binder: 3116:3137 transaction failed 29189/-3, size 0-0 line 2870
[  249.692352] binder: 3116:3137 ioctl c0306201 20002fd0 returned -14
[  249.694580] binder: BINDER_SET_CONTEXT_MGR already set
[  249.694589] binder: 3096:3110 ioctl 40046207 0 returned -16
[  249.694630] binder: 3096:3134 ERROR: BC_REGISTER_LOOPER called without request
[  249.694638] binder: 3134 RLIMIT_NICE not set
[  249.695879] binder_alloc: 2089: binder_alloc_buf, no vma
[  249.695900] binder: 3096:3110 transaction failed 29189/-3, size 0-0 line 2870
[  249.704439] binder: BINDER_SET_CONTEXT_MGR already set
[  249.704447] binder: 3143:3146 ioctl 40046207 0 returned -16
[  249.704524] binder: 3143:3146 ERROR: BC_REGISTER_LOOPER called without request
[  249.704531] binder: 3146 RLIMIT_NICE not set
[  249.706009] binder: 3116:3137 ioctl c018620b 2000dfe8 returned -14
[  249.713478] binder: 3096:3110 ioctl c0306201 20002fd0 returned -14
[  249.720104] binder: 3096:3134 BC_FREE_BUFFER uffffffffffffffff no match
[  249.720138] binder: 3096:3134 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.720146] binder: 3096:3134 got transaction to invalid handle
[  249.720154] binder: 3096:3134 transaction failed 29201/-22, size 0-8 line 2755
[  249.720168] binder: 3096:3134 ioctl c0306201 20005fd0 returned -14
[  249.730426] binder: 3116:3137 ioctl 40046205 0 returned -22
[  249.740930] binder: BINDER_SET_CONTEXT_MGR already set
[  249.740938] binder: 3153:3154 ioctl 40046207 0 returned -16
[  249.741063] binder: 3153:3154 ERROR: BC_REGISTER_LOOPER called without request
[  249.741070] binder: 3154 RLIMIT_NICE not set
[  249.741644] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.741672] binder: 3143:3151 transaction failed 29189/-3, size 0-0 line 2870
[  249.749368] binder: BINDER_SET_CONTEXT_MGR already set
[  249.749374] binder: 3116:3137 ioctl 40046207 0 returned -16
[  249.749402] binder: 3116:3150 ERROR: BC_REGISTER_LOOPER called without request
[  249.749408] binder: 3150 RLIMIT_NICE not set
[  249.749788] binder: 3143:3151 got reply transaction with no transaction stack
[  249.749796] binder: 3143:3151 transaction failed 29201/-71, size 24-8 line 2670
[  249.750618] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.750638] binder: 3116:3137 transaction failed 29189/-3, size 0-0 line 2870
[  249.753972] binder: 3116:3137 ioctl c0306201 20002fd0 returned -14
[  249.754180] binder: 3143:3151 ioctl c0306201 20005fd0 returned -14
[  249.755483] binder: 3143:3151 ioctl c018620b 2000dfe8 returned -14
[  249.763628] binder: 3116:3150 BC_FREE_BUFFER u0000000000000000 no match
[  249.763656] binder: 3116:3150 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.763664] binder: 3116:3150 got transaction to invalid handle
[  249.763674] binder: 3116:3150 transaction failed 29201/-22, size 0-8 line 2755
[  249.768841] binder_alloc: 2089: binder_alloc_buf, no vma
[  249.768864] binder: 3153:3161 transaction failed 29189/-3, size 0-0 line 2870
[  249.773894] binder: 3143:3151 ioctl 40046205 0 returned -22
[  249.786285] binder: BINDER_SET_CONTEXT_MGR already set
[  249.786293] binder: 3143:3162 ioctl 40046207 0 returned -16
[  249.787483] binder: 3143:3151 ERROR: BC_REGISTER_LOOPER called without request
[  249.787492] binder: 3151 RLIMIT_NICE not set
[  249.787563] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.787585] binder: 3143:3162 transaction failed 29189/-3, size 0-0 line 2870
[  249.788946] binder: 3143:3162 unknown command 1400526783
[  249.788956] binder: 3143:3162 ioctl c0306201 20002fd0 returned -22
[  249.790155] binder: 3153:3161 ioctl c0306201 20002fd0 returned -14
[  249.795086] binder: BINDER_SET_CONTEXT_MGR already set
[  249.795094] binder: 3166:3169 ioctl 40046207 0 returned -16
[  249.795267] binder: 3166:3169 ERROR: BC_REGISTER_LOOPER called without request
[  249.795275] binder: 3169 RLIMIT_NICE not set
[  249.798767] binder: 3143:3171 got reply transaction with no transaction stack
[  249.798785] binder: 3143:3171 transaction failed 29201/-71, size 24-8 line 2670
[  249.802066] binder: 3143:3171 BC_FREE_BUFFER uffffffffffffffff no match
[  249.802098] binder: 3143:3171 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.802105] binder: 3143:3171 got transaction to invalid handle
[  249.802115] binder: 3143:3171 transaction failed 29201/-22, size 0-8 line 2755
[  249.802136] binder: 3143:3171 ioctl c0306201 20005fd0 returned -14
[  249.829530] binder: 3153:3161 ioctl c0306201 20005fd0 returned -14
[  249.830267] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.830290] binder: 3166:3176 transaction failed 29189/-3, size 0-0 line 2870
[  249.831455] binder: 3153:3161 ioctl c018620b 2000dfe8 returned -14
[  249.844266] binder: 3166:3176 ioctl c0306201 20002fd0 returned -14
[  249.845860] binder: 3153:3161 ioctl 40046205 0 returned -22
[  249.845993] binder: BINDER_SET_CONTEXT_MGR already set
[  249.846007] binder: 3175:3179 ioctl 40046207 0 returned -16
[  249.846119] binder: 3175:3179 ERROR: BC_REGISTER_LOOPER called without request
[  249.846127] binder: 3179 RLIMIT_NICE not set
[  249.860551] binder: 3153:3180 ERROR: BC_REGISTER_LOOPER called without request
[  249.860558] binder: 3180 RLIMIT_NICE not set
[  249.861765] binder_alloc: 2089: binder_alloc_buf, no vma
[  249.861786] binder: 3153:3180 transaction failed 29189/-3, size 0-0 line 2870
[  249.864070] binder: BINDER_SET_CONTEXT_MGR already set
[  249.864078] binder: 3153:3161 ioctl 40046207 0 returned -16
[  249.870559] binder: 3153:3161 ioctl c0306201 20002fd0 returned -14
[  249.874619] binder: 3153:3161 got reply transaction with no transaction stack
[  249.874627] binder: 3153:3161 transaction failed 29201/-71, size 24-8 line 2670
[  249.881757] binder: 3166:3176 ioctl c018620b 2000dfe8 returned -14
[  249.885592] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.885616] binder: 3175:3188 transaction failed 29189/-3, size 0-0 line 2870
[  249.886290] binder: 3153:3180 BC_FREE_BUFFER uffffffffffffffff no match
[  249.886320] binder: 3153:3180 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.886327] binder: 3153:3180 got transaction to invalid handle
[  249.886336] binder: 3153:3180 transaction failed 29201/-22, size 0-8 line 2755
[  249.886375] binder: 3153:3180 ioctl c0306201 20005fd0 returned -14
[  249.890294] binder: 3175:3188 got reply transaction with no transaction stack
[  249.890303] binder: 3175:3188 transaction failed 29201/-71, size 24-8 line 2670
[  249.898902] binder: 3175:3188 ioctl c0306201 20005fd0 returned -14
[  249.899243] binder: 3166:3176 ioctl 40046205 0 returned -22
[  249.913827] binder: BINDER_SET_CONTEXT_MGR already set
[  249.913836] binder: 3166:3176 ioctl 40046207 0 returned -16
[  249.914135] binder: 3166:3192 ERROR: BC_REGISTER_LOOPER called without request
[  249.914145] binder: 3192 RLIMIT_NICE not set
[  249.915376] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.915397] binder: 3166:3176 transaction failed 29189/-3, size 0-0 line 2870
[  249.916521] binder: 3175:3188 ioctl 40046205 0 returned -22
[  249.918651] binder: 3166:3176 ioctl c0306201 20002fd0 returned -14
[  249.919327] binder: BINDER_SET_CONTEXT_MGR already set
[  249.919334] binder: 3194:3198 ioctl 40046207 0 returned -16
[  249.919433] binder: 3194:3198 ERROR: BC_REGISTER_LOOPER called without request
[  249.919440] binder: 3198 RLIMIT_NICE not set
[  249.927965] binder: 3166:3192 BC_FREE_BUFFER u0000000000000000 no match
[  249.927997] binder: 3166:3192 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.928060] binder: 3166:3192 got transaction to invalid handle
[  249.928070] binder: 3166:3192 transaction failed 29201/-22, size 0-8 line 2755
[  249.938919] binder: BINDER_SET_CONTEXT_MGR already set
[  249.938930] binder: 3175:3199 ioctl 40046207 0 returned -16
[  249.946592] binder: 3175:3188 ERROR: BC_REGISTER_LOOPER called without request
[  249.946603] binder: 3188 RLIMIT_NICE not set
[  249.946694] binder_alloc: 2840: binder_alloc_buf, no vma
[  249.946720] binder: 3175:3199 transaction failed 29189/-3, size 0-0 line 2870
[  249.948147] binder: 3175:3199 unknown command 1400526783
[  249.948157] binder: 3175:3199 ioctl c0306201 20002fd0 returned -22
[  249.952317] binder_alloc: 2089: binder_alloc_buf, no vma
[  249.952345] binder: 3194:3206 transaction failed 29189/-3, size 0-0 line 2870
[  249.954064] binder: 3175:3207 got reply transaction with no transaction stack
[  249.954074] binder: 3175:3207 transaction failed 29201/-71, size 24-8 line 2670
[  249.955488] binder: 3175:3207 BC_FREE_BUFFER uffffffffffffffff no match
[  249.955522] binder: 3175:3207 IncRefs 0 refcount change on invalid ref 1 ret -22
[  249.955530] binder: 3175:3207 got transaction to invalid handle
[  249.955541] binder: 3175:3207 transaction failed 29201/-22, size 0-8 line 2755
[  249.955563] binder: 3175:3207 ioctl c0306201 20005fd0 returned -14
[  249.965561] binder: BINDER_SET_CONTEXT_MGR already set
[  249.965570] binder: 3205:3208 ioctl 40046207 0 returned -16
[  249.965674] binder: 3205:3208 ERROR: BC_REGISTER_LOOPER called without request
[  249.965682] binder: 3208 RLIMIT_NICE not set
[  249.966813] binder: 3194:3206 ioctl c0306201 20002fd0 returned -14
[  249.989578] binder: 3194:3206 ioctl c0306201 20005fd0 returned -14
[  249.990831] binder: 3194:3206 ioctl c018620b 2000dfe8 returned -14
[  249.993155] binder_alloc: 2086: binder_alloc_buf, no vma
[  249.993178] binder: 3205:3216 transaction failed 29189/-3, size 0-0 line 2870
[  250.012519] binder: BINDER_SET_CONTEXT_MGR already set
[  250.012527] binder: 3214:3217 ioctl 40046207 0 returned -16
[  250.012607] binder: 3214:3217 ERROR: BC_REGISTER_LOOPER called without request
[  250.012614] binder: 3217 RLIMIT_NICE not set
[  250.014479] binder: 3194:3206 ioctl 40046205 0 returned -22
[  250.022699] binder: 3205:3216 ioctl c0306201 20002fd0 returned -14
[  250.036472] binder: BINDER_SET_CONTEXT_MGR already set
[  250.036481] binder: 3194:3206 ioctl 40046207 0 returned -16
[  250.036523] binder: 3194:3222 ERROR: BC_REGISTER_LOOPER called without request
[  250.036532] binder: 3222 RLIMIT_NICE not set
[  250.037908] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.037934] binder: 3194:3206 transaction failed 29189/-3, size 0-0 line 2870
[  250.038588] binder_alloc: 2840: binder_alloc_buf, no vma
[  250.038612] binder: 3214:3226 transaction failed 29189/-3, size 0-0 line 2870
[  250.041465] binder: 3214:3226 got reply transaction with no transaction stack
[  250.041473] binder: 3214:3226 transaction failed 29201/-71, size 24-8 line 2670
[  250.047930] binder: 3194:3206 ioctl c0306201 20002fd0 returned -14
[  250.054691] binder: 3205:3216 ioctl c018620b 2000dfe8 returned -14
[  250.054992] binder: 3194:3222 BC_FREE_BUFFER uffffffffffffffff no match
[  250.055048] binder: 3194:3222 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.055055] binder: 3194:3222 got transaction to invalid handle
[  250.055064] binder: 3194:3222 transaction failed 29201/-22, size 0-8 line 2755
[  250.055078] binder: 3194:3222 ioctl c0306201 20005fd0 returned -14
[  250.063261] binder: 3214:3226 ioctl 40046205 0 returned -22
[  250.069255] binder: 3205:3216 ioctl 40046205 0 returned -22
[  250.077130] binder: BINDER_SET_CONTEXT_MGR already set
[  250.077140] binder: 3214:3228 ioctl 40046207 0 returned -16
[  250.077244] binder: BINDER_SET_CONTEXT_MGR already set
[  250.077251] binder: 3229:3233 ioctl 40046207 0 returned -16
[  250.077528] binder: 3229:3233 ioctl c0306201 20008fd0 returned -14
[  250.077642] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.077665] binder: 3229:3233 transaction failed 29189/-3, size 0-0 line 2870
[  250.078344] binder: 3214:3226 ERROR: BC_REGISTER_LOOPER called without request
[  250.078352] binder: 3226 RLIMIT_NICE not set
[  250.078422] binder_alloc: 2840: binder_alloc_buf, no vma
[  250.078445] binder: 3214:3228 transaction failed 29189/-3, size 0-0 line 2870
[  250.078647] binder: 3229:3233 ioctl c0306201 20002fd0 returned -14
[  250.079397] binder: 3229:3233 ioctl c0306201 20005fd0 returned -14
[  250.083682] binder: 3229:3233 ioctl c018620b 2000dfe8 returned -14
[  250.087240] binder: 3214:3228 unknown command 1400526783
[  250.087249] binder: 3214:3228 ioctl c0306201 20002fd0 returned -22
[  250.088341] binder: BINDER_SET_CONTEXT_MGR already set
[  250.088349] binder: 3205:3216 ioctl 40046207 0 returned -16
[  250.088389] binder: 3205:3230 ERROR: BC_REGISTER_LOOPER called without request
[  250.088397] binder: 3230 RLIMIT_NICE not set
[  250.089958] binder_alloc: 2086: binder_alloc_buf, no vma
[  250.089982] binder: 3205:3216 transaction failed 29189/-3, size 0-0 line 2870
[  250.095090] binder: 3205:3216 ioctl c0306201 20002fd0 returned -14
[  250.096869] binder: 3214:3236 got reply transaction with no transaction stack
[  250.096888] binder: 3214:3236 transaction failed 29201/-71, size 24-8 line 2670
[  250.101265] binder: 3229:3233 ioctl 40046205 0 returned -22
[  250.103821] binder: 3205:3230 BC_FREE_BUFFER u0000000000000000 no match
[  250.103850] binder: 3205:3230 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.103858] binder: 3205:3230 got transaction to invalid handle
[  250.103868] binder: 3205:3230 transaction failed 29201/-22, size 0-8 line 2755
[  250.120338] binder: BINDER_SET_CONTEXT_MGR already set
[  250.120346] binder: 3240:3241 ioctl 40046207 0 returned -16
[  250.120427] binder: 3240:3241 ERROR: BC_REGISTER_LOOPER called without request
[  250.120435] binder: 3241 RLIMIT_NICE not set
[  250.120626] binder: 3229:3239 ioctl c0306201 20008fd0 returned -14
[  250.121817] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.121839] binder: 3229:3233 transaction failed 29189/-3, size 0-0 line 2870
[  250.154494] binder_alloc: 2840: binder_alloc_buf, no vma
[  250.154519] binder: 3240:3248 transaction failed 29189/-3, size 0-0 line 2870
[  250.155278] binder: BINDER_SET_CONTEXT_MGR already set
[  250.155286] binder: 3242:3244 ioctl 40046207 0 returned -16
[  250.155385] binder: 3242:3244 ERROR: BC_REGISTER_LOOPER called without request
[  250.155394] binder: 3244 RLIMIT_NICE not set
[  250.170887] binder: 3240:3248 got reply transaction with no transaction stack
[  250.170898] binder: 3240:3248 transaction failed 29201/-71, size 24-8 line 2670
[  250.178491] binder: BINDER_SET_CONTEXT_MGR already set
[  250.178500] binder: 3247:3253 ioctl 40046207 0 returned -16
[  250.178993] binder: 3247:3253 ioctl c0306201 20008fd0 returned -14
[  250.179170] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.179192] binder: 3247:3253 transaction failed 29189/-3, size 0-0 line 2870
[  250.180630] binder: 3247:3253 ioctl c0306201 20002fd0 returned -14
[  250.181607] binder: 3247:3253 ioctl c0306201 20005fd0 returned -14
[  250.181746] binder: 3247:3253 ioctl c018620b 2000dfe8 returned -14
[  250.184328] binder_alloc: 2086: binder_alloc_buf, no vma
[  250.184353] binder: 3242:3256 transaction failed 29189/-3, size 0-0 line 2870
[  250.193062] binder: 3240:3248 ioctl 40046205 0 returned -22
[  250.193106] binder: 3247:3253 ioctl 40046205 0 returned -22
[  250.193391] binder: 3242:3256 ioctl c0306201 20002fd0 returned -14
[  250.212893] binder: BINDER_SET_CONTEXT_MGR already set
[  250.212902] binder: 3240:3259 ioctl 40046207 0 returned -16
[  250.219966] binder: 3242:3256 ioctl c018620b 2000dfe8 returned -14
[  250.220978] binder: 3240:3248 ERROR: BC_REGISTER_LOOPER called without request
[  250.220986] binder: 3248 RLIMIT_NICE not set
[  250.221085] binder_alloc: 2840: binder_alloc_buf, no vma
[  250.221106] binder: 3240:3259 transaction failed 29189/-3, size 0-0 line 2870
[  250.222448] binder: 3247:3253 ioctl c0306201 20008fd0 returned -14
[  250.222700] binder: 3240:3259 unknown command 1400526783
[  250.222708] binder: 3240:3259 ioctl c0306201 20002fd0 returned -22
[  250.222909] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.222929] binder: 3247:3253 transaction failed 29189/-3, size 0-0 line 2870
[  250.225148] binder: 3240:3265 got reply transaction with no transaction stack
[  250.225157] binder: 3240:3265 transaction failed 29201/-71, size 24-8 line 2670
[  250.233708] binder: 3242:3256 ioctl 40046205 0 returned -22
[  250.262117] binder: BINDER_SET_CONTEXT_MGR already set
[  250.262125] binder: 3272:3274 ioctl 40046207 0 returned -16
[  250.262191] binder: 3272:3274 ERROR: BC_REGISTER_LOOPER called without request
[  250.262199] binder: 3274 RLIMIT_NICE not set
[  250.277245] binder: BINDER_SET_CONTEXT_MGR already set
[  250.277257] binder: 3242:3256 ioctl 40046207 0 returned -16
[  250.277305] binder: 3242:3270 ERROR: BC_REGISTER_LOOPER called without request
[  250.277314] binder: 3270 RLIMIT_NICE not set
[  250.278573] binder_alloc: 2086: binder_alloc_buf, no vma
[  250.278599] binder: 3242:3256 transaction failed 29189/-3, size 0-0 line 2870
[  250.279851] binder: BINDER_SET_CONTEXT_MGR already set
[  250.279858] binder: 3276:3278 ioctl 40046207 0 returned -16
[  250.279965] binder: 3276:3278 ERROR: BC_REGISTER_LOOPER called without request
[  250.279978] binder: 3276:3278 ioctl c0306201 20008fd0 returned -14
[  250.280116] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.280135] binder: 3276:3278 transaction failed 29189/-3, size 0-0 line 2870
[  250.282331] binder: 3242:3256 ioctl c0306201 20002fd0 returned -14
[  250.282796] binder: 3276:3278 ioctl c0306201 20002fd0 returned -14
[  250.285218] binder: 3276:3278 ioctl c0306201 20005fd0 returned -14
[  250.285391] binder: 3276:3278 ioctl c018620b 2000dfe8 returned -14
[  250.293335] binder: 3242:3270 BC_FREE_BUFFER u0000000000000000 no match
[  250.293369] binder: 3242:3270 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.293378] binder: 3242:3270 got transaction to invalid handle
[  250.293390] binder: 3242:3270 transaction failed 29201/-22, size 0-8 line 2755
[  250.294228] binder_alloc: 2840: binder_alloc_buf, no vma
[  250.294251] binder: 3272:3279 transaction failed 29189/-3, size 0-0 line 2870
[  250.308073] binder: 3276:3278 ioctl 40046205 0 returned -22
[  250.316113] binder: BINDER_SET_CONTEXT_MGR already set
[  250.316122] binder: 3284:3286 ioctl 40046207 0 returned -16
[  250.316298] binder: 3284:3286 ERROR: BC_REGISTER_LOOPER called without request
[  250.316306] binder: 3286 RLIMIT_NICE not set
[  250.330817] binder: 3276:3280 ERROR: BC_REGISTER_LOOPER called without request
[  250.330833] binder: 3276:3280 ioctl c0306201 20008fd0 returned -14
[  250.333688] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.333712] binder: 3276:3280 transaction failed 29189/-3, size 0-0 line 2870
[  250.334212] binder: BINDER_SET_CONTEXT_MGR already set
[  250.334221] binder: 3276:3278 ioctl 40046207 0 returned -16
[  250.334374] binder: 3272:3279 ioctl 40046205 0 returned -22
[  250.338255] binder: 3276:3280 ioctl c0306201 20002fd0 returned -14
[  250.342144] binder: BINDER_SET_CONTEXT_MGR already set
[  250.342154] binder: 3272:3288 ioctl 40046207 0 returned -16
[  250.343475] binder_alloc: 2840: binder_alloc_buf, no vma
[  250.343491] binder: 3276:3278 ioctl c0306201 2000afd0 returned -14
[  250.343500] binder: 3272:3288 transaction failed 29189/-3, size 0-0 line 2870
[  250.343520] binder: 3272:3279 ERROR: BC_REGISTER_LOOPER called without request
[  250.343530] binder: 3279 RLIMIT_NICE not set
[  250.348953] binder: 3276:3278 BC_FREE_BUFFER uffffffffffffffff no match
[  250.348987] binder: 3276:3278 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.348996] binder: 3276:3278 got transaction to invalid handle
[  250.349012] binder: 3276:3278 transaction failed 29201/-22, size 0-8 line 2755
[  250.349051] binder: 3276:3278 ioctl c0306201 20005fd0 returned -14
[  250.349229] binder: 3276:3278 ioctl c018620b 2000dfe8 returned -14
[  250.362870] binder: BINDER_SET_CONTEXT_MGR already set
[  250.362877] binder: 3297:3299 ioctl 40046207 0 returned -16
[  250.362953] binder: 3297:3299 ERROR: BC_REGISTER_LOOPER called without request
[  250.362962] binder: 3299 RLIMIT_NICE not set
[  250.367319] binder_alloc: 2086: binder_alloc_buf, no vma
[  250.367376] binder: 3284:3295 transaction failed 29189/-3, size 0-0 line 2870
[  250.374117] binder: BINDER_SET_CONTEXT_MGR already set
[  250.374124] binder: 3298:3300 ioctl 40046207 0 returned -16
[  250.374542] binder: 3298:3300 ERROR: BC_REGISTER_LOOPER called without request
[  250.374559] binder: 3298:3300 ioctl c0306201 20008fd0 returned -14
[  250.374685] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.374708] binder: 3298:3300 transaction failed 29189/-3, size 0-0 line 2870
[  250.375486] binder: 3298:3300 ioctl c0306201 20002fd0 returned -14
[  250.375842] binder: 3284:3295 ioctl c0306201 20002fd0 returned -14
[  250.376564] binder: 3298:3300 ioctl c0306201 20005fd0 returned -14
[  250.376740] binder: 3298:3300 ioctl c018620b 2000dfe8 returned -14
[  250.385144] binder: 3298:3300 ioctl 40046205 0 returned -22
[  250.387278] binder_alloc: 2840: binder_alloc_buf, no vma
[  250.387303] binder: 3297:3303 transaction failed 29189/-3, size 0-0 line 2870
[  250.388952] binder: 3284:3295 ioctl c018620b 2000dfe8 returned -14
[  250.408959] binder: 3298:3302 ERROR: BC_REGISTER_LOOPER called without request
[  250.408978] binder: 3298:3302 ioctl c0306201 20008fd0 returned -14
[  250.409766] binder: BINDER_SET_CONTEXT_MGR already set
[  250.409773] binder: 3298:3300 ioctl 40046207 0 returned -16
[  250.410841] binder: 3284:3295 ioctl 40046205 0 returned -22
[  250.412096] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.412120] binder: 3298:3300 transaction failed 29189/-3, size 0-0 line 2870
[  250.428052] binder: 3298:3300 unknown command 0
[  250.428059] binder: 3298:3300 ioctl c0306201 20002fd0 returned -22
[  250.433355] binder: 3297:3303 ioctl 40046205 0 returned -22
[  250.435845] binder: BINDER_SET_CONTEXT_MGR already set
[  250.435853] binder: 3297:3312 ioctl 40046207 0 returned -16
[  250.437144] binder: 3297:3303 ERROR: BC_REGISTER_LOOPER called without request
[  250.437152] binder: 3303 RLIMIT_NICE not set
[  250.437309] binder_alloc: 2840: binder_alloc_buf, no vma
[  250.437330] binder: 3297:3312 transaction failed 29189/-3, size 0-0 line 2870
[  250.439676] binder: BINDER_SET_CONTEXT_MGR already set
[  250.439685] binder: 3284:3295 ioctl 40046207 0 returned -16
[  250.439782] binder: 3284:3310 ERROR: BC_REGISTER_LOOPER called without request
[  250.439789] binder: 3310 RLIMIT_NICE not set
[  250.441689] binder_alloc: 2086: binder_alloc_buf, no vma
[  250.441710] binder: 3284:3295 transaction failed 29189/-3, size 0-0 line 2870
[  250.442045] binder: 3298:3302 BC_FREE_BUFFER uffffffffffffffff no match
[  250.442078] binder: 3298:3302 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.442086] binder: 3298:3302 got transaction to invalid handle
[  250.442096] binder: 3298:3302 transaction failed 29201/-22, size 0-8 line 2755
[  250.442110] binder: 3298:3302 ioctl c0306201 20005fd0 returned -14
[  250.457976] binder: 3284:3295 unknown command 0
[  250.457986] binder: 3284:3295 ioctl c0306201 20002fd0 returned -22
[  250.475069] binder: BINDER_SET_CONTEXT_MGR already set
[  250.475078] binder: 3323:3324 ioctl 40046207 0 returned -16
[  250.475161] binder: 3323:3324 ERROR: BC_REGISTER_LOOPER called without request
[  250.475170] binder: 3324 RLIMIT_NICE not set
[  250.481466] binder: 3318:3327 ERROR: BC_REGISTER_LOOPER called without request
[  250.481474] binder: 3327 RLIMIT_NICE not set
[  250.481642] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.481662] binder: 3318:3327 transaction failed 29189/-3, size 0-0 line 2870
[  250.482481] binder: 3318:3327 ioctl c0306201 20002fd0 returned -14
[  250.483780] binder: 3318:3327 ioctl c0306201 20005fd0 returned -14
[  250.483906] binder: 3284:3310 BC_FREE_BUFFER u0000000000000000 no match
[  250.483941] binder: 3284:3310 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.483951] binder: 3284:3310 got transaction to invalid handle
[  250.483963] binder: 3284:3310 transaction failed 29201/-22, size 0-8 line 2755
[  250.484244] binder: 3318:3327 ioctl c018620b 2000dfe8 returned -14
[  250.500366] binder: 3318:3327 ioctl 40046205 0 returned -22
[  250.515296] binder: 3318:3330 ERROR: BC_REGISTER_LOOPER called without request
[  250.515306] binder: 3330 RLIMIT_NICE not set
[  250.516530] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.516552] binder: 3318:3327 transaction failed 29189/-3, size 0-0 line 2870
[  250.517990] binder: BINDER_SET_CONTEXT_MGR already set
[  250.517998] binder: 3332:3334 ioctl 40046207 0 returned -16
[  250.518182] binder: 3332:3334 ERROR: BC_REGISTER_LOOPER called without request
[  250.518190] binder: 3334 RLIMIT_NICE not set
[  250.519380] binder: 3318:3327 ioctl c0306201 20002fd0 returned -14
[  250.525410] binder: 3318:3330 BC_FREE_BUFFER uffffffffffffffff no match
[  250.525440] binder: 3318:3330 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.525448] binder: 3318:3330 got transaction to invalid handle
[  250.525459] binder: 3318:3330 transaction failed 29201/-22, size 0-8 line 2755
[  250.525475] binder: 3318:3330 ioctl c0306201 20005fd0 returned -14
[  250.540656] binder: 3323:3335 ioctl 40046205 0 returned -22
[  250.541413] binder: BINDER_SET_CONTEXT_MGR already set
[  250.541422] binder: 3323:3338 ioctl 40046207 0 returned -16
[  250.554185] binder_alloc: 2086: binder_alloc_buf, no vma
[  250.554211] binder: 3332:3348 transaction failed 29189/-3, size 0-0 line 2870
[  250.557228] binder: BINDER_SET_CONTEXT_MGR already set
[  250.557236] binder: 3340:3343 ioctl 40046207 0 returned -16
[  250.557412] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.557434] binder: 3340:3343 transaction failed 29189/-3, size 0-0 line 2870
[  250.558675] binder: 3340:3343 ioctl c0306201 20002fd0 returned -14
[  250.559475] binder: 3340:3343 ioctl c0306201 20005fd0 returned -14
[  250.564147] binder: 3340:3343 ioctl c018620b 2000dfe8 returned -14
[  250.569415] binder: BINDER_SET_CONTEXT_MGR already set
[  250.569423] binder: 3349:3350 ioctl 40046207 0 returned -16
[  250.571259] binder: 3332:3348 ioctl c0306201 20002fd0 returned -14
[  250.576651] binder: 3340:3343 ioctl 40046205 0 returned -22
[  250.591755] binder: 3332:3348 ioctl c018620b 2000dfe8 returned -14
[  250.596842] binder: 3349:3350 ioctl 40046205 0 returned -22
[  250.602388] binder: BINDER_SET_CONTEXT_MGR already set
[  250.602397] binder: 3349:3354 ioctl 40046207 0 returned -16
[  250.604227] binder: BINDER_SET_CONTEXT_MGR already set
[  250.604236] binder: 3340:3343 ioctl 40046207 0 returned -16
[  250.612899] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.612917] binder: 3340:3343 transaction failed 29189/-3, size 0-0 line 2870
[  250.613630] binder: 3332:3348 ioctl 40046205 0 returned -22
[  250.630828] binder: 3340:3343 unknown command 0
[  250.630837] binder: 3340:3343 ioctl c0306201 20002fd0 returned -22
[  250.638915] binder: BINDER_SET_CONTEXT_MGR already set
[  250.638924] binder: 3332:3348 ioctl 40046207 0 returned -16
[  250.638961] binder: 3332:3359 ERROR: BC_REGISTER_LOOPER called without request
[  250.638970] binder: 3359 RLIMIT_NICE not set
[  250.639916] binder: 3340:3352 BC_FREE_BUFFER uffffffffffffffff no match
[  250.639946] binder: 3340:3352 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.639954] binder: 3340:3352 got transaction to invalid handle
[  250.639964] binder: 3340:3352 transaction failed 29201/-22, size 0-8 line 2755
[  250.639978] binder: 3340:3352 ioctl c0306201 20005fd0 returned -14
[  250.646071] binder_alloc: 2086: binder_alloc_buf, no vma
[  250.646091] binder: 3332:3348 transaction failed 29189/-3, size 0-0 line 2870
[  250.648978] binder: 3332:3348 ioctl c0306201 20002fd0 returned -14
[  250.659243] binder: BINDER_SET_CONTEXT_MGR already set
[  250.659251] binder: 3365:3368 ioctl 40046207 0 returned -16
[  250.659559] binder: 3332:3359 BC_FREE_BUFFER u0000000000000000 no match
[  250.659592] binder: 3332:3359 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.659602] binder: 3332:3359 got transaction to invalid handle
[  250.659612] binder: 3332:3359 transaction failed 29201/-22, size 0-8 line 2755
[  250.680929] binder: BINDER_SET_CONTEXT_MGR already set
[  250.680939] binder: 3372:3375 ioctl 40046207 0 returned -16
[  250.682289] binder: 3365:3368 ioctl 40046205 0 returned -22
[  250.706216] binder: BINDER_SET_CONTEXT_MGR already set
[  250.706224] binder: 3379:3382 ioctl 40046207 0 returned -16
[  250.706320] binder: 3379:3382 ERROR: BC_REGISTER_LOOPER called without request
[  250.706329] binder: 3382 RLIMIT_NICE not set
[  250.711719] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.711744] binder: 3372:3386 transaction failed 29189/-3, size 0-0 line 2870
[  250.717858] binder: BINDER_SET_CONTEXT_MGR already set
[  250.717910] binder: 3383:3384 ioctl 40046207 0 returned -16
[  250.719472] binder: 3372:3386 ioctl c0306201 20002fd0 returned -14
[  250.735950] binder_alloc: 2086: binder_alloc_buf, no vma
[  250.735975] binder: 3379:3396 transaction failed 29189/-3, size 0-0 line 2870
[  250.736948] binder: 3383:3384 ioctl 40046205 0 returned -22
[  250.737952] binder: 3372:3386 ioctl c0306201 20005fd0 returned -14
[  250.739182] binder: 3372:3386 ioctl c018620b 2000dfe8 returned -14
[  250.739522] binder: BINDER_SET_CONTEXT_MGR already set
[  250.739530] binder: 3383:3392 ioctl 40046207 0 returned -16
[  250.756625] binder: 3379:3396 ioctl c0306201 20002fd0 returned -14
[  250.757912] binder: 3372:3386 ioctl 40046205 0 returned -22
[  250.778688] binder: 3379:3396 ioctl c018620b 2000dfe8 returned -14
[  250.781241] binder: BINDER_SET_CONTEXT_MGR already set
[  250.781288] binder: 3402:3404 ioctl 40046207 0 returned -16
[  250.791319] binder: BINDER_SET_CONTEXT_MGR already set
[  250.791328] binder: 3372:3386 ioctl 40046207 0 returned -16
[  250.792395] binder: 3402:3404 ioctl 40046205 0 returned -22
[  250.792676] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.792699] binder: 3372:3386 transaction failed 29189/-3, size 0-0 line 2870
[  250.795540] binder: 3372:3386 ioctl c0306201 20002fd0 returned -14
[  250.804549] binder: 3379:3396 ioctl 40046205 0 returned -22
[  250.814810] binder: 3372:3399 BC_FREE_BUFFER uffffffffffffffff no match
[  250.814852] binder: 3372:3399 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.814861] binder: 3372:3399 got transaction to invalid handle
[  250.814873] binder: 3372:3399 transaction failed 29201/-22, size 0-8 line 2755
[  250.814895] binder: 3372:3399 ioctl c0306201 20005fd0 returned -14
[  250.820060] binder: BINDER_SET_CONTEXT_MGR already set
[  250.820070] binder: 3379:3396 ioctl 40046207 0 returned -16
[  250.820113] binder: 3379:3409 ERROR: BC_REGISTER_LOOPER called without request
[  250.820125] binder: 3409 RLIMIT_NICE not set
[  250.827370] binder_alloc: 2086: binder_alloc_buf, no vma
[  250.827396] binder: 3379:3396 transaction failed 29189/-3, size 0-0 line 2870
[  250.842996] binder: 3379:3396 ioctl c0306201 20002fd0 returned -14
[  250.858283] binder: 3379:3409 BC_FREE_BUFFER u0000000000000000 no match
[  250.858326] binder: 3379:3409 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.858335] binder: 3379:3409 got transaction to invalid handle
[  250.858347] binder: 3379:3409 transaction failed 29201/-22, size 0-8 line 2755
[  250.878525] binder: 3415:3417 ioctl 40046205 0 returned -22
[  250.883980] binder: BINDER_SET_CONTEXT_MGR already set
[  250.883989] binder: 3415:3417 ioctl 40046207 0 returned -16
[  250.884055] binder: 3415:3424 ERROR: BC_REGISTER_LOOPER called without request
[  250.885275] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.885297] binder: 3415:3417 transaction failed 29189/-3, size 0-0 line 2870
[  250.888310] binder: 3415:3417 ioctl c0306201 20002fd0 returned -14
[  250.893366] binder: 3415:3424 BC_FREE_BUFFER uffffffffffffffff no match
[  250.893394] binder: 3415:3424 IncRefs 0 refcount change on invalid ref 1 ret -22
[  250.893403] binder: 3415:3424 got transaction to invalid handle
[  250.893413] binder: 3415:3424 transaction failed 29201/-22, size 0-8 line 2755
[  250.893429] binder: 3415:3424 ioctl c0306201 20005fd0 returned -14
[  250.897145] binder: BINDER_SET_CONTEXT_MGR already set
[  250.897153] binder: 3426:3431 ioctl 40046207 0 returned -16
[  250.908905] binder: BINDER_SET_CONTEXT_MGR already set
[  250.908912] binder: 3434:3435 ioctl 40046207 0 returned -16
[  250.908989] binder: 3434:3435 ERROR: BC_REGISTER_LOOPER called without request
[  250.908996] binder: 3435 RLIMIT_NICE not set
[  250.921866] binder: BINDER_SET_CONTEXT_MGR already set
[  250.921874] binder: 3427:3432 ioctl 40046207 0 returned -16
[  250.922027] binder: 3427:3432 ERROR: BC_REGISTER_LOOPER called without request
[  250.922038] binder: 3432 RLIMIT_NICE not set
[  250.923780] binder: BINDER_SET_CONTEXT_MGR already set
[  250.923787] binder: 3439:3442 ioctl 40046207 0 returned -16
[  250.935392] binder_alloc: 2089: binder_alloc_buf, no vma
[  250.935414] binder: 3434:3444 transaction failed 29189/-3, size 0-0 line 2870
[  250.952309] binder: 3434:3444 ioctl c0306201 20002fd0 returned -14
[  250.954397] binder_alloc: 2086: binder_alloc_buf, no vma
[  250.954426] binder: 3427:3452 transaction failed 29189/-3, size 0-0 line 2870
[  250.964908] binder: BINDER_SET_CONTEXT_MGR already set
[  250.964917] binder: 3445:3450 ioctl 40046207 0 returned -16
[  250.971712] binder: BINDER_SET_CONTEXT_MGR already set
[  250.971728] binder: 3445:3454 ioctl 40046207 0 returned -16
[  250.988974] binder: 3427:3452 ioctl c0306201 20002fd0 returned -14
[  251.006290] binder: 3434:3444 ioctl c0306201 20005fd0 returned -14
[  251.007687] binder: 3434:3444 ioctl c018620b 2000dfe8 returned -14
[  251.040421] binder: 3434:3444 ioctl 40046205 0 returned -22
[  251.041706] binder: 3427:3452 ioctl c018620b 2000dfe8 returned -14
[  251.061414] binder: BINDER_SET_CONTEXT_MGR already set
[  251.061426] binder: 3434:3444 ioctl 40046207 0 returned -16
[  251.061469] binder: 3434:3468 ERROR: BC_REGISTER_LOOPER called without request
[  251.061480] binder: 3468 RLIMIT_NICE not set
[  251.061649] binder: 3427:3452 ioctl 40046205 0 returned -22
[  251.062714] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.062740] binder: 3434:3444 transaction failed 29189/-3, size 0-0 line 2870
[  251.065732] binder: 3434:3444 ioctl c0306201 20002fd0 returned -14
[  251.077543] binder: 3434:3468 BC_FREE_BUFFER uffffffffffffffff no match
[  251.077575] binder: 3434:3468 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.077583] binder: 3434:3468 got transaction to invalid handle
[  251.077593] binder: 3434:3468 transaction failed 29201/-22, size 0-8 line 2755
[  251.077608] binder: 3434:3468 ioctl c0306201 20005fd0 returned -14
[  251.082084] binder: BINDER_SET_CONTEXT_MGR already set
[  251.082092] binder: 3427:3452 ioctl 40046207 0 returned -16
[  251.082129] binder: 3427:3471 ERROR: BC_REGISTER_LOOPER called without request
[  251.082139] binder: 3471 RLIMIT_NICE not set
[  251.087573] binder_alloc: 2086: binder_alloc_buf, no vma
[  251.087598] binder: 3427:3452 transaction failed 29189/-3, size 0-0 line 2870
[  251.100445] binder: 3427:3452 ioctl c0306201 20002fd0 returned -14
[  251.101808] binder: BINDER_SET_CONTEXT_MGR already set
[  251.101816] binder: 3478:3479 ioctl 40046207 0 returned -16
[  251.101898] binder: 3478:3479 ERROR: BC_REGISTER_LOOPER called without request
[  251.101905] binder: 3479 RLIMIT_NICE not set
[  251.113411] binder: 3427:3471 BC_FREE_BUFFER u0000000000000000 no match
[  251.113444] binder: 3427:3471 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.113453] binder: 3427:3471 got transaction to invalid handle
[  251.113465] binder: 3427:3471 transaction failed 29201/-22, size 0-8 line 2755
[  251.134473] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.134496] binder: 3478:3490 transaction failed 29189/-3, size 0-0 line 2870
[  251.142622] binder: BINDER_SET_CONTEXT_MGR already set
[  251.142630] binder: 3489:3492 ioctl 40046207 0 returned -16
[  251.142713] binder: 3489:3492 ERROR: BC_REGISTER_LOOPER called without request
[  251.142720] binder: 3492 RLIMIT_NICE not set
[  251.152910] binder: 3478:3490 ioctl c0306201 20002fd0 returned -14
[  251.167228] binder: 3478:3490 ioctl c0306201 20005fd0 returned -14
[  251.167777] binder_alloc: 2086: binder_alloc_buf, no vma
[  251.167830] binder: 3489:3500 transaction failed 29189/-3, size 0-0 line 2870
[  251.170338] binder: 3478:3490 ioctl c018620b 2000dfe8 returned -14
[  251.184569] binder: 3478:3490 ioctl 40046205 0 returned -22
[  251.188068] binder: BINDER_SET_CONTEXT_MGR already set
[  251.188075] binder: 3502:3506 ioctl 40046207 0 returned -16
[  251.188237] binder: 3502:3506 ERROR: BC_REGISTER_LOOPER called without request
[  251.188245] binder: 3506 RLIMIT_NICE not set
[  251.199952] binder: 3489:3500 ioctl c0306201 20002fd0 returned -14
[  251.201149] binder: BINDER_SET_CONTEXT_MGR already set
[  251.201157] binder: 3478:3490 ioctl 40046207 0 returned -16
[  251.201196] binder: 3478:3504 ERROR: BC_REGISTER_LOOPER called without request
[  251.201204] binder: 3504 RLIMIT_NICE not set
[  251.202757] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.202777] binder: 3478:3490 transaction failed 29189/-3, size 0-0 line 2870
[  251.207538] binder: 3478:3490 unknown command 0
[  251.207546] binder: 3478:3490 ioctl c0306201 20002fd0 returned -22
[  251.213722] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.213745] binder: 3502:3511 transaction failed 29189/-3, size 0-0 line 2870
[  251.215137] binder: 3478:3504 BC_FREE_BUFFER uffffffffffffffff no match
[  251.215182] binder: 3478:3504 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.215190] binder: 3478:3504 got transaction to invalid handle
[  251.215199] binder: 3478:3504 transaction failed 29201/-22, size 0-8 line 2755
[  251.215214] binder: 3478:3504 ioctl c0306201 20005fd0 returned -14
[  251.231916] binder: 3489:3500 ioctl c018620b 2000dfe8 returned -14
[  251.236211] binder: 3502:3511 ioctl c0306201 20002fd0 returned -14
[  251.240329] binder: BINDER_SET_CONTEXT_MGR already set
[  251.240337] binder: 3515:3517 ioctl 40046207 0 returned -16
[  251.240427] binder: 3515:3517 ERROR: BC_REGISTER_LOOPER called without request
[  251.240436] binder: 3517 RLIMIT_NICE not set
[  251.254379] binder: 3502:3511 ioctl c018620b 2000dfe8 returned -14
[  251.254664] binder: 3489:3500 ioctl 40046205 0 returned -22
[  251.263692] binder: BINDER_SET_CONTEXT_MGR already set
[  251.263731] binder: 3489:3500 ioctl 40046207 0 returned -16
[  251.263899] binder: 3489:3519 ERROR: BC_REGISTER_LOOPER called without request
[  251.263906] binder: 3519 RLIMIT_NICE not set
[  251.265123] binder_alloc: 2086: binder_alloc_buf, no vma
[  251.265145] binder: 3489:3500 transaction failed 29189/-3, size 0-0 line 2870
[  251.265273] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.265293] binder: 3515:3522 transaction failed 29189/-3, size 0-0 line 2870
[  251.268228] binder: 3489:3500 ioctl c0306201 20002fd0 returned -14
[  251.268323] binder: 3502:3511 ioctl 40046205 0 returned -22
[  251.273101] binder: 3515:3522 ioctl c0306201 20002fd0 returned -14
[  251.276542] binder: BINDER_SET_CONTEXT_MGR already set
[  251.276549] binder: 3502:3511 ioctl 40046207 0 returned -16
[  251.277069] binder: 3489:3519 BC_FREE_BUFFER u0000000000000000 no match
[  251.277101] binder: 3489:3519 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.277110] binder: 3489:3519 got transaction to invalid handle
[  251.277121] binder: 3489:3519 transaction failed 29201/-22, size 0-8 line 2755
[  251.277294] binder: 3502:3524 ERROR: BC_REGISTER_LOOPER called without request
[  251.277301] binder: 3524 RLIMIT_NICE not set
[  251.278516] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.278537] binder: 3502:3511 transaction failed 29189/-3, size 0-0 line 2870
[  251.282120] binder: 3502:3511 ioctl c0306201 20002fd0 returned -14
[  251.286875] binder: 3515:3522 ioctl c0306201 20005fd0 returned -14
[  251.287245] binder: 3502:3524 BC_FREE_BUFFER u0000000000000000 no match
[  251.287273] binder: 3502:3524 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.287281] binder: 3502:3524 got transaction to invalid handle
[  251.287293] binder: 3502:3524 transaction failed 29201/-22, size 0-8 line 2755
[  251.292350] binder: 3515:3522 ioctl c018620b 2000dfe8 returned -14
[  251.312989] binder: 3515:3522 ioctl 40046205 0 returned -22
[  251.314381] binder: BINDER_SET_CONTEXT_MGR already set
[  251.314390] binder: 3527:3532 ioctl 40046207 0 returned -16
[  251.314501] binder: 3527:3532 ERROR: BC_REGISTER_LOOPER called without request
[  251.314509] binder: 3532 RLIMIT_NICE not set
[  251.319474] binder: BINDER_SET_CONTEXT_MGR already set
[  251.319481] binder: 3530:3533 ioctl 40046207 0 returned -16
[  251.319652] binder: 3530:3533 ERROR: BC_REGISTER_LOOPER called without request
[  251.319659] binder: 3533 RLIMIT_NICE not set
[  251.320968] binder: BINDER_SET_CONTEXT_MGR already set
[  251.321020] binder: 3515:3522 ioctl 40046207 0 returned -16
[  251.321219] binder: 3515:3531 ERROR: BC_REGISTER_LOOPER called without request
[  251.321226] binder: 3531 RLIMIT_NICE not set
[  251.322482] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.322506] binder: 3515:3522 transaction failed 29189/-3, size 0-0 line 2870
[  251.331361] binder: 3515:3522 ioctl c0306201 20002fd0 returned -14
[  251.336836] binder: 3515:3531 BC_FREE_BUFFER uffffffffffffffff no match
[  251.336869] binder: 3515:3531 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.336877] binder: 3515:3531 got transaction to invalid handle
[  251.336887] binder: 3515:3531 transaction failed 29201/-22, size 0-8 line 2755
[  251.336902] binder: 3515:3531 ioctl c0306201 20005fd0 returned -14
[  251.340837] binder_alloc: 2086: binder_alloc_buf, no vma
[  251.340862] binder: 3527:3538 transaction failed 29189/-3, size 0-0 line 2870
[  251.351351] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.351376] binder: 3530:3539 transaction failed 29189/-3, size 0-0 line 2870
[  251.358838] binder: 3527:3538 ioctl c0306201 20002fd0 returned -14
[  251.360458] binder: BINDER_SET_CONTEXT_MGR already set
[  251.360466] binder: 3540:3541 ioctl 40046207 0 returned -16
[  251.360560] binder: 3540:3541 ERROR: BC_REGISTER_LOOPER called without request
[  251.360567] binder: 3541 RLIMIT_NICE not set
[  251.374115] binder: 3530:3539 ioctl c0306201 20002fd0 returned -14
[  251.391159] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.391194] binder: 3540:3543 transaction failed 29189/-3, size 0-0 line 2870
[  251.399331] binder: 3530:3539 ioctl c018620b 2000dfe8 returned -14
[  251.405593] binder: 3540:3543 ioctl c0306201 20002fd0 returned -14
[  251.411936] binder: 3527:3538 ioctl c018620b 2000dfe8 returned -14
[  251.414761] binder: 3530:3539 ioctl 40046205 0 returned -22
[  251.417720] binder: 3540:3543 ioctl c0306201 20005fd0 returned -14
[  251.418962] binder: 3540:3543 ioctl c018620b 2000dfe8 returned -14
[  251.423637] binder: BINDER_SET_CONTEXT_MGR already set
[  251.423645] binder: 3530:3539 ioctl 40046207 0 returned -16
[  251.423679] binder: 3530:3553 ERROR: BC_REGISTER_LOOPER called without request
[  251.423686] binder: 3553 RLIMIT_NICE not set
[  251.424876] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.424899] binder: 3530:3539 transaction failed 29189/-3, size 0-0 line 2870
[  251.425431] binder: 3527:3538 ioctl 40046205 0 returned -22
[  251.427868] binder: 3530:3539 unknown command 0
[  251.427875] binder: 3530:3539 ioctl c0306201 20002fd0 returned -22
[  251.448742] binder: 3530:3553 BC_FREE_BUFFER u0000000000000000 no match
[  251.448771] binder: 3530:3553 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.448786] binder: 3530:3553 got transaction to invalid handle
[  251.448798] binder: 3530:3553 transaction failed 29201/-22, size 0-8 line 2755
[  251.450230] binder: 3540:3543 ioctl 40046205 0 returned -22
[  251.456738] binder: BINDER_SET_CONTEXT_MGR already set
[  251.456748] binder: 3527:3538 ioctl 40046207 0 returned -16
[  251.456906] binder: 3527:3562 ERROR: BC_REGISTER_LOOPER called without request
[  251.456914] binder: 3562 RLIMIT_NICE not set
[  251.460072] binder_alloc: 2086: binder_alloc_buf, no vma
[  251.460098] binder: 3527:3538 transaction failed 29189/-3, size 0-0 line 2870
[  251.461768] binder: 3527:3538 unknown command 0
[  251.461777] binder: 3527:3538 ioctl c0306201 20002fd0 returned -22
[  251.469846] binder: BINDER_SET_CONTEXT_MGR already set
[  251.469854] binder: 3540:3543 ioctl 40046207 0 returned -16
[  251.475919] binder: 3540:3560 ERROR: BC_REGISTER_LOOPER called without request
[  251.475928] binder: 3560 RLIMIT_NICE not set
[  251.477582] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.477624] binder: 3540:3543 transaction failed 29189/-3, size 0-0 line 2870
[  251.479376] binder: 3527:3556 BC_FREE_BUFFER u0000000000000000 no match
[  251.479418] binder: 3527:3556 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.479427] binder: 3527:3556 got transaction to invalid handle
[  251.479437] binder: 3527:3556 transaction failed 29201/-22, size 0-8 line 2755
[  251.488123] binder: 3540:3543 unknown command 0
[  251.488133] binder: 3540:3543 ioctl c0306201 20002fd0 returned -22
[  251.490334] binder: BINDER_SET_CONTEXT_MGR already set
[  251.490342] binder: 3565:3567 ioctl 40046207 0 returned -16
[  251.494681] binder: 3565:3567 ERROR: BC_REGISTER_LOOPER called without request
[  251.494690] binder: 3567 RLIMIT_NICE not set
[  251.498322] binder: 3540:3560 BC_FREE_BUFFER uffffffffffffffff no match
[  251.498354] binder: 3540:3560 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.498362] binder: 3540:3560 got transaction to invalid handle
[  251.498372] binder: 3540:3560 transaction failed 29201/-22, size 0-8 line 2755
[  251.498388] binder: 3540:3560 ioctl c0306201 20005fd0 returned -14
[  251.512208] binder: BINDER_SET_CONTEXT_MGR already set
[  251.512216] binder: 3574:3577 ioctl 40046207 0 returned -16
[  251.512307] binder: 3574:3577 ERROR: BC_REGISTER_LOOPER called without request
[  251.512315] binder: 3577 RLIMIT_NICE not set
[  251.521163] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.521187] binder: 3565:3583 transaction failed 29189/-3, size 0-0 line 2870
[  251.526668] binder: 3565:3583 ioctl c0306201 20002fd0 returned -14
[  251.532818] binder: BINDER_SET_CONTEXT_MGR already set
[  251.532825] binder: 3582:3584 ioctl 40046207 0 returned -16
[  251.532918] binder: 3582:3584 ERROR: BC_REGISTER_LOOPER called without request
[  251.532925] binder: 3584 RLIMIT_NICE not set
[  251.546701] binder: 3565:3583 ioctl c018620b 2000dfe8 returned -14
[  251.550819] binder_alloc: 2086: binder_alloc_buf, no vma
[  251.550842] binder: 3574:3585 transaction failed 29189/-3, size 0-0 line 2870
[  251.558525] binder: 3574:3585 ioctl c0306201 20002fd0 returned -14
[  251.559842] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.559866] binder: 3582:3590 transaction failed 29189/-3, size 0-0 line 2870
[  251.565392] binder: 3565:3583 ioctl 40046205 0 returned -22
[  251.570645] binder: 3582:3590 ioctl c0306201 20002fd0 returned -14
[  251.576424] binder: 3574:3585 ioctl c018620b 2000dfe8 returned -14
[  251.601260] binder: BINDER_SET_CONTEXT_MGR already set
[  251.601269] binder: 3565:3583 ioctl 40046207 0 returned -16
[  251.601308] binder: 3565:3593 ERROR: BC_REGISTER_LOOPER called without request
[  251.601318] binder: 3593 RLIMIT_NICE not set
[  251.601437] binder: 3574:3585 ioctl 40046205 0 returned -22
[  251.602716] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.602739] binder: 3565:3583 transaction failed 29189/-3, size 0-0 line 2870
[  251.614254] binder: 3565:3583 unknown command 0
[  251.614263] binder: 3565:3583 ioctl c0306201 20002fd0 returned -22
[  251.615672] binder: BINDER_SET_CONTEXT_MGR already set
[  251.615681] binder: 3574:3585 ioctl 40046207 0 returned -16
[  251.615735] binder: 3574:3597 ERROR: BC_REGISTER_LOOPER called without request
[  251.615744] binder: 3597 RLIMIT_NICE not set
[  251.619392] binder: 3582:3590 ioctl c0306201 20005fd0 returned -14
[  251.619531] binder_alloc: 2086: binder_alloc_buf, no vma
[  251.619555] binder: 3574:3585 transaction failed 29189/-3, size 0-0 line 2870
[  251.622375] binder: 3582:3590 ioctl c018620b 2000dfe8 returned -14
[  251.623796] binder: 3574:3585 ioctl c0306201 20002fd0 returned -14
[  251.624135] binder: 3565:3593 BC_FREE_BUFFER u0000000000000000 no match
[  251.624169] binder: 3565:3593 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.624178] binder: 3565:3593 got transaction to invalid handle
[  251.624188] binder: 3565:3593 transaction failed 29201/-22, size 0-8 line 2755
[  251.641154] binder: 3574:3597 BC_FREE_BUFFER u0000000000000000 no match
[  251.641186] binder: 3574:3597 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.641195] binder: 3574:3597 got transaction to invalid handle
[  251.641207] binder: 3574:3597 transaction failed 29201/-22, size 0-8 line 2755
[  251.647132] binder: 3582:3590 ioctl 40046205 0 returned -22
[  251.656180] binder: BINDER_SET_CONTEXT_MGR already set
[  251.656188] binder: 3607:3610 ioctl 40046207 0 returned -16
[  251.656269] binder: 3607:3610 ERROR: BC_REGISTER_LOOPER called without request
[  251.656278] binder: 3610 RLIMIT_NICE not set
[  251.657366] binder: BINDER_SET_CONTEXT_MGR already set
[  251.657374] binder: 3582:3590 ioctl 40046207 0 returned -16
[  251.657411] binder: 3582:3605 ERROR: BC_REGISTER_LOOPER called without request
[  251.657419] binder: 3605 RLIMIT_NICE not set
[  251.658645] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.658667] binder: 3582:3590 transaction failed 29189/-3, size 0-0 line 2870
[  251.666389] binder: 3582:3590 ioctl c0306201 20002fd0 returned -14
[  251.670542] binder: BINDER_SET_CONTEXT_MGR already set
[  251.670550] binder: 3611:3613 ioctl 40046207 0 returned -16
[  251.670645] binder: 3611:3613 ERROR: BC_REGISTER_LOOPER called without request
[  251.670654] binder: 3613 RLIMIT_NICE not set
[  251.674134] binder: 3582:3605 BC_FREE_BUFFER uffffffffffffffff no match
[  251.674165] binder: 3582:3605 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.674174] binder: 3582:3605 got transaction to invalid handle
[  251.674183] binder: 3582:3605 transaction failed 29201/-22, size 0-8 line 2755
[  251.674199] binder: 3582:3605 ioctl c0306201 20005fd0 returned -14
[  251.690136] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.690159] binder: 3607:3621 transaction failed 29189/-3, size 0-0 line 2870
[  251.692543] binder: 3607:3621 got reply transaction with no transaction stack
[  251.692550] binder: 3607:3621 transaction failed 29201/-71, size 24-8 line 2670
[  251.696113] binder: BINDER_SET_CONTEXT_MGR already set
[  251.696120] binder: 3619:3622 ioctl 40046207 0 returned -16
[  251.696198] binder: 3619:3622 ERROR: BC_REGISTER_LOOPER called without request
[  251.696205] binder: 3622 RLIMIT_NICE not set
[  251.701260] binder_alloc: 2086: binder_alloc_buf, no vma
[  251.701282] binder: 3611:3624 transaction failed 29189/-3, size 0-0 line 2870
[  251.713275] binder: 3611:3624 ioctl c0306201 20002fd0 returned -14
[  251.722717] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.722742] binder: 3619:3630 transaction failed 29189/-3, size 0-0 line 2870
[  251.742240] binder: 3607:3621 ioctl 40046205 0 returned -22
[  251.750393] binder: 3619:3630 ioctl c0306201 20002fd0 returned -14
[  251.756274] binder: BINDER_SET_CONTEXT_MGR already set
[  251.756284] binder: 3607:3632 ioctl 40046207 0 returned -16
[  251.764745] binder: 3607:3621 ERROR: BC_REGISTER_LOOPER called without request
[  251.764756] binder: 3621 RLIMIT_NICE not set
[  251.764836] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.764862] binder: 3607:3632 transaction failed 29189/-3, size 0-0 line 2870
[  251.766374] binder: 3607:3632 unknown command 1400526783
[  251.766384] binder: 3607:3632 ioctl c0306201 20002fd0 returned -22
[  251.769168] binder: 3611:3624 ioctl c018620b 2000dfe8 returned -14
[  251.772577] binder: 3607:3638 got reply transaction with no transaction stack
[  251.772595] binder: 3607:3638 transaction failed 29201/-71, size 24-8 line 2670
[  251.773995] binder: 3607:3638 BC_FREE_BUFFER u0000000000000000 no match
[  251.774052] binder: 3607:3638 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.774060] binder: 3607:3638 got transaction to invalid handle
[  251.774070] binder: 3607:3638 transaction failed 29201/-22, size 0-8 line 2755
[  251.777420] binder: 3619:3630 ioctl c0306201 20005fd0 returned -14
[  251.783218] binder: 3619:3630 ioctl c018620b 2000dfe8 returned -14
[  251.799691] binder: 3611:3624 ioctl 40046205 0 returned -22
[  251.801266] binder: BINDER_SET_CONTEXT_MGR already set
[  251.801274] binder: 3642:3644 ioctl 40046207 0 returned -16
[  251.801355] binder: 3642:3644 ERROR: BC_REGISTER_LOOPER called without request
[  251.801365] binder: 3644 RLIMIT_NICE not set
[  251.813037] binder: 3619:3630 ioctl 40046205 0 returned -22
[  251.819542] binder: 3611:3643 ERROR: BC_REGISTER_LOOPER called without request
[  251.819551] binder: 3643 RLIMIT_NICE not set
[  251.820972] binder: BINDER_SET_CONTEXT_MGR already set
[  251.820979] binder: 3619:3630 ioctl 40046207 0 returned -16
[  251.821074] binder_alloc: 2086: binder_alloc_buf, no vma
[  251.821097] binder: 3611:3643 transaction failed 29189/-3, size 0-0 line 2870
[  251.821398] binder: 3619:3647 ERROR: BC_REGISTER_LOOPER called without request
[  251.821405] binder: 3647 RLIMIT_NICE not set
[  251.823388] binder: BINDER_SET_CONTEXT_MGR already set
[  251.823396] binder: 3611:3624 ioctl 40046207 0 returned -16
[  251.823785] binder_alloc: 2089: binder_alloc_buf, no vma
[  251.823807] binder: 3619:3630 transaction failed 29189/-3, size 0-0 line 2870
[  251.824322] binder: 3648:3651 ERROR: BC_REGISTER_LOOPER called without request
[  251.824328] binder: 3651 RLIMIT_NICE not set
[  251.824993] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.825058] binder: 3642:3654 transaction failed 29189/-3, size 0-0 line 2870
[  251.829143] binder: 3619:3630 ioctl c0306201 20002fd0 returned -14
[  251.835961] binder: 3619:3647 BC_FREE_BUFFER uffffffffffffffff no match
[  251.835997] binder: 3619:3647 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.836024] binder: 3619:3647 got transaction to invalid handle
[  251.836033] binder: 3619:3647 transaction failed 29201/-22, size 0-8 line 2755
[  251.836048] binder: 3619:3647 ioctl c0306201 20005fd0 returned -14
[  251.838033] binder: 3611:3624 unknown command 0
[  251.838042] binder: 3611:3624 ioctl c0306201 20002fd0 returned -22
[  251.838075] binder: 3642:3654 got reply transaction with no transaction stack
[  251.838083] binder: 3642:3654 transaction failed 29201/-71, size 24-8 line 2670
[  251.862533] binder: 3611:3643 BC_FREE_BUFFER u0000000000000000 no match
[  251.862564] binder: 3611:3643 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.862572] binder: 3611:3643 got transaction to invalid handle
[  251.862583] binder: 3611:3643 transaction failed 29201/-22, size 0-8 line 2755
[  251.868199] binder: 3648:3651 ioctl c0306201 20002fd0 returned -14
[  251.868524] binder: 3648:3651 got reply transaction with no transaction stack
[  251.868532] binder: 3648:3651 transaction failed 29201/-71, size 24-8 line 2670
[  251.869405] binder: 3648:3651 ioctl c0306201 20005fd0 returned -14
[  251.869649] binder: 3648:3651 ioctl c018620b 2000dfe8 returned -14
[  251.871775] binder: 3648:3651 ioctl 40046205 0 returned -22
[  251.881188] binder: BINDER_SET_CONTEXT_MGR already set
[  251.881195] binder: 3656:3657 ioctl 40046207 0 returned -16
[  251.881398] binder: 3656:3657 ERROR: BC_REGISTER_LOOPER called without request
[  251.881405] binder: 3657 RLIMIT_NICE not set
[  251.883817] binder: BINDER_SET_CONTEXT_MGR already set
[  251.883824] binder: 3648:3651 ioctl 40046207 0 returned -16
[  251.883861] binder: 3648:3659 ERROR: BC_REGISTER_LOOPER called without request
[  251.883868] binder: 3659 RLIMIT_NICE not set
[  251.885142] binder_alloc: 3648: binder_alloc_buf, no vma
[  251.885162] binder: 3648:3651 transaction failed 29189/-3, size 0-0 line 2870
[  251.887200] binder: 3642:3654 ioctl 40046205 0 returned -22
[  251.888144] binder: 3648:3651 ioctl c0306201 20002fd0 returned -14
[  251.889660] binder: BINDER_SET_CONTEXT_MGR already set
[  251.889669] binder: 3642:3663 ioctl 40046207 0 returned -16
[  251.890838] binder: 3642:3654 ERROR: BC_REGISTER_LOOPER called without request
[  251.890845] binder: 3654 RLIMIT_NICE not set
[  251.890903] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.890923] binder: 3642:3663 transaction failed 29189/-3, size 0-0 line 2870
[  251.892259] binder: 3642:3663 unknown command 1400526783
[  251.892266] binder: 3642:3663 ioctl c0306201 20002fd0 returned -22
[  251.892329] binder: 3642:3670 got reply transaction with no transaction stack
[  251.892347] binder: 3642:3670 transaction failed 29201/-71, size 24-8 line 2670
[  251.893168] binder: 3648:3659 BC_FREE_BUFFER uffffffffffffffff no match
[  251.893194] binder: 3648:3659 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.893202] binder: 3648:3659 got transaction to invalid handle
[  251.893211] binder: 3648:3659 transaction failed 29201/-22, size 0-8 line 2755
[  251.893225] binder: 3648:3659 ioctl c0306201 20005fd0 returned -14
[  251.900310] binder: BINDER_SET_CONTEXT_MGR already set
[  251.900317] binder: 3667:3669 ioctl 40046207 0 returned -16
[  251.900405] binder: 3667:3669 ERROR: BC_REGISTER_LOOPER called without request
[  251.900411] binder: 3669 RLIMIT_NICE not set
[  251.900446] binder: 3642:3670 BC_FREE_BUFFER u0000000000000000 no match
[  251.900470] binder: 3642:3670 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.900477] binder: 3642:3670 got transaction to invalid handle
[  251.900487] binder: 3642:3670 transaction failed 29201/-22, size 0-8 line 2755
[  251.923076] binder: 3656:3673 ioctl c0306201 20002fd0 returned -14
[  251.925617] binder_alloc: 2086: binder_alloc_buf, no vma
[  251.925636] binder: 3667:3678 transaction failed 29189/-3, size 0-0 line 2870
[  251.926100] binder: 3656:3673 got reply transaction with no transaction stack
[  251.926111] binder: 3656:3673 transaction failed 29201/-71, size 24-8 line 2670
[  251.935208] binder: 3656:3673 ioctl c0306201 20005fd0 returned -14
[  251.936503] binder: 3656:3673 ioctl c018620b 2000dfe8 returned -14
[  251.936944] binder: BINDER_SET_CONTEXT_MGR already set
[  251.936961] binder: 3677:3679 ioctl 40046207 0 returned -16
[  251.937109] binder: 3677:3679 ERROR: BC_REGISTER_LOOPER called without request
[  251.937116] binder: 3679 RLIMIT_NICE not set
[  251.943939] binder: 3667:3678 ioctl c0306201 20002fd0 returned -14
[  251.949541] binder: 3656:3673 ioctl 40046205 0 returned -22
[  251.956232] binder: BINDER_SET_CONTEXT_MGR already set
[  251.956239] binder: 3656:3673 ioctl 40046207 0 returned -16
[  251.956272] binder: 3656:3685 ERROR: BC_REGISTER_LOOPER called without request
[  251.956280] binder: 3685 RLIMIT_NICE not set
[  251.960303] binder: 3656:3673 ioctl c0306201 20002fd0 returned -14
[  251.961987] binder: 3656:3673 got reply transaction with no transaction stack
[  251.961994] binder: 3656:3673 transaction failed 29201/-71, size 24-8 line 2670
[  251.966391] binder: 3656:3685 BC_FREE_BUFFER uffffffffffffffff no match
[  251.966424] binder: 3656:3685 IncRefs 0 refcount change on invalid ref 1 ret -22
[  251.966433] binder: 3656:3685 got transaction to invalid handle
[  251.966443] binder: 3656:3685 transaction failed 29201/-22, size 0-8 line 2755
[  251.966457] binder: 3656:3685 ioctl c0306201 20005fd0 returned -14
[  251.969768] binder_alloc: 2840: binder_alloc_buf, no vma
[  251.969793] binder: 3677:3688 transaction failed 29189/-3, size 0-0 line 2870
[  251.980547] binder: 3677:3688 got reply transaction with no transaction stack
[  251.980560] binder: 3677:3688 transaction failed 29201/-71, size 24-8 line 2670
[  251.992063] binder: 3667:3678 ioctl c018620b 2000dfe8 returned -14
[  251.992314] binder: BINDER_SET_CONTEXT_MGR already set
[  251.992322] binder: 3691:3694 ioctl 40046207 0 returned -16
[  251.992411] binder: 3691:3694 ERROR: BC_REGISTER_LOOPER called without request
[  251.992419] binder: 3694 RLIMIT_NICE not set
[  252.005651] binder: BINDER_SET_CONTEXT_MGR already set
[  252.005701] binder: 3692:3696 ioctl 40046207 0 returned -16
[  252.006054] binder: 3692:3696 ERROR: BC_REGISTER_LOOPER called without request
[  252.006063] binder: 3696 RLIMIT_NICE not set
[  252.013968] binder: 3677:3688 ioctl 40046205 0 returned -22
[  252.021757] binder: 3667:3678 ioctl 40046205 0 returned -22
[  252.022005] binder: BINDER_SET_CONTEXT_MGR already set
[  252.022046] binder: 3677:3703 ioctl 40046207 0 returned -16
[  252.030852] binder_alloc: 2840: binder_alloc_buf, no vma
[  252.030864] binder: 3677:3688 ERROR: BC_REGISTER_LOOPER called without request
[  252.030876] binder: 3677:3699 transaction failed 29189/-3, size 0-0 line 2870
[  252.030879] binder: 3688 RLIMIT_NICE not set
[  252.032367] binder: 3677:3699 unknown command 1400526783
[  252.032377] binder: 3677:3699 ioctl c0306201 20002fd0 returned -22
[  252.032599] binder: 3677:3703 got reply transaction with no transaction stack
[  252.032609] binder: 3677:3703 transaction failed 29201/-71, size 24-8 line 2670
[  252.033314] binder_alloc: 3648: binder_alloc_buf, no vma
[  252.033344] binder: 3692:3708 transaction failed 29189/-3, size 0-0 line 2870
[  252.036840] binder: 3691:3702 ioctl c0306201 20002fd0 returned -14
[  252.039235] binder: 3691:3702 got reply transaction with no transaction stack
[  252.039243] binder: 3691:3702 transaction failed 29201/-71, size 24-8 line 2670
[  252.040909] binder: BINDER_SET_CONTEXT_MGR already set
[  252.040917] binder: 3667:3678 ioctl 40046207 0 returned -16
[  252.041035] binder: 3667:3701 ERROR: BC_REGISTER_LOOPER called without request
[  252.041042] binder: 3701 RLIMIT_NICE not set
[  252.042296] binder_alloc: 2086: binder_alloc_buf, no vma
[  252.042317] binder: 3667:3678 transaction failed 29189/-3, size 0-0 line 2870
[  252.045314] binder: 3667:3678 ioctl c0306201 20002fd0 returned -14
[  252.047319] binder: 3692:3708 got reply transaction with no transaction stack
[  252.047328] binder: 3692:3708 transaction failed 29201/-71, size 24-8 line 2670
[  252.051734] binder: 3691:3702 ioctl c0306201 20005fd0 returned -14
[  252.055316] binder: 3667:3701 BC_FREE_BUFFER u0000000000000000 no match
[  252.055349] binder: 3667:3701 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.055359] binder: 3667:3701 got transaction to invalid handle
[  252.055371] binder: 3667:3701 transaction failed 29201/-22, size 0-8 line 2755
[  252.063195] binder: 3691:3702 ioctl c018620b 2000dfe8 returned -14
[  252.084084] binder: 3691:3702 ioctl 40046205 0 returned -22
[  252.084255] binder: 3692:3708 ioctl 40046205 0 returned -22
[  252.084624] binder: BINDER_SET_CONTEXT_MGR already set
[  252.084631] binder: 3715:3719 ioctl 40046207 0 returned -16
[  252.084703] binder: 3715:3719 ERROR: BC_REGISTER_LOOPER called without request
[  252.084711] binder: 3719 RLIMIT_NICE not set
[  252.086478] binder: BINDER_SET_CONTEXT_MGR already set
[  252.086486] binder: 3717:3722 ioctl 40046207 0 returned -16
[  252.086894] binder: 3717:3722 ERROR: BC_REGISTER_LOOPER called without request
[  252.086901] binder: 3722 RLIMIT_NICE not set
[  252.087468] binder: BINDER_SET_CONTEXT_MGR already set
[  252.087476] binder: 3692:3718 ioctl 40046207 0 returned -16
[  252.088675] binder: 3692:3708 ERROR: BC_REGISTER_LOOPER called without request
[  252.088682] binder: 3708 RLIMIT_NICE not set
[  252.088924] binder_alloc: 3648: binder_alloc_buf, no vma
[  252.088951] binder: 3692:3718 transaction failed 29189/-3, size 0-0 line 2870
[  252.090558] binder: 3692:3718 unknown command 1400526783
[  252.090566] binder: 3692:3718 ioctl c0306201 20002fd0 returned -22
[  252.098108] binder: 3692:3724 got reply transaction with no transaction stack
[  252.098126] binder: 3692:3724 transaction failed 29201/-71, size 24-8 line 2670
[  252.099865] binder: 3692:3724 BC_FREE_BUFFER u0000000000000000 no match
[  252.099896] binder: 3692:3724 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.099903] binder: 3692:3724 got transaction to invalid handle
[  252.099913] binder: 3692:3724 transaction failed 29201/-22, size 0-8 line 2755
[  252.100230] binder: BINDER_SET_CONTEXT_MGR already set
[  252.100236] binder: 3691:3702 ioctl 40046207 0 returned -16
[  252.102592] binder: 3691:3720 ERROR: BC_REGISTER_LOOPER called without request
[  252.102600] binder: 3720 RLIMIT_NICE not set
[  252.117194] binder_alloc: 2086: binder_alloc_buf, no vma
[  252.117219] binder: 3717:3730 transaction failed 29189/-3, size 0-0 line 2870
[  252.119685] binder: 3691:3702 ioctl c0306201 20002fd0 returned -14
[  252.131206] binder_alloc: 2840: binder_alloc_buf, no vma
[  252.131229] binder: 3715:3729 transaction failed 29189/-3, size 0-0 line 2870
[  252.131598] binder: 3691:3702 got reply transaction with no transaction stack
[  252.131608] binder: 3691:3702 transaction failed 29201/-71, size 24-8 line 2670
[  252.136570] binder: BINDER_SET_CONTEXT_MGR already set
[  252.136577] binder: 3731:3733 ioctl 40046207 0 returned -16
[  252.138608] binder: BINDER_SET_CONTEXT_MGR already set
[  252.138615] binder: 3731:3734 ioctl 40046207 0 returned -16
[  252.143388] binder: 3715:3729 got reply transaction with no transaction stack
[  252.143396] binder: 3715:3729 transaction failed 29201/-71, size 24-8 line 2670
[  252.145260] binder: 3691:3720 BC_FREE_BUFFER uffffffffffffffff no match
[  252.145287] binder: 3691:3720 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.145295] binder: 3691:3720 got transaction to invalid handle
[  252.145304] binder: 3691:3720 transaction failed 29201/-22, size 0-8 line 2755
[  252.145318] binder: 3691:3720 ioctl c0306201 20005fd0 returned -14
[  252.154697] binder: 3717:3730 ioctl c0306201 20002fd0 returned -14
[  252.171201] binder: 3715:3729 ioctl 40046205 0 returned -22
[  252.178239] binder: 3717:3730 ioctl c018620b 2000dfe8 returned -14
[  252.178320] binder: BINDER_SET_CONTEXT_MGR already set
[  252.178328] binder: 3715:3740 ioctl 40046207 0 returned -16
[  252.179514] binder: 3715:3729 ERROR: BC_REGISTER_LOOPER called without request
[  252.179522] binder: 3729 RLIMIT_NICE not set
[  252.179590] binder_alloc: 2840: binder_alloc_buf, no vma
[  252.179614] binder: 3715:3740 transaction failed 29189/-3, size 0-0 line 2870
[  252.182320] binder: 3715:3740 unknown command 1400526783
[  252.182331] binder: 3715:3740 ioctl c0306201 20002fd0 returned -22
[  252.182941] binder: BINDER_SET_CONTEXT_MGR already set
[  252.182949] binder: 3737:3742 ioctl 40046207 0 returned -16
[  252.183090] binder: 3737:3742 ERROR: BC_REGISTER_LOOPER called without request
[  252.183097] binder: 3742 RLIMIT_NICE not set
[  252.183947] binder: 3715:3747 got reply transaction with no transaction stack
[  252.183963] binder: 3715:3747 transaction failed 29201/-71, size 24-8 line 2670
[  252.205108] binder: 3717:3730 ioctl 40046205 0 returned -22
[  252.206557] binder: BINDER_SET_CONTEXT_MGR already set
[  252.206565] binder: 3750:3751 ioctl 40046207 0 returned -16
[  252.206644] binder: 3750:3751 ERROR: BC_REGISTER_LOOPER called without request
[  252.206652] binder: 3751 RLIMIT_NICE not set
[  252.207955] binder_alloc: 2089: binder_alloc_buf, no vma
[  252.207980] binder: 3737:3753 transaction failed 29189/-3, size 0-0 line 2870
[  252.217505] binder: BINDER_SET_CONTEXT_MGR already set
[  252.217514] binder: 3717:3730 ioctl 40046207 0 returned -16
[  252.217553] binder: 3717:3749 ERROR: BC_REGISTER_LOOPER called without request
[  252.217563] binder: 3749 RLIMIT_NICE not set
[  252.218813] binder_alloc: 2086: binder_alloc_buf, no vma
[  252.218836] binder: 3717:3730 transaction failed 29189/-3, size 0-0 line 2870
[  252.220621] binder: 3737:3753 ioctl c0306201 20002fd0 returned -14
[  252.222373] binder: 3717:3730 ioctl c0306201 20002fd0 returned -14
[  252.232697] binder_alloc: 2840: binder_alloc_buf, no vma
[  252.232719] binder: 3750:3759 transaction failed 29189/-3, size 0-0 line 2870
[  252.246900] binder: 3717:3749 BC_FREE_BUFFER u0000000000000000 no match
[  252.246935] binder: 3717:3749 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.246944] binder: 3717:3749 got transaction to invalid handle
[  252.246955] binder: 3717:3749 transaction failed 29201/-22, size 0-8 line 2755
[  252.257171] binder: 3737:3753 ioctl c0306201 20005fd0 returned -14
[  252.260000] binder: 3737:3753 ioctl c018620b 2000dfe8 returned -14
[  252.262036] binder: BINDER_SET_CONTEXT_MGR already set
[  252.262043] binder: 3760:3761 ioctl 40046207 0 returned -16
[  252.262208] binder: 3760:3761 ERROR: BC_REGISTER_LOOPER called without request
[  252.262216] binder: 3761 RLIMIT_NICE not set
[  252.282125] binder: BINDER_SET_CONTEXT_MGR already set
[  252.282133] binder: 3762:3765 ioctl 40046207 0 returned -16
[  252.282214] binder: 3762:3765 ERROR: BC_REGISTER_LOOPER called without request
[  252.282221] binder: 3765 RLIMIT_NICE not set
[  252.283992] binder: 3737:3753 ioctl 40046205 0 returned -22
[  252.285466] binder_alloc: 3648: binder_alloc_buf, no vma
[  252.285488] binder: 3760:3771 transaction failed 29189/-3, size 0-0 line 2870
[  252.288600] binder: 3750:3759 ioctl 40046205 0 returned -22
[  252.289236] binder: BINDER_SET_CONTEXT_MGR already set
[  252.289243] binder: 3737:3753 ioctl 40046207 0 returned -16
[  252.289272] binder: 3737:3767 ERROR: BC_REGISTER_LOOPER called without request
[  252.289279] binder: 3767 RLIMIT_NICE not set
[  252.290207] binder: 3764:3770 ERROR: BC_REGISTER_LOOPER called without request
[  252.290214] binder: 3770 RLIMIT_NICE not set
[  252.290463] binder_alloc: 2089: binder_alloc_buf, no vma
[  252.290483] binder: 3737:3753 transaction failed 29189/-3, size 0-0 line 2870
[  252.293591] binder: 3737:3753 ioctl c0306201 20002fd0 returned -14
[  252.293677] binder: 3760:3771 ioctl c0306201 20002fd0 returned -14
[  252.301363] binder: 3737:3767 BC_FREE_BUFFER uffffffffffffffff no match
[  252.301393] binder: 3737:3767 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.301401] binder: 3737:3767 got transaction to invalid handle
[  252.301409] binder: 3737:3767 transaction failed 29201/-22, size 0-8 line 2755
[  252.301423] binder: 3737:3767 ioctl c0306201 20005fd0 returned -14
[  252.306374] binder: BINDER_SET_CONTEXT_MGR already set
[  252.306395] binder: 3750:3768 ioctl 40046207 0 returned -16
[  252.307639] binder: 3750:3759 ERROR: BC_REGISTER_LOOPER called without request
[  252.307648] binder: 3759 RLIMIT_NICE not set
[  252.307720] binder_alloc: 2840: binder_alloc_buf, no vma
[  252.307742] binder: 3750:3768 transaction failed 29189/-3, size 0-0 line 2870
[  252.313891] binder_alloc: 2086: binder_alloc_buf, no vma
[  252.313916] binder: 3762:3773 transaction failed 29189/-3, size 0-0 line 2870
[  252.314392] binder: 3750:3768 unknown command 1400526783
[  252.314402] binder: 3750:3768 ioctl c0306201 20002fd0 returned -22
[  252.315770] binder: 3770 RLIMIT_NICE not set
[  252.318609] binder: 3764:3770 ioctl c0306201 20002fd0 returned -14
[  252.320473] binder: 3770 RLIMIT_NICE not set
[  252.321526] binder: 3760:3771 ioctl c018620b 2000dfe8 returned -14
[  252.321898] binder: 3764:3770 BC_FREE_BUFFER uffffffffffffffff no match
[  252.321976] binder: 3764:3770 got transaction with invalid offsets ptr
[  252.322006] binder: 3764:3770 transaction failed 29201/-14, size 0-8 line 2898
[  252.322733] binder: 3764:3770 ioctl c018620b 2000dfe8 returned -14
[  252.324460] binder: 3764:3770 ioctl 40046205 0 returned -22
[  252.326256] binder: 3762:3773 ioctl c0306201 20002fd0 returned -14
[  252.328090] binder: BINDER_SET_CONTEXT_MGR already set
[  252.328098] binder: 3776:3780 ioctl 40046207 0 returned -16
[  252.328181] binder: 3776:3780 ERROR: BC_REGISTER_LOOPER called without request
[  252.328188] binder: 3780 RLIMIT_NICE not set
[  252.339540] binder: BINDER_SET_CONTEXT_MGR already set
[  252.339548] binder: 3764:3770 ioctl 40046207 0 returned -16
[  252.339770] binder: 3764:3778 ERROR: BC_REGISTER_LOOPER called without request
[  252.339777] binder: 3778 RLIMIT_NICE not set
[  252.341557] binder_alloc: 3764: binder_alloc_buf, no vma
[  252.341577] binder: 3764:3770 transaction failed 29189/-3, size 0-0 line 2870
[  252.344425] binder: 3764:3770 ioctl c0306201 20002fd0 returned -14
[  252.346526] binder: 3760:3771 ioctl 40046205 0 returned -22
[  252.350906] binder: 3764:3778 BC_FREE_BUFFER uffffffffffffffff no match
[  252.350947] binder: 3764:3778 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.350956] binder: 3764:3778 got transaction to invalid handle
[  252.350968] binder: 3764:3778 transaction failed 29201/-22, size 0-8 line 2755
[  252.351636] binder_alloc: 2089: binder_alloc_buf, no vma
[  252.351659] binder: 3776:3784 transaction failed 29189/-3, size 0-0 line 2870
[  252.355615] binder: BINDER_SET_CONTEXT_MGR already set
[  252.355622] binder: 3782:3783 ioctl 40046207 0 returned -16
[  252.355706] binder: 3782:3783 ERROR: BC_REGISTER_LOOPER called without request
[  252.355713] binder: 3783 RLIMIT_NICE not set
[  252.365574] binder: 3762:3773 ioctl 40046205 0 returned -22
[  252.369464] binder: BINDER_SET_CONTEXT_MGR already set
[  252.369472] binder: 3786:3787 ioctl 40046207 0 returned -16
[  252.370084] binder: 3786:3787 ERROR: BC_REGISTER_LOOPER called without request
[  252.370091] binder: 3787 RLIMIT_NICE not set
[  252.371212] binder: BINDER_SET_CONTEXT_MGR already set
[  252.371219] binder: 3762:3773 ioctl 40046207 0 returned -16
[  252.371252] binder: 3762:3788 ERROR: BC_REGISTER_LOOPER called without request
[  252.371258] binder: 3788 RLIMIT_NICE not set
[  252.372463] binder_alloc: 2086: binder_alloc_buf, no vma
[  252.372506] binder: 3762:3773 transaction failed 29189/-3, size 0-0 line 2870
[  252.373577] binder: 3776:3784 ioctl c0306201 20002fd0 returned -14
[  252.373802] binder: BINDER_SET_CONTEXT_MGR already set
[  252.373809] binder: 3760:3771 ioctl 40046207 0 returned -16
[  252.376946] binder: 3762:3773 ioctl c0306201 20002fd0 returned -14
[  252.377683] binder_alloc: 2840: binder_alloc_buf, no vma
[  252.377709] binder: 3782:3792 transaction failed 29189/-3, size 0-0 line 2870
[  252.378126] binder: 3760:3781 ERROR: BC_REGISTER_LOOPER called without request
[  252.378164] binder: 3781 RLIMIT_NICE not set
[  252.379615] binder_alloc: 3648: binder_alloc_buf, no vma
[  252.379637] binder: 3760:3771 transaction failed 29189/-3, size 0-0 line 2870
[  252.384573] binder: 3760:3771 ioctl c0306201 20002fd0 returned -14
[  252.384910] binder: 3762:3788 BC_FREE_BUFFER u0000000000000000 no match
[  252.384947] binder: 3762:3788 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.384954] binder: 3762:3788 got transaction to invalid handle
[  252.384963] binder: 3762:3788 transaction failed 29201/-22, size 0-8 line 2755
[  252.389516] binder: 3776:3784 ioctl c0306201 20005fd0 returned -14
[  252.390782] binder: 3776:3784 ioctl c018620b 2000dfe8 returned -14
[  252.395638] binder_alloc: 3764: binder_alloc_buf, no vma
[  252.395658] binder: 3786:3795 transaction failed 29189/-3, size 0-0 line 2870
[  252.396747] binder: 3760:3781 BC_FREE_BUFFER u0000000000000000 no match
[  252.396778] binder: 3760:3781 got transaction to invalid handle
[  252.396787] binder: 3760:3781 transaction failed 29201/-22, size 0-8 line 2755
[  252.397338] binder: 3782:3792 ioctl 40046205 0 returned -22
[  252.405181] binder: BINDER_SET_CONTEXT_MGR already set
[  252.405189] binder: 3797:3799 ioctl 40046207 0 returned -16
[  252.405281] binder: 3797:3799 ERROR: BC_REGISTER_LOOPER called without request
[  252.405289] binder: 3799 RLIMIT_NICE not set
[  252.407482] binder: BINDER_SET_CONTEXT_MGR already set
[  252.407490] binder: 3782:3796 ioctl 40046207 0 returned -16
[  252.409042] binder: 3782:3792 ERROR: BC_REGISTER_LOOPER called without request
[  252.409049] binder: 3792 RLIMIT_NICE not set
[  252.409076] binder: 3786:3795 ioctl c0306201 20002fd0 returned -14
[  252.409233] binder_alloc: 2840: binder_alloc_buf, no vma
[  252.409252] binder: 3782:3796 transaction failed 29189/-3, size 0-0 line 2870
[  252.412771] binder: 3776:3784 ioctl 40046205 0 returned -22
[  252.423061] binder: BINDER_SET_CONTEXT_MGR already set
[  252.423069] binder: 3802:3803 ioctl 40046207 0 returned -16
[  252.423226] binder: 3802:3803 ERROR: BC_REGISTER_LOOPER called without request
[  252.423233] binder: 3803 RLIMIT_NICE not set
[  252.426631] binder: 3786:3795 ioctl c018620b 2000dfe8 returned -14
[  252.427182] binder: BINDER_SET_CONTEXT_MGR already set
[  252.427190] binder: 3804:3806 ioctl 40046207 0 returned -16
[  252.428451] binder: 3804:3806 ERROR: BC_REGISTER_LOOPER called without request
[  252.428459] binder: 3806 RLIMIT_NICE not set
[  252.428550] binder_alloc: 2086: binder_alloc_buf, no vma
[  252.428570] binder: 3797:3807 transaction failed 29189/-3, size 0-0 line 2870
[  252.435427] binder: 3797:3807 ioctl c0306201 20002fd0 returned -14
[  252.437392] binder: BINDER_SET_CONTEXT_MGR already set
[  252.437399] binder: 3776:3784 ioctl 40046207 0 returned -16
[  252.437431] binder: 3776:3800 ERROR: BC_REGISTER_LOOPER called without request
[  252.437438] binder: 3800 RLIMIT_NICE not set
[  252.438651] binder_alloc: 2089: binder_alloc_buf, no vma
[  252.438671] binder: 3776:3784 transaction failed 29189/-3, size 0-0 line 2870
[  252.439689] binder: 3786:3795 ioctl 40046205 0 returned -22
[  252.442474] binder: 3776:3784 ioctl c0306201 20002fd0 returned -14
[  252.445775] binder: BINDER_SET_CONTEXT_MGR already set
[  252.445782] binder: 3786:3795 ioctl 40046207 0 returned -16
[  252.446086] binder: 3786:3809 ERROR: BC_REGISTER_LOOPER called without request
[  252.446094] binder: 3809 RLIMIT_NICE not set
[  252.447303] binder_alloc: 3764: binder_alloc_buf, no vma
[  252.447325] binder: 3786:3795 transaction failed 29189/-3, size 0-0 line 2870
[  252.448748] binder: 3776:3800 BC_FREE_BUFFER uffffffffffffffff no match
[  252.448777] binder: 3776:3800 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.448784] binder: 3776:3800 got transaction to invalid handle
[  252.448793] binder: 3776:3800 transaction failed 29201/-22, size 0-8 line 2755
[  252.448807] binder: 3776:3800 ioctl c0306201 20005fd0 returned -14
[  252.449504] binder_alloc: 3648: binder_alloc_buf, no vma
[  252.449524] binder: 3802:3811 transaction failed 29189/-3, size 0-0 line 2870
[  252.449747] binder: 3797:3807 ioctl c018620b 2000dfe8 returned -14
[  252.453191] binder: 3786:3795 ioctl c0306201 20002fd0 returned -14
[  252.467243] binder: 3786:3809 BC_FREE_BUFFER uffffffffffffffff no match
[  252.467270] binder: 3786:3809 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.467277] binder: 3786:3809 got transaction to invalid handle
[  252.467286] binder: 3786:3809 transaction failed 29201/-22, size 0-8 line 2755
[  252.467499] binder: 3802:3811 ioctl c0306201 20002fd0 returned -14
[  252.473954] binder: 3797:3807 ioctl 40046205 0 returned -22
[  252.477944] binder: BINDER_SET_CONTEXT_MGR already set
[  252.477951] binder: 3814:3815 ioctl 40046207 0 returned -16
[  252.478396] binder: 3814:3815 ERROR: BC_REGISTER_LOOPER called without request
[  252.478403] binder: 3815 RLIMIT_NICE not set
[  252.479571] binder: 3802:3811 ioctl c018620b 20000fe8 returned -14
[  252.491846] binder: 3804:3812 ioctl 40046205 0 returned -22
[  252.500969] binder: BINDER_SET_CONTEXT_MGR already set
[  252.500980] binder: 3797:3807 ioctl 40046207 0 returned -16
[  252.501112] binder: 3797:3816 ERROR: BC_REGISTER_LOOPER called without request
[  252.501119] binder: 3816 RLIMIT_NICE not set
[  252.501721] binder: 3802:3811 ioctl 40046205 0 returned -22
[  252.501911] binder: BINDER_SET_CONTEXT_MGR already set
[  252.501924] binder: 3804:3819 ioctl 40046207 0 returned -16
[  252.502328] binder_alloc: 2086: binder_alloc_buf, no vma
[  252.502351] binder: 3797:3807 transaction failed 29189/-3, size 0-0 line 2870
[  252.503152] binder: 3804:3812 ERROR: BC_REGISTER_LOOPER called without request
[  252.503160] binder: 3812 RLIMIT_NICE not set
[  252.504407] binder_alloc: 2089: binder_alloc_buf, no vma
[  252.504437] binder: 3814:3826 transaction failed 29189/-3, size 0-0 line 2870
[  252.511459] binder: 3797:3807 ioctl c0306201 20002fd0 returned -14
[  252.524220] binder: BINDER_SET_CONTEXT_MGR already set
[  252.524228] binder: 3802:3811 ioctl 40046207 0 returned -16
[  252.524267] binder: 3802:3824 ERROR: BC_REGISTER_LOOPER called without request
[  252.524275] binder: 3824 RLIMIT_NICE not set
[  252.525502] binder: 3814:3826 ioctl c0306201 20002fd0 returned -14
[  252.525671] binder_alloc: 3648: binder_alloc_buf, no vma
[  252.525694] binder: 3802:3811 transaction failed 29189/-3, size 0-0 line 2870
[  252.533170] binder: 3797:3816 BC_FREE_BUFFER u0000000000000000 no match
[  252.533202] binder: 3797:3816 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.533214] binder: 3797:3816 got transaction to invalid handle
[  252.533224] binder: 3797:3816 transaction failed 29201/-22, size 0-8 line 2755
[  252.535109] binder: 3802:3811 unknown command 0
[  252.535118] binder: 3802:3811 ioctl c0306201 20002fd0 returned -22
[  252.547723] binder: 3802:3824 ioctl c018620b 20000fe8 returned -14
[  252.550645] binder: 3802:3824 BC_FREE_BUFFER uffffffffffffffff no match
[  252.550677] binder: 3802:3824 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.550686] binder: 3802:3824 got transaction to invalid handle
[  252.550696] binder: 3802:3824 transaction failed 29201/-22, size 0-8 line 2755
[  252.551382] binder: 3814:3826 ioctl c0306201 20005fd0 returned -14
[  252.555149] binder: 3814:3826 ioctl c018620b 2000dfe8 returned -14
[  252.555210] binder: BINDER_SET_CONTEXT_MGR already set
[  252.555217] binder: 3827:3829 ioctl 40046207 0 returned -16
[  252.560622] binder: 3827:3829 ioctl 40046205 0 returned -22
[  252.581079] binder: 3814:3826 ioctl 40046205 0 returned -22
[  252.583082] binder: BINDER_SET_CONTEXT_MGR already set
[  252.583092] binder: 3827:3835 ioctl 40046207 0 returned -16
[  252.600782] binder: BINDER_SET_CONTEXT_MGR already set
[  252.600792] binder: 3814:3826 ioctl 40046207 0 returned -16
[  252.600831] binder: 3814:3840 ERROR: BC_REGISTER_LOOPER called without request
[  252.600839] binder: 3840 RLIMIT_NICE not set
[  252.606415] binder: 3845:3848 ioctl 40046205 0 returned -22
[  252.608943] binder_alloc: 2089: binder_alloc_buf, no vma
[  252.608966] binder: 3814:3826 transaction failed 29189/-3, size 0-0 line 2870
[  252.625129] binder: 3814:3826 ioctl c0306201 20002fd0 returned -14
[  252.644639] binder: 3814:3840 BC_FREE_BUFFER uffffffffffffffff no match
[  252.644673] binder: 3814:3840 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.644684] binder: 3814:3840 got transaction to invalid handle
[  252.644695] binder: 3814:3840 transaction failed 29201/-22, size 0-8 line 2755
[  252.644712] binder: 3814:3840 ioctl c0306201 20005fd0 returned -14
[  252.668516] binder: 3855:3858 ioctl 40046205 0 returned -22
[  252.691364] binder: BINDER_SET_CONTEXT_MGR already set
[  252.691373] binder: 3862:3863 ioctl 40046207 0 returned -16
[  252.691463] binder: 3862:3863 ERROR: BC_REGISTER_LOOPER called without request
[  252.691472] binder: 3863 RLIMIT_NICE not set
[  252.722075] binder_alloc: 2089: binder_alloc_buf, no vma
[  252.722106] binder: 3862:3875 transaction failed 29189/-3, size 0-0 line 2870
[  252.744825] binder: 3868:3871 ioctl 40046205 0 returned -22
[  252.763323] binder: 3862:3875 ioctl c0306201 20005fd0 returned -14
[  252.764613] binder: 3862:3875 ioctl c018620b 2000dfe8 returned -14
[  252.781135] binder: 3862:3875 ioctl 40046205 0 returned -22
[  252.790385] binder: BINDER_SET_CONTEXT_MGR already set
[  252.790392] binder: 3862:3875 ioctl 40046207 0 returned -16
[  252.792232] binder: 3862:3890 ERROR: BC_REGISTER_LOOPER called without request
[  252.792240] binder: 3890 RLIMIT_NICE not set
[  252.793462] binder_alloc: 2089: binder_alloc_buf, no vma
[  252.793487] binder: 3862:3875 transaction failed 29189/-3, size 0-0 line 2870
[  252.810606] binder: 3888:3891 ioctl 40046205 0 returned -22
[  252.814209] binder: 3862:3890 BC_FREE_BUFFER uffffffffffffffff no match
[  252.814239] binder: 3862:3890 IncRefs 0 refcount change on invalid ref 1 ret -22
[  252.814247] binder: 3862:3890 got transaction to invalid handle
[  252.814256] binder: 3862:3890 transaction failed 29201/-22, size 0-8 line 2755
[  252.814270] binder: 3862:3890 ioctl c0306201 20005fd0 returned -14
[  253.119881] binder: BINDER_SET_CONTEXT_MGR already set
[  253.119890] binder: 3900:3912 ioctl 40046207 0 returned -16
[  253.119984] binder: 3900:3912 ERROR: BC_REGISTER_LOOPER called without request
[  253.119994] binder: 3912 RLIMIT_NICE not set
[  253.148252] binder_alloc: 2089: binder_alloc_buf, no vma
[  253.148314] binder: 3900:3919 transaction failed 29189/-3, size 0-0 line 2870
[  253.176869] binder: 3900:3919 ioctl c0306201 20002fd0 returned -14
[  253.208151] binder: 3900:3919 ioctl c0306201 20005fd0 returned -14
[  253.209541] binder: 3900:3919 ioctl c018620b 2000dfe8 returned -14
[  253.234378] binder: 3900:3919 ioctl 40046205 0 returned -22
[  253.246168] binder: BINDER_SET_CONTEXT_MGR already set
[  253.246176] binder: 3900:3919 ioctl 40046207 0 returned -16
[  253.246217] binder: 3900:3938 ERROR: BC_REGISTER_LOOPER called without request
[  253.246225] binder: 3938 RLIMIT_NICE not set
[  253.252371] binder_alloc: 2089: binder_alloc_buf, no vma
[  253.252395] binder: 3900:3919 transaction failed 29189/-3, size 0-0 line 2870
[  253.255411] binder: 3900:3919 ioctl c0306201 20002fd0 returned -14
[  253.260364] binder: 3900:3938 BC_FREE_BUFFER uffffffffffffffff no match
[  253.260394] binder: 3900:3938 IncRefs 0 refcount change on invalid ref 1 ret -22
[  253.260402] binder: 3900:3938 got transaction to invalid handle
[  253.260411] binder: 3900:3938 transaction failed 29201/-22, size 0-8 line 2755
[  253.260426] binder: 3900:3938 ioctl c0306201 20005fd0 returned -14
[  253.283777] binder: BINDER_SET_CONTEXT_MGR already set
[  253.283785] binder: 3945:3946 ioctl 40046207 0 returned -16
[  253.283888] binder: 3945:3946 ERROR: BC_REGISTER_LOOPER called without request
[  253.283896] binder: 3946 RLIMIT_NICE not set
[  253.323938] binder_alloc: 2089: binder_alloc_buf, no vma
[  253.323968] binder: 3945:3956 transaction failed 29189/-3, size 0-0 line 2870
[  253.338671] binder: 3945:3956 ioctl c0306201 20002fd0 returned -14
[  253.358048] binder: 3945:3956 ioctl c0306201 20005fd0 returned -14
[  253.359315] binder: 3945:3956 ioctl c018620b 2000dfe8 returned -14
[  253.373653] binder: 3945:3956 ioctl 40046205 0 returned -22
[  253.381685] binder: BINDER_SET_CONTEXT_MGR already set
[  253.381692] binder: 3945:3956 ioctl 40046207 0 returned -16
[  253.381723] binder: 3945:3968 ERROR: BC_REGISTER_LOOPER called without request
[  253.381731] binder: 3968 RLIMIT_NICE not set
[  253.382942] binder_alloc: 2089: binder_alloc_buf, no vma
[  253.382965] binder: 3945:3956 transaction failed 29189/-3, size 0-0 line 2870
[  253.386488] binder: 3945:3956 ioctl c0306201 20002fd0 returned -14
[  253.391905] binder: 3945:3968 BC_FREE_BUFFER uffffffffffffffff no match
[  253.391932] binder: 3945:3968 IncRefs 0 refcount change on invalid ref 1 ret -22
[  253.391940] binder: 3945:3968 got transaction to invalid handle
[  253.391949] binder: 3945:3968 transaction failed 29201/-22, size 0-8 line 2755
[  253.391962] binder: 3945:3968 ioctl c0306201 20005fd0 returned -14
[  253.427318] binder: BINDER_SET_CONTEXT_MGR already set
[  253.427326] binder: 3974:3979 ioctl 40046207 0 returned -16
[  253.427416] binder: 3974:3979 ERROR: BC_REGISTER_LOOPER called without request
[  253.427423] binder: 3979 RLIMIT_NICE not set
[  253.452575] binder_alloc: 2089: binder_alloc_buf, no vma
[  253.452599] binder: 3974:3991 transaction failed 29189/-3, size 0-0 line 2870
[  253.459390] binder: 3974:3991 ioctl c0306201 20002fd0 returned -14
[  253.478218] binder: 3974:3991 ioctl c0306201 20005fd0 returned -14
[  253.485110] binder: 3974:3991 ioctl c018620b 2000dfe8 returned -14
[  253.516311] binder: 3974:3991 ioctl 40046205 0 returned -22
[  253.528967] binder: BINDER_SET_CONTEXT_MGR already set
[  253.528975] binder: 3974:3991 ioctl 40046207 0 returned -16
[  253.529084] binder: 3974:4006 ERROR: BC_REGISTER_LOOPER called without request
[  253.529093] binder: 4006 RLIMIT_NICE not set
[  253.530956] binder_alloc: 2089: binder_alloc_buf, no vma
[  253.531134] binder: 3974:3991 transaction failed 29189/-3, size 0-0 line 2870
[  253.534391] binder: 3974:3991 ioctl c0306201 20002fd0 returned -14
[  253.539950] binder: 3974:4006 BC_FREE_BUFFER uffffffffffffffff no match
[  253.539980] binder: 3974:4006 IncRefs 0 refcount change on invalid ref 1 ret -22
[  253.539988] binder: 3974:4006 got transaction to invalid handle
[  253.539998] binder: 3974:4006 transaction failed 29201/-22, size 0-8 line 2755
[  253.540035] binder: 3974:4006 ioctl c0306201 20005fd0 returned -14
[  253.540183] binder: 4008:4012 ERROR: BC_REGISTER_LOOPER called without request
[  253.540190] binder: 4012 RLIMIT_NICE not set
[  253.565531] binder: 4012 RLIMIT_NICE not set
[  253.572793] binder: BINDER_SET_CONTEXT_MGR already set
[  253.572800] binder: 4018:4023 ioctl 40046207 0 returned -16
[  253.572996] binder: 4018:4023 ERROR: BC_REGISTER_LOOPER called without request
[  253.573024] binder: 4023 RLIMIT_NICE not set
[  253.573537] binder: 4008:4012 ioctl c0306201 20002fd0 returned -14
[  253.573829] binder: 4012 RLIMIT_NICE not set
[  253.574635] binder: 4008:4012 ioctl c018620b 20000fe8 returned -14
[  253.576221] binder: 4008:4012 BC_FREE_BUFFER uffffffffffffffff no match
[  253.576291] binder: 4008:4012 got transaction with invalid offset (48, min 0 max 0) or object.
[  253.576320] binder: 4008:4012 transaction failed 29201/-22, size 0-8 line 2933
[  253.580195] binder: 4008:4012 ioctl 40046205 0 returned -22
[  253.586114] binder: BINDER_SET_CONTEXT_MGR already set
[  253.586122] binder: 4008:4012 ioctl 40046207 0 returned -16
[  253.586154] binder: 4008:4020 ERROR: BC_REGISTER_LOOPER called without request
[  253.586161] binder: 4020 RLIMIT_NICE not set
[  253.587419] binder_alloc: 4008: binder_alloc_buf, no vma
[  253.587439] binder: 4008:4012 transaction failed 29189/-3, size 0-0 line 2870
[  253.595322] binder: 4008:4012 ioctl c0306201 20002fd0 returned -14
[  253.598876] binder: 4008:4020 ioctl c018620b 20000fe8 returned -14
[  253.599062] binder_alloc: 2089: binder_alloc_buf, no vma
[  253.599084] binder: 4018:4024 transaction failed 29189/-3, size 0-0 line 2870
[  253.603036] binder: 4008:4020 BC_FREE_BUFFER uffffffffffffffff no match
[  253.603064] binder: 4008:4020 IncRefs 0 refcount change on invalid ref 1 ret -22
[  253.603071] binder: 4008:4020 got transaction to invalid handle
[  253.603081] binder: 4008:4020 transaction failed 29201/-22, size 0-8 line 2755
[  253.610046] binder: 4018:4024 ioctl c0306201 20002fd0 returned -14
[  253.625928] binder: 4018:4024 ioctl c0306201 20005fd0 returned -14
[  253.627276] binder: 4018:4024 ioctl c018620b 2000dfe8 returned -14
[  253.643221] binder: 4018:4024 ioctl 40046205 0 returned -22
[  253.648241] binder: BINDER_SET_CONTEXT_MGR already set
[  253.648248] binder: 4018:4024 ioctl 40046207 0 returned -16
[  253.648326] binder: 4018:4027 ERROR: BC_REGISTER_LOOPER called without request
[  253.648334] binder: 4027 RLIMIT_NICE not set
[  253.649523] binder_alloc: 2089: binder_alloc_buf, no vma
[  253.649543] binder: 4018:4024 transaction failed 29189/-3, size 0-0 line 2870
[  253.652347] binder: 4018:4024 ioctl c0306201 20002fd0 returned -14
[  253.657384] binder: 4018:4027 BC_FREE_BUFFER uffffffffffffffff no match
[  253.657412] binder: 4018:4027 IncRefs 0 refcount change on invalid ref 1 ret -22
[  253.657419] binder: 4018:4027 got transaction to invalid handle
[  253.657428] binder: 4018:4027 transaction failed 29201/-22, size 0-8 line 2755
[  253.657441] binder: 4018:4027 ioctl c0306201 20005fd0 returned -14
[  253.993358] binder: BINDER_SET_CONTEXT_MGR already set
[  253.993367] binder: 4031:4041 ioctl 40046207 0 returned -16
[  253.993618] binder: BINDER_SET_CONTEXT_MGR already set
[  253.993625] binder: 4033:4038 ioctl 40046207 0 returned -16
[  253.993834] binder: 4031:4041 ERROR: BC_REGISTER_LOOPER called without request
[  253.993842] binder: 4041 RLIMIT_NICE not set
[  253.993863] binder: 4033:4038 ERROR: BC_REGISTER_LOOPER called without request
[  253.993869] binder: 4038 RLIMIT_NICE not set
[  253.994138] binder: BINDER_SET_CONTEXT_MGR already set
[  253.994145] binder: 4035:4039 ioctl 40046207 0 returned -16
[  253.994363] binder: 4035:4039 ERROR: BC_REGISTER_LOOPER called without request
[  253.994370] binder: 4039 RLIMIT_NICE not set
[  254.030735] binder_alloc: 2840: binder_alloc_buf, no vma
[  254.030758] binder: 4033:4049 transaction failed 29189/-3, size 0-0 line 2870
[  254.034427] binder_alloc: 2089: binder_alloc_buf, no vma
[  254.034451] binder: 4031:4048 transaction failed 29189/-3, size 0-0 line 2870
[  254.034659] binder_alloc: 4008: binder_alloc_buf, no vma
[  254.034680] binder: 4035:4050 transaction failed 29189/-3, size 0-0 line 2870
[  254.039080] binder: 4033:4049 ioctl c0306201 20002fd0 returned -14
[  254.046489] binder: 4033:4049 ioctl c018620b 20000fe8 returned -14
[  254.063528] binder: 4031:4048 ioctl c0306201 20002fd0 returned -14
[  254.076581] binder: 4033:4049 ioctl 40046205 0 returned -22
[  254.082891] binder: BINDER_SET_CONTEXT_MGR already set
[  254.082898] binder: 4033:4049 ioctl 40046207 0 returned -16
[  254.082932] binder: 4033:4057 ERROR: BC_REGISTER_LOOPER called without request
[  254.082940] binder: 4057 RLIMIT_NICE not set
[  254.084658] binder_alloc: 2840: binder_alloc_buf, no vma
[  254.084678] binder: 4033:4049 transaction failed 29189/-3, size 0-0 line 2870
[  254.091698] binder: 4033:4049 unknown command 0
[  254.091706] binder: 4033:4049 ioctl c0306201 20002fd0 returned -22
[  254.097822] binder: 4033:4057 ioctl c018620b 20000fe8 returned -14
[  254.100226] binder: 4035:4050 ioctl c018620b 20000fe8 returned -14
[  254.100474] binder: 4033:4057 BC_FREE_BUFFER uffffffffffffffff no match
[  254.100508] binder: 4033:4057 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.100517] binder: 4033:4057 got transaction to invalid handle
[  254.100527] binder: 4033:4057 transaction failed 29201/-22, size 0-8 line 2755
[  254.104963] binder: 4031:4048 ioctl c0306201 20005fd0 returned -14
[  254.111914] binder: 4031:4048 ioctl c018620b 2000dfe8 returned -14
[  254.132397] binder: 4031:4048 ioctl 40046205 0 returned -22
[  254.132439] binder: 4035:4050 ioctl 40046205 0 returned -22
[  254.146150] binder: BINDER_SET_CONTEXT_MGR already set
[  254.146158] binder: 4031:4048 ioctl 40046207 0 returned -16
[  254.146193] binder: 4031:4072 ERROR: BC_REGISTER_LOOPER called without request
[  254.146202] binder: 4072 RLIMIT_NICE not set
[  254.147482] binder_alloc: 2089: binder_alloc_buf, no vma
[  254.147504] binder: 4031:4048 transaction failed 29189/-3, size 0-0 line 2870
[  254.151166] binder: 4031:4048 ioctl c0306201 20002fd0 returned -14
[  254.154472] binder: BINDER_SET_CONTEXT_MGR already set
[  254.154481] binder: 4035:4050 ioctl 40046207 0 returned -16
[  254.154520] binder: 4035:4073 ERROR: BC_REGISTER_LOOPER called without request
[  254.154529] binder: 4073 RLIMIT_NICE not set
[  254.157230] binder: 4031:4072 BC_FREE_BUFFER uffffffffffffffff no match
[  254.157260] binder: 4031:4072 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.157267] binder: 4031:4072 got transaction to invalid handle
[  254.157276] binder: 4031:4072 transaction failed 29201/-22, size 0-8 line 2755
[  254.157290] binder: 4031:4072 ioctl c0306201 20005fd0 returned -14
[  254.164761] binder_alloc: 4008: binder_alloc_buf, no vma
[  254.164785] binder: 4035:4050 transaction failed 29189/-3, size 0-0 line 2870
[  254.172745] binder: 4035:4050 ioctl c0306201 20002fd0 returned -14
[  254.185638] binder: 4035:4073 ioctl c018620b 20000fe8 returned -14
[  254.188310] binder: 4035:4073 BC_FREE_BUFFER uffffffffffffffff no match
[  254.188340] binder: 4035:4073 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.188348] binder: 4035:4073 got transaction to invalid handle
[  254.188358] binder: 4035:4073 transaction failed 29201/-22, size 0-8 line 2755
[  254.333531] binder: BINDER_SET_CONTEXT_MGR already set
[  254.333539] binder: 4083:4090 ioctl 40046207 0 returned -16
[  254.336330] binder: 4083:4090 ERROR: BC_REGISTER_LOOPER called without request
[  254.336339] binder: 4090 RLIMIT_NICE not set
[  254.353711] binder: BINDER_SET_CONTEXT_MGR already set
[  254.353719] binder: 4088:4096 ioctl 40046207 0 returned -16
[  254.354080] binder: 4088:4096 ERROR: BC_REGISTER_LOOPER called without request
[  254.354088] binder: 4096 RLIMIT_NICE not set
[  254.355603] binder_alloc: 2089: binder_alloc_buf, no vma
[  254.355626] binder: 4083:4100 transaction failed 29189/-3, size 0-0 line 2870
[  254.370166] binder: 4083:4100 ioctl c0306201 20002fd0 returned -14
[  254.388837] binder_alloc: 4008: binder_alloc_buf, no vma
[  254.388860] binder: 4088:4104 transaction failed 29189/-3, size 0-0 line 2870
[  254.397083] binder: 4083:4100 ioctl c0306201 20005fd0 returned -14
[  254.398347] binder: 4083:4100 ioctl c018620b 2000dfe8 returned -14
[  254.401960] binder: 4088:4104 got reply transaction with no transaction stack
[  254.401968] binder: 4088:4104 transaction failed 29201/-71, size 24-8 line 2670
[  254.405777] binder: 4088:4104 ioctl c018620b 20000fe8 returned -14
[  254.430596] binder: 4083:4100 ioctl 40046205 0 returned -22
[  254.434710] binder: 4088:4104 ioctl 40046205 0 returned -22
[  254.436079] binder: BINDER_SET_CONTEXT_MGR already set
[  254.436087] binder: 4083:4100 ioctl 40046207 0 returned -16
[  254.436125] binder: 4083:4113 ERROR: BC_REGISTER_LOOPER called without request
[  254.436134] binder: 4113 RLIMIT_NICE not set
[  254.437452] binder_alloc: 2089: binder_alloc_buf, no vma
[  254.437476] binder: 4083:4100 transaction failed 29189/-3, size 0-0 line 2870
[  254.440671] binder: 4083:4100 ioctl c0306201 20002fd0 returned -14
[  254.448209] binder: BINDER_SET_CONTEXT_MGR already set
[  254.448216] binder: 4088:4104 ioctl 40046207 0 returned -16
[  254.448610] binder: 4088:4114 ERROR: BC_REGISTER_LOOPER called without request
[  254.448617] binder: 4114 RLIMIT_NICE not set
[  254.449825] binder_alloc: 4008: binder_alloc_buf, no vma
[  254.449850] binder: 4088:4104 transaction failed 29189/-3, size 0-0 line 2870
[  254.451106] binder: 4083:4113 BC_FREE_BUFFER uffffffffffffffff no match
[  254.451139] binder: 4083:4113 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.451148] binder: 4083:4113 got transaction to invalid handle
[  254.451157] binder: 4083:4113 transaction failed 29201/-22, size 0-8 line 2755
[  254.451172] binder: 4083:4113 ioctl c0306201 20005fd0 returned -14
[  254.452829] binder: 4088:4104 unknown command 1400526783
[  254.452837] binder: 4088:4104 ioctl c0306201 20002fd0 returned -22
[  254.455614] binder: 4088:4114 ioctl c018620b 20000fe8 returned -14
[  254.462044] binder: 4088:4114 BC_FREE_BUFFER uffffffffffffffff no match
[  254.462074] binder: 4088:4114 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.462081] binder: 4088:4114 got transaction to invalid handle
[  254.462090] binder: 4088:4114 transaction failed 29201/-22, size 0-8 line 2755
[  254.489912] binder: BINDER_SET_CONTEXT_MGR already set
[  254.489921] binder: 4123:4125 ioctl 40046207 0 returned -16
[  254.490070] binder: 4123:4125 ERROR: BC_REGISTER_LOOPER called without request
[  254.490078] binder: 4125 RLIMIT_NICE not set
[  254.516133] binder_alloc: 2089: binder_alloc_buf, no vma
[  254.516156] binder: 4123:4131 transaction failed 29189/-3, size 0-0 line 2870
[  254.524007] binder: 4123:4131 ioctl c0306201 20002fd0 returned -14
[  254.539684] binder: 4123:4131 ioctl c0306201 20005fd0 returned -14
[  254.540927] binder: 4123:4131 ioctl c018620b 2000dfe8 returned -14
[  254.553718] binder: 4123:4131 ioctl 40046205 0 returned -22
[  254.558824] binder: BINDER_SET_CONTEXT_MGR already set
[  254.558832] binder: 4123:4131 ioctl 40046207 0 returned -16
[  254.558897] binder: 4123:4133 ERROR: BC_REGISTER_LOOPER called without request
[  254.558904] binder: 4133 RLIMIT_NICE not set
[  254.562240] binder_alloc: 2089: binder_alloc_buf, no vma
[  254.562261] binder: 4123:4131 transaction failed 29189/-3, size 0-0 line 2870
[  254.565533] binder: 4123:4131 ioctl c0306201 20002fd0 returned -14
[  254.583232] binder: 4123:4133 BC_FREE_BUFFER uffffffffffffffff no match
[  254.583261] binder: 4123:4133 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.583268] binder: 4123:4133 got transaction to invalid handle
[  254.583278] binder: 4123:4133 transaction failed 29201/-22, size 0-8 line 2755
[  254.583295] binder: 4123:4133 ioctl c0306201 20005fd0 returned -14
[  254.616340] binder: BINDER_SET_CONTEXT_MGR already set
[  254.616348] binder: 4145:4148 ioctl 40046207 0 returned -16
[  254.616909] binder: 4145:4148 ERROR: BC_REGISTER_LOOPER called without request
[  254.616926] binder: 4145:4148 ioctl c0306201 20008fd0 returned -14
[  254.624559] binder_alloc: 4008: binder_alloc_buf, no vma
[  254.624583] binder: 4145:4148 transaction failed 29189/-3, size 0-0 line 2870
[  254.627900] binder: 4145:4148 ioctl c0306201 2000afd0 returned -14
[  254.628374] binder: 4145:4148 ioctl c018620b 20000fe8 returned -14
[  254.628809] binder: 4145:4148 BC_FREE_BUFFER uffffffffffffffff no match
[  254.628834] binder: 4145:4148 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.628841] binder: 4145:4148 got transaction to invalid handle
[  254.628849] binder: 4145:4148 transaction failed 29201/-22, size 0-8 line 2755
[  254.634746] binder: BINDER_SET_CONTEXT_MGR already set
[  254.634759] binder: 4144:4153 ioctl 40046207 0 returned -16
[  254.634840] binder: 4144:4153 ERROR: BC_REGISTER_LOOPER called without request
[  254.634847] binder: 4153 RLIMIT_NICE not set
[  254.639153] binder: 4145:4148 ioctl 40046205 0 returned -22
[  254.660878] binder_alloc: 2089: binder_alloc_buf, no vma
[  254.660906] binder: 4144:4160 transaction failed 29189/-3, size 0-0 line 2870
[  254.667198] binder: BINDER_SET_CONTEXT_MGR already set
[  254.667209] binder: 4145:4148 ioctl 40046207 0 returned -16
[  254.667251] binder: 4145:4155 ERROR: BC_REGISTER_LOOPER called without request
[  254.667272] binder: 4145:4155 ioctl c0306201 20008fd0 returned -14
[  254.673944] binder_alloc: 4008: binder_alloc_buf, no vma
[  254.673969] binder: 4145:4148 transaction failed 29189/-3, size 0-0 line 2870
[  254.688585] binder: 4145:4148 unknown command 1400526783
[  254.688594] binder: 4145:4148 ioctl c0306201 20002fd0 returned -22
[  254.698767] binder: 4145:4155 ioctl c018620b 20000fe8 returned -14
[  254.701140] binder: 4144:4160 ioctl c0306201 20005fd0 returned -14
[  254.702623] binder: 4144:4160 ioctl c018620b 2000dfe8 returned -14
[  254.707228] binder: 4145:4155 BC_FREE_BUFFER uffffffffffffffff no match
[  254.707265] binder: 4145:4155 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.707274] binder: 4145:4155 got transaction to invalid handle
[  254.707284] binder: 4145:4155 transaction failed 29201/-22, size 0-8 line 2755
[  254.721839] binder: 4144:4160 ioctl 40046205 0 returned -22
[  254.723190] binder: BINDER_SET_CONTEXT_MGR already set
[  254.723198] binder: 4169:4171 ioctl 40046207 0 returned -16
[  254.723364] binder: 4169:4171 ERROR: BC_REGISTER_LOOPER called without request
[  254.723372] binder: 4171 RLIMIT_NICE not set
[  254.727120] binder: BINDER_SET_CONTEXT_MGR already set
[  254.727128] binder: 4144:4160 ioctl 40046207 0 returned -16
[  254.727166] binder: 4144:4174 ERROR: BC_REGISTER_LOOPER called without request
[  254.727173] binder: 4174 RLIMIT_NICE not set
[  254.728442] binder_alloc: 2089: binder_alloc_buf, no vma
[  254.728466] binder: 4144:4160 transaction failed 29189/-3, size 0-0 line 2870
[  254.742210] binder: 4144:4160 ioctl c0306201 20002fd0 returned -14
[  254.747843] binder: 4144:4174 BC_FREE_BUFFER uffffffffffffffff no match
[  254.747889] binder: 4144:4174 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.747898] binder: 4144:4174 got transaction to invalid handle
[  254.747908] binder: 4144:4174 transaction failed 29201/-22, size 0-8 line 2755
[  254.747923] binder: 4144:4174 ioctl c0306201 20005fd0 returned -14
[  254.749583] binder_alloc: 2840: binder_alloc_buf, no vma
[  254.749609] binder: 4169:4180 transaction failed 29189/-3, size 0-0 line 2870
[  254.776663] binder: BINDER_SET_CONTEXT_MGR already set
[  254.776671] binder: 4176:4179 ioctl 40046207 0 returned -16
[  254.776919] binder: 4176:4179 ERROR: BC_REGISTER_LOOPER called without request
[  254.776926] binder: 4179 RLIMIT_NICE not set
[  254.779063] binder: 4169:4180 got reply transaction with no transaction stack
[  254.779071] binder: 4169:4180 transaction failed 29201/-71, size 24-8 line 2670
[  254.798385] binder_alloc: 4008: binder_alloc_buf, no vma
[  254.798407] binder: 4176:4181 transaction failed 29189/-3, size 0-0 line 2870
[  254.802482] binder: 4169:4180 ioctl 40046205 0 returned -22
[  254.815796] binder: 4176:4181 got reply transaction with no transaction stack
[  254.815805] binder: 4176:4181 transaction failed 29201/-71, size 24-8 line 2670
[  254.815920] binder: BINDER_SET_CONTEXT_MGR already set
[  254.815927] binder: 4169:4180 ioctl 40046207 0 returned -16
[  254.816176] binder: 4169:4182 ERROR: BC_REGISTER_LOOPER called without request
[  254.816185] binder: 4182 RLIMIT_NICE not set
[  254.817485] binder_alloc: 2840: binder_alloc_buf, no vma
[  254.817505] binder: 4169:4180 transaction failed 29189/-3, size 0-0 line 2870
[  254.819888] binder: 4176:4181 ioctl c018620b 20000fe8 returned -14
[  254.820036] binder: 4169:4180 unknown command 1400526783
[  254.820044] binder: 4169:4180 ioctl c0306201 20002fd0 returned -22
[  254.825272] binder: 4169:4182 BC_FREE_BUFFER u0000000000000000 no match
[  254.825298] binder: 4169:4182 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.825305] binder: 4169:4182 got transaction to invalid handle
[  254.825313] binder: 4169:4182 transaction failed 29201/-22, size 0-8 line 2755
[  254.838775] binder: 4176:4181 ioctl 40046205 0 returned -22
[  254.843697] binder: BINDER_SET_CONTEXT_MGR already set
[  254.843704] binder: 4176:4181 ioctl 40046207 0 returned -16
[  254.843733] binder: 4176:4183 ERROR: BC_REGISTER_LOOPER called without request
[  254.843756] binder: 4183 RLIMIT_NICE not set
[  254.844934] binder_alloc: 4008: binder_alloc_buf, no vma
[  254.844953] binder: 4176:4181 transaction failed 29189/-3, size 0-0 line 2870
[  254.847563] binder: 4176:4181 unknown command 1400526783
[  254.847570] binder: 4176:4181 ioctl c0306201 20002fd0 returned -22
[  254.850244] binder: 4176:4183 ioctl c018620b 20000fe8 returned -14
[  254.852809] binder: 4176:4183 BC_FREE_BUFFER uffffffffffffffff no match
[  254.852833] binder: 4176:4183 IncRefs 0 refcount change on invalid ref 1 ret -22
[  254.852840] binder: 4176:4183 got transaction to invalid handle
[  254.852848] binder: 4176:4183 transaction failed 29201/-22, size 0-8 line 2755
[  265.970788] binder: undelivered TRANSACTION_ERROR: 29189
[  265.976416] binder: undelivered TRANSACTION_ERROR: 29189
[  265.982076] binder: undelivered TRANSACTION_ERROR: 29189
[  265.987719] binder: undelivered TRANSACTION_ERROR: 29189
[  265.993344] binder: undelivered TRANSACTION_ERROR: 29189
[  265.998910] binder: undelivered TRANSACTION_ERROR: 29189
[  266.004634] binder: undelivered TRANSACTION_ERROR: 29189
[  266.010173] binder: undelivered TRANSACTION_COMPLETE
[  266.015292] binder: undelivered transaction 1731
[  266.020293] binder: undelivered TRANSACTION_ERROR: 29189
[  266.025903] binder: undelivered TRANSACTION_ERROR: 29189
[  266.031470] binder: undelivered TRANSACTION_ERROR: 29189
[  266.037187] binder: undelivered TRANSACTION_ERROR: 29189
[  266.042998] binder: undelivered TRANSACTION_ERROR: 29189
[  266.048923] binder: undelivered TRANSACTION_ERROR: 29189
[  266.054425] binder: undelivered TRANSACTION_ERROR: 29189
[  266.059960] binder: undelivered TRANSACTION_ERROR: 29189
[  266.065559] binder: undelivered TRANSACTION_ERROR: 29189
[  266.071087] binder: undelivered TRANSACTION_COMPLETE
[  266.076205] binder: undelivered transaction 1677
[  266.081192] binder: undelivered TRANSACTION_ERROR: 29189
[  266.086751] binder: undelivered TRANSACTION_ERROR: 29189
[  266.092220] binder: undelivered TRANSACTION_ERROR: 29201
[  266.097782] binder: undelivered TRANSACTION_ERROR: 29201
[  266.103339] binder: undelivered TRANSACTION_ERROR: 29189
[  266.108797] binder: undelivered TRANSACTION_ERROR: 29201
[  266.114367] binder: undelivered TRANSACTION_ERROR: 29201
[  266.119910] binder: undelivered TRANSACTION_ERROR: 29189
[  266.125385] binder: undelivered TRANSACTION_ERROR: 29201
[  266.130898] binder: undelivered TRANSACTION_ERROR: 29201
[  266.136474] binder: undelivered TRANSACTION_ERROR: 29201
[  266.142049] binder: undelivered TRANSACTION_ERROR: 29189
[  266.147503] binder: undelivered TRANSACTION_ERROR: 29201
[  266.153077] binder: send failed reply for transaction 1626 to 3648:3659
[  266.159839] binder: undelivered TRANSACTION_ERROR: 29201
[  266.165297] binder: undelivered TRANSACTION_COMPLETE
[  266.170400] binder: undelivered TRANSACTION_ERROR: 29189
[  266.176050] binder: undelivered TRANSACTION_ERROR: 29189
[  266.181619] binder: undelivered TRANSACTION_ERROR: 29189
[  266.187085] binder: undelivered TRANSACTION_ERROR: 29201
[  266.192632] binder: undelivered TRANSACTION_ERROR: 29189
[  266.198322] binder: undelivered TRANSACTION_ERROR: 29189
[  266.203933] binder: undelivered TRANSACTION_ERROR: 29189
[  266.209607] binder: undelivered TRANSACTION_ERROR: 29189
[  266.215213] binder: undelivered TRANSACTION_ERROR: 29189
[  266.221039] binder: undelivered TRANSACTION_ERROR: 29189
[  266.226592] binder: undelivered TRANSACTION_ERROR: 29189
[  266.232368] binder: undelivered TRANSACTION_ERROR: 29189
[  266.237924] binder: undelivered TRANSACTION_ERROR: 29189
[  266.243503] binder: undelivered TRANSACTION_ERROR: 29189
[  266.248986] binder: undelivered TRANSACTION_ERROR: 29189
[  266.254526] binder: undelivered TRANSACTION_ERROR: 29189
[  266.260114] binder: undelivered TRANSACTION_ERROR: 29189
[  266.265597] binder: undelivered TRANSACTION_ERROR: 29189
[  266.271143] binder: undelivered TRANSACTION_ERROR: 29189
[  266.276596] binder: undelivered TRANSACTION_ERROR: 29201
[  266.282156] binder: undelivered TRANSACTION_ERROR: 29201
[  266.287622] binder: undelivered TRANSACTION_ERROR: 29189
[  266.293198] binder: undelivered TRANSACTION_ERROR: 29189
[  266.298653] binder: undelivered TRANSACTION_ERROR: 29201
[  266.304140] binder: undelivered TRANSACTION_ERROR: 29189
[  266.309758] binder: undelivered TRANSACTION_ERROR: 29189
[  266.315244] binder: undelivered TRANSACTION_ERROR: 29201
[  266.320718] binder: undelivered TRANSACTION_ERROR: 29201
[  266.326227] binder: undelivered TRANSACTION_ERROR: 29189
[  266.331697] binder: undelivered TRANSACTION_ERROR: 29189
[  266.337163] binder: undelivered TRANSACTION_ERROR: 29201
[  266.342628] binder: undelivered TRANSACTION_ERROR: 29201
[  266.348155] binder: undelivered TRANSACTION_ERROR: 29201
[  266.353615] binder: undelivered TRANSACTION_ERROR: 29201
[  266.359079] binder: undelivered TRANSACTION_ERROR: 29189
[  266.364549] binder: undelivered TRANSACTION_ERROR: 29201
[  266.370159] binder: undelivered TRANSACTION_ERROR: 29189
[  266.375628] binder: undelivered TRANSACTION_ERROR: 29189
[  266.381086] binder: undelivered TRANSACTION_ERROR: 29201
[  266.386556] binder: undelivered TRANSACTION_ERROR: 29201
[  266.392074] binder: undelivered TRANSACTION_ERROR: 29201
[  266.397653] binder: undelivered TRANSACTION_ERROR: 29189
[  266.403182] binder: undelivered TRANSACTION_ERROR: 29189
[  266.408807] binder: undelivered TRANSACTION_ERROR: 29189
[  266.414433] binder: undelivered TRANSACTION_ERROR: 29189
[  266.420341] binder: undelivered TRANSACTION_ERROR: 29189
[  266.425886] binder: undelivered TRANSACTION_ERROR: 29189
[  266.431608] binder: undelivered TRANSACTION_ERROR: 29189
[  266.437114] binder: undelivered TRANSACTION_COMPLETE
[  266.442221] binder: undelivered transaction 1394
[  266.447271] binder: undelivered TRANSACTION_ERROR: 29189
[  266.452737] binder: undelivered TRANSACTION_ERROR: 29201
[  266.458288] binder: undelivered TRANSACTION_ERROR: 29189
[  266.463823] binder: undelivered TRANSACTION_ERROR: 29189
[  266.469357] binder: undelivered TRANSACTION_ERROR: 29189
[  266.474908] binder: undelivered TRANSACTION_ERROR: 29189
[  266.480478] binder: undelivered TRANSACTION_ERROR: 29189
[  266.485993] binder: undelivered TRANSACTION_ERROR: 29189
[  266.491592] binder: undelivered TRANSACTION_ERROR: 29201
[  266.497128] binder: undelivered TRANSACTION_ERROR: 29189
[  266.502732] binder: undelivered TRANSACTION_ERROR: 29189
[  266.508324] binder: undelivered TRANSACTION_ERROR: 29189
[  266.513913] binder: undelivered TRANSACTION_ERROR: 29189
[  266.519475] binder: undelivered TRANSACTION_ERROR: 29189
[  266.525227] binder: undelivered TRANSACTION_ERROR: 29189
[  266.530842] binder: undelivered TRANSACTION_ERROR: 29189
[  266.536394] binder: undelivered TRANSACTION_ERROR: 29189
[  266.541983] binder: undelivered TRANSACTION_ERROR: 29189
[  266.547535] binder: undelivered TRANSACTION_ERROR: 29189
[  266.553155] binder: undelivered TRANSACTION_ERROR: 29189
[  266.558760] binder: undelivered TRANSACTION_ERROR: 29189
[  266.564417] binder: undelivered TRANSACTION_ERROR: 29189
[  266.569939] binder: undelivered TRANSACTION_ERROR: 29189
[  266.575399] binder: undelivered TRANSACTION_ERROR: 29201
[  266.580869] binder: undelivered TRANSACTION_ERROR: 29201
[  266.586442] binder: undelivered TRANSACTION_ERROR: 29201
[  266.591948] binder: undelivered TRANSACTION_ERROR: 29189
[  266.597579] binder: undelivered TRANSACTION_COMPLETE
[  266.602686] binder: undelivered transaction 1207
[  266.607619] binder: unexpected work type, 4, not freed
[  266.612900] binder: undelivered TRANSACTION_COMPLETE
[  266.618031] binder: undelivered TRANSACTION_ERROR: 29201
[  266.623480] binder: undelivered TRANSACTION_COMPLETE
[  266.628592] binder: undelivered transaction 1202
[  266.640070] binder: undelivered TRANSACTION_ERROR: 29189
[  266.645619] binder: undelivered TRANSACTION_ERROR: 29201
[  266.651149] binder: undelivered TRANSACTION_ERROR: 29189
[  266.656838] binder: undelivered TRANSACTION_ERROR: 29189
[  266.662332] binder: undelivered TRANSACTION_ERROR: 29201
[  266.667838] binder: undelivered TRANSACTION_ERROR: 29189
[  266.673373] binder: undelivered TRANSACTION_ERROR: 29189
[  266.678856] binder: undelivered TRANSACTION_ERROR: 29201
[  266.684351] binder: undelivered TRANSACTION_ERROR: 29189
[  266.689841] binder: undelivered TRANSACTION_ERROR: 29201
[  266.695340] binder: undelivered TRANSACTION_ERROR: 29189
[  266.700869] binder: undelivered TRANSACTION_ERROR: 29189
[  266.706425] binder: undelivered TRANSACTION_ERROR: 29189
[  266.711909] binder: undelivered TRANSACTION_ERROR: 29201
[  266.717434] binder: undelivered TRANSACTION_ERROR: 29189
[  266.722956] binder: undelivered TRANSACTION_ERROR: 29189
[  266.728448] binder: undelivered TRANSACTION_ERROR: 29201
[  266.733962] binder: undelivered TRANSACTION_ERROR: 29189
[  266.739458] binder: undelivered TRANSACTION_ERROR: 29201
[  266.744943] binder: undelivered TRANSACTION_ERROR: 29189
[  266.750443] binder: undelivered TRANSACTION_ERROR: 29201
[  266.755928] binder: undelivered TRANSACTION_ERROR: 29189
[  266.761428] binder: undelivered TRANSACTION_ERROR: 29201
2017/12/02 09:23:19 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_sctp(0xa, 0x805, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000224000-0x2c)=[@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}], 0x1c)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000ba0000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r1 = syz_open_dev$tun(&(0x7f00002d2000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000141000)=0x101)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000533000)={@generic="02000000040000000004008000e9bc22", @ifru_settings={0x10001, 0x0, @fr=&(0x7f0000013000-0x18)={0x0, 0x8000000000002, 0x3, 0xfffffffffffffffb, 0x81c7, 0x7fffffff, 0x26e}}})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000dd6000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r2 = syz_open_dev$evdev(&(0x7f0000cc3000-0x12)="2f6465762f696e7075742f6576656e742300", 0x1, 0x80)
fallocate(r2, 0x3, 0x700000, 0x0)
syz_open_dev$tun(&(0x7f0000b1f000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
r3 = socket(0x10, 0x3, 0x4000000000)
write(r3, &(0x7f00000b8000)="260000005e0009fff10000f83a0000000000000001000000ffffffee0000085b1ee9fb4b35ea", 0x26)
2017/12/02 09:23:19 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0x62, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb1d9cd1af5dea4037b54926a5c678474f908986cb0e56d62f1c8b6b73beb3bec523434238d9fb1e05a754703f1e23d1f2ec"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:19 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x0, &(0x7f000000a000)="")
2017/12/02 09:23:19 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
dup2(r4, r0)
getegid()
2017/12/02 09:23:19 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000071f000-0x78)={0x0, 0x78, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xffffffffffff8000, 0x400000000, 0x0, 0x0, 0x2408000000, 0x2, 0x0, 0x0, 0x0, 0x2ba69649, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffffff, 0x1ff, 0xffffffffffffff9c, 0x8)
perf_event_open(&(0x7f00008a8000-0x78)={0x4000000002, 0x78, 0xa2, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000390000)=0x0)
r0 = getpgid(0x0)
gettid()
r1 = getpgrp(r0)
perf_event_open(&(0x7f00006d1000)={0x2, 0x78, 0xc30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f00008ab000-0x8)=0x8000000074)
r2 = memfd_create(&(0x7f0000e5f000-0x3)="405b00", 0x2)
ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0086426, &(0x7f00004ab000)={0x3, &(0x7f00006b6000-0x18)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$sock_int(r3, 0x1, 0x800000008, &(0x7f0000f8f000-0x4)=0x0, 0x4)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
r5 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xd4e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2001000000000f6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000cc5000)="2e2f66696c653000", 0x10000, 0x0)
r6 = socket(0x11, 0x3, 0x0)
bind(r6, &(0x7f00005a2000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679c00800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c000100000000e9ffff48740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000122000)={{{@in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, @in6=@local={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {{@in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0}, 0x0, @in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f00001a1000)=0xe8)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r6, 0x84, 0x13, &(0x7f00009d5000-0x4)=0x10000, 0x4)
r7 = socket$inet(0x2, 0x80a, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0xfffffffffffffffd})
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000586000)={0x0, @in6={{0xa, 0x3, 0xfb1, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x4}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x2, 0x80000001, 0x7, 0x7, 0x7d}, &(0x7f0000555000)=0xa0)
perf_event_open(&(0x7f00006b3000-0x78)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0x0, r5, 0x0)
writev(r6, &(0x7f0000cdc000-0x20)=[], 0x0)
r8 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0x100})
2017/12/02 09:23:19 executing program 0:
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:19 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000071f000-0x78)={0x0, 0x78, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xffffffffffff8000, 0x400000000, 0x0, 0x0, 0x2408000000, 0x2, 0x0, 0x0, 0x0, 0x2ba69649, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffffff, 0x1ff, 0xffffffffffffff9c, 0x8)
perf_event_open(&(0x7f00008a8000-0x78)={0x4000000002, 0x78, 0xa2, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000390000)=0x0)
r0 = getpgid(0x0)
gettid()
r1 = getpgrp(r0)
perf_event_open(&(0x7f00006d1000)={0x2, 0x78, 0xc30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f00008ab000-0x8)=0x8000000074)
r2 = memfd_create(&(0x7f0000e5f000-0x3)="405b00", 0x2)
ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0086426, &(0x7f00004ab000)={0x3, &(0x7f00006b6000-0x18)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$sock_int(r3, 0x1, 0x800000008, &(0x7f0000f8f000-0x4)=0x0, 0x4)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
r5 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xd4e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2001000000000f6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000cc5000)="2e2f66696c653000", 0x10000, 0x0)
r6 = socket(0x11, 0x3, 0x0)
bind(r6, &(0x7f00005a2000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679c00800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c000100000000e9ffff48740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000122000)={{{@in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, @in6=@local={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {{@in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0}, 0x0, @in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f00001a1000)=0xe8)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r6, 0x84, 0x13, &(0x7f00009d5000-0x4)=0x10000, 0x4)
r7 = socket$inet(0x2, 0x80a, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0xfffffffffffffffd})
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000586000)={0x0, @in6={{0xa, 0x3, 0xfb1, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x4}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x2, 0x80000001, 0x7, 0x7, 0x7d}, &(0x7f0000555000)=0xa0)
perf_event_open(&(0x7f00006b3000-0x78)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0x0, r5, 0x0)
writev(r6, &(0x7f0000cdc000-0x20)=[], 0x0)
r8 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0x100})
2017/12/02 09:23:19 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="", 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:19 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:20 executing program 5:
r0 = open(&(0x7f0000e9f000)="2e2f66696c653000", 0x80000, 0x8)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$FIONREAD(r0, 0x541b, &(0x7f0000001000-0x4)=0x0)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
ioctl$fiemap(r0, 0xc020660b, &(0x7f0000a56000)={0xa36d, 0xc6b0, 0x6, 0xffffffffffffffff, 0x4, [{0x80000001, 0x40, 0x7, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0}, {0x0, 0x8, 0x5, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0}, {0x11f, 0x8, 0xffffffff7fffffff, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0}, {0x3ff, 0x3, 0x5, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0}]})
write(r1, &(0x7f0000372000)="23216164", 0x4)
execveat(r1, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000745000-0x4)=0x0)
[  266.767624] binder: undelivered TRANSACTION_ERROR: 29189
[  266.773187] binder: undelivered TRANSACTION_ERROR: 29201
[  266.780427] binder: undelivered TRANSACTION_ERROR: 29189
[  266.797164] binder: 4193:4196 ERROR: BC_REGISTER_LOOPER called without request
[  266.797174] binder: 4196 RLIMIT_NICE not set
[  266.812694] binder: undelivered TRANSACTION_ERROR: 29189
2017/12/02 09:23:20 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:20 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f000000b000-0xd7)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  266.835222] binder: undelivered TRANSACTION_ERROR: 29189
[  266.840827] binder: 4196 RLIMIT_NICE not set
[  266.842437] binder: 4193:4196 ioctl c0306201 20002fd0 returned -14
[  266.842775] binder: 4196 RLIMIT_NICE not set
[  266.843562] binder: 4193:4196 BC_FREE_BUFFER uffffffffffffffff no match
2017/12/02 09:23:20 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x0, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:20 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r3 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r3, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r4=>0x0})
mq_timedsend(r3, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r4})
ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
[  266.843656] binder: 4193:4196 got transaction with invalid offsets ptr
[  266.843692] binder: 4193:4196 transaction failed 29201/-14, size 0-8 line 2898
[  266.843713] binder: 4193:4196 ioctl c0306201 20005fd0 returned -14
[  266.844209] binder: 4193:4196 ioctl c018620b 2000dfe8 returned -14
[  266.854402] device lo entered promiscuous mode
[  266.854552] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
2017/12/02 09:23:20 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:20 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f00007f5000)=[&(0x7f0000890000-0x11)="2f6465762f7667615f6172626974657200", &(0x7f000007d000-0x11)="2f6465762f7667615f6172626974657200", &(0x7f00007ff000-0x8)="73656c696e757800", &(0x7f0000440000-0x11)="2f6465762f7667615f6172626974657200", &(0x7f00004e7000)="2f6465762f7667615f6172626974657200", &(0x7f0000909000)="00"], &(0x7f00004ef000-0x4)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
openat$rfkill(0xffffffffffffff9c, &(0x7f0000e9f000)="2f6465762f72666b696c6c00", 0x10080, 0x0)
fsync(r0)
[  266.855556] binder: 4193:4196 ioctl 40046205 0 returned -22
[  266.866956] binder: BINDER_SET_CONTEXT_MGR already set
[  266.866967] binder: 4193:4196 ioctl 40046207 0 returned -16
[  266.867038] binder: 4193:4212 ERROR: BC_REGISTER_LOOPER called without request
[  266.867048] binder: 4212 RLIMIT_NICE not set
[  266.868399] binder_alloc: 4193: binder_alloc_buf, no vma
[  266.868428] binder: 4193:4196 transaction failed 29189/-3, size 0-0 line 2870
[  266.871310] binder: 4193:4196 ioctl c0306201 20002fd0 returned -14
[  266.878207] binder: 4193:4212 BC_FREE_BUFFER uffffffffffffffff no match
[  266.878242] binder: 4193:4212 IncRefs 0 refcount change on invalid ref 1 ret -22
[  266.878251] binder: 4193:4212 got transaction to invalid handle
[  266.878262] binder: 4193:4212 transaction failed 29201/-22, size 0-8 line 2755
[  266.878279] binder: 4193:4212 ioctl c0306201 20005fd0 returned -14
[  266.906935] binder: BINDER_SET_CONTEXT_MGR already set
[  266.906946] binder: 4222:4224 ioctl 40046207 0 returned -16
[  266.907364] binder: 4222:4224 ERROR: BC_REGISTER_LOOPER called without request
[  266.907374] binder: 4224 RLIMIT_NICE not set
[  266.935522] binder_alloc: 4193: binder_alloc_buf, no vma
[  266.935551] binder: 4222:4232 transaction failed 29189/-3, size 0-0 line 2870
[  266.981673] binder: 4222:4232 ioctl c0306201 20005fd0 returned -14
[  266.987430] binder: 4222:4232 ioctl c018620b 2000dfe8 returned -14
[  267.015820] binder: 4222:4232 ioctl 40046205 0 returned -22
[  267.028119] binder: BINDER_SET_CONTEXT_MGR already set
[  267.028129] binder: 4222:4232 ioctl 40046207 0 returned -16
[  267.028219] binder: 4222:4248 ERROR: BC_REGISTER_LOOPER called without request
[  267.028228] binder: 4248 RLIMIT_NICE not set
[  267.029463] binder_alloc: 4193: binder_alloc_buf, no vma
[  267.029488] binder: 4222:4232 transaction failed 29189/-3, size 0-0 line 2870
[  267.040814] binder: 4222:4232 ioctl c0306201 20002fd0 returned -14
[  267.046031] binder: 4222:4248 BC_FREE_BUFFER uffffffffffffffff no match
[  267.046069] binder: 4222:4248 IncRefs 0 refcount change on invalid ref 1 ret -22
[  267.046078] binder: 4222:4248 got transaction to invalid handle
[  267.046088] binder: 4222:4248 transaction failed 29201/-22, size 0-8 line 2755
[  267.046105] binder: 4222:4248 ioctl c0306201 20005fd0 returned -14
[  267.178864] binder: undelivered TRANSACTION_ERROR: 29189
[  267.184446] binder: unexpected work type, 4, not freed
[  267.189735] binder: undelivered TRANSACTION_COMPLETE
[  267.194852] binder: undelivered TRANSACTION_ERROR: 29201
[  267.200305] binder: undelivered TRANSACTION_COMPLETE
[  267.205419] binder: undelivered transaction 1790
[  267.210425] binder: undelivered TRANSACTION_ERROR: 29189
[  267.215940] binder: undelivered TRANSACTION_ERROR: 29201
[  267.221426] binder: undelivered TRANSACTION_ERROR: 29189
[  267.226980] binder: undelivered TRANSACTION_ERROR: 29189
[  267.232512] binder: undelivered TRANSACTION_ERROR: 29189
[  267.238160] binder: undelivered TRANSACTION_ERROR: 29189
[  267.243651] binder: undelivered TRANSACTION_ERROR: 29201
[  267.249160] binder: undelivered TRANSACTION_ERROR: 29189
[  267.254709] binder: undelivered TRANSACTION_ERROR: 29189
[  267.260229] binder: undelivered TRANSACTION_ERROR: 29201
[  267.265722] binder: undelivered TRANSACTION_ERROR: 29201
[  267.271276] binder: undelivered TRANSACTION_ERROR: 29189
[  267.276765] binder: undelivered TRANSACTION_ERROR: 29201
[  267.282275] binder: undelivered TRANSACTION_ERROR: 29201
[  267.287753] binder: undelivered TRANSACTION_ERROR: 29189
[  267.293260] binder: undelivered TRANSACTION_ERROR: 29201
[  267.298788] binder: undelivered TRANSACTION_ERROR: 29201
[  267.304318] binder: undelivered TRANSACTION_ERROR: 29189
[  267.309840] binder: undelivered TRANSACTION_ERROR: 29189
[  267.315344] binder: undelivered TRANSACTION_ERROR: 29201
[  267.320828] binder: undelivered TRANSACTION_ERROR: 29189
[  267.326383] binder: undelivered TRANSACTION_ERROR: 29189
[  267.331898] binder: undelivered TRANSACTION_ERROR: 29189
[  267.337409] binder: undelivered TRANSACTION_ERROR: 29201
[  267.342895] binder: undelivered TRANSACTION_ERROR: 29189
[  267.348467] binder: undelivered TRANSACTION_ERROR: 29189
[  267.353996] binder: undelivered TRANSACTION_ERROR: 29189
[  267.359506] binder: undelivered TRANSACTION_ERROR: 29201
[  267.364992] binder: undelivered TRANSACTION_ERROR: 29189
[  267.370545] binder: undelivered TRANSACTION_ERROR: 29189
[  267.376120] binder: undelivered TRANSACTION_ERROR: 29189
[  267.381608] binder: undelivered TRANSACTION_ERROR: 29201
[  267.387143] binder: undelivered TRANSACTION_ERROR: 29189
[  267.392671] binder: undelivered TRANSACTION_ERROR: 29189
[  267.398185] binder: undelivered TRANSACTION_ERROR: 29201
[  267.403671] binder: undelivered TRANSACTION_ERROR: 29189
[  267.409171] binder: undelivered TRANSACTION_ERROR: 29189
[  267.414657] binder: undelivered TRANSACTION_ERROR: 29201
[  267.420185] binder: undelivered TRANSACTION_ERROR: 29201
[  267.425698] binder: undelivered TRANSACTION_ERROR: 29189
[  267.431184] binder: undelivered TRANSACTION_ERROR: 29201
[  267.436685] binder: undelivered TRANSACTION_ERROR: 29189
[  267.442227] binder: undelivered TRANSACTION_ERROR: 29189
[  267.447700] binder: undelivered TRANSACTION_ERROR: 29201
[  267.453199] binder: undelivered TRANSACTION_ERROR: 29189
[  267.458705] binder: undelivered TRANSACTION_ERROR: 29201
[  267.464216] binder: undelivered TRANSACTION_ERROR: 29189
[  267.469745] binder: undelivered TRANSACTION_ERROR: 29189
[  267.475248] binder: undelivered TRANSACTION_ERROR: 29201
[  267.480741] binder: undelivered TRANSACTION_ERROR: 29189
[  267.486238] binder: undelivered TRANSACTION_ERROR: 29201
[  267.491737] binder: undelivered TRANSACTION_ERROR: 29189
[  267.497276] binder: undelivered TRANSACTION_ERROR: 29189
[  267.502759] binder: undelivered TRANSACTION_ERROR: 29189
[  267.508246] binder: undelivered TRANSACTION_ERROR: 29189
[  267.513769] binder: undelivered TRANSACTION_ERROR: 29189
[  267.519318] binder: undelivered TRANSACTION_ERROR: 29189
[  267.524832] binder: undelivered TRANSACTION_ERROR: 29189
[  267.530340] binder: undelivered TRANSACTION_ERROR: 29201
[  267.535831] binder: undelivered TRANSACTION_ERROR: 29189
[  267.541338] binder: undelivered TRANSACTION_ERROR: 29201
[  267.546830] binder: undelivered TRANSACTION_ERROR: 29189
[  267.552382] binder: undelivered TRANSACTION_ERROR: 29189
[  267.557863] binder: undelivered TRANSACTION_ERROR: 29189
[  267.563369] binder: undelivered TRANSACTION_ERROR: 29201
[  267.568857] binder: undelivered TRANSACTION_ERROR: 29189
[  267.574478] binder: undelivered TRANSACTION_ERROR: 29201
[  267.580615] binder: undelivered TRANSACTION_ERROR: 29201
[  267.586109] binder: undelivered TRANSACTION_ERROR: 29189
[  267.591675] binder: undelivered TRANSACTION_ERROR: 29189
[  267.597206] binder: undelivered TRANSACTION_ERROR: 29201
[  267.602707] binder: undelivered TRANSACTION_ERROR: 29189
[  267.608219] binder: undelivered TRANSACTION_ERROR: 29189
[  267.613822] binder: undelivered TRANSACTION_ERROR: 29201
[  267.619365] binder: undelivered TRANSACTION_ERROR: 29189
[  267.624904] binder: undelivered TRANSACTION_ERROR: 29189
[  267.630384] binder: undelivered TRANSACTION_ERROR: 29189
[  267.635875] binder: undelivered TRANSACTION_ERROR: 29201
[  267.641358] binder: undelivered TRANSACTION_ERROR: 29189
[  267.646831] binder: undelivered TRANSACTION_ERROR: 29201
[  267.652334] binder: undelivered TRANSACTION_ERROR: 29201
[  267.657856] binder: undelivered TRANSACTION_ERROR: 29189
[  267.663371] binder: undelivered TRANSACTION_ERROR: 29189
[  267.668869] binder: undelivered TRANSACTION_ERROR: 29201
[  267.674367] binder: undelivered TRANSACTION_ERROR: 29189
[  267.679976] binder: undelivered TRANSACTION_ERROR: 29189
[  267.685597] binder: undelivered TRANSACTION_ERROR: 29189
[  267.691099] binder: undelivered TRANSACTION_ERROR: 29201
[  267.696614] binder: undelivered TRANSACTION_ERROR: 29189
[  267.702129] binder: undelivered TRANSACTION_ERROR: 29189
[  267.707673] binder: undelivered TRANSACTION_ERROR: 29189
[  267.713154] binder: undelivered TRANSACTION_ERROR: 29189
[  267.718647] binder: undelivered TRANSACTION_ERROR: 29201
[  267.724180] binder: undelivered TRANSACTION_ERROR: 29189
[  267.729736] binder: undelivered TRANSACTION_ERROR: 29189
[  267.735232] binder: undelivered TRANSACTION_ERROR: 29189
[  267.740724] binder: undelivered TRANSACTION_ERROR: 29201
[  267.746234] binder: undelivered TRANSACTION_ERROR: 29189
[  267.751782] binder: undelivered TRANSACTION_ERROR: 29189
[  267.757270] binder: undelivered TRANSACTION_ERROR: 29201
[  267.762800] binder: undelivered TRANSACTION_ERROR: 29189
[  267.768327] binder: undelivered TRANSACTION_ERROR: 29189
[  267.773824] binder: undelivered TRANSACTION_ERROR: 29201
[  267.779321] binder: undelivered TRANSACTION_ERROR: 29189
[  267.784949] binder: undelivered TRANSACTION_ERROR: 29201
[  267.790468] binder: undelivered TRANSACTION_ERROR: 29189
[  267.795982] binder: undelivered TRANSACTION_ERROR: 29189
[  267.801483] binder: undelivered TRANSACTION_ERROR: 29201
[  267.807003] binder: undelivered TRANSACTION_ERROR: 29201
[  267.812525] binder: undelivered TRANSACTION_ERROR: 29189
[  267.818111] binder: undelivered TRANSACTION_ERROR: 29189
[  267.823590] binder: undelivered TRANSACTION_ERROR: 29201
[  267.829099] binder: undelivered TRANSACTION_ERROR: 29189
[  267.834615] binder: undelivered TRANSACTION_ERROR: 29189
[  267.840151] binder: undelivered TRANSACTION_ERROR: 29189
[  267.845636] binder: undelivered TRANSACTION_ERROR: 29201
[  267.851151] binder: undelivered TRANSACTION_ERROR: 29189
[  267.856723] binder: undelivered TRANSACTION_ERROR: 29189
[  267.862207] binder: undelivered TRANSACTION_ERROR: 29201
[  267.867706] binder: undelivered TRANSACTION_ERROR: 29189
[  267.873221] binder: undelivered TRANSACTION_ERROR: 29189
[  267.878757] binder: undelivered TRANSACTION_ERROR: 29189
[  267.884275] binder: undelivered TRANSACTION_ERROR: 29189
[  267.889775] binder: undelivered TRANSACTION_ERROR: 29201
[  267.895335] binder: undelivered TRANSACTION_ERROR: 29189
[  267.900913] binder: undelivered TRANSACTION_ERROR: 29189
[  267.906404] binder: undelivered TRANSACTION_ERROR: 29201
[  267.911904] binder: undelivered TRANSACTION_ERROR: 29189
[  267.917422] binder: undelivered TRANSACTION_ERROR: 29189
[  267.922918] binder: undelivered TRANSACTION_ERROR: 29201
[  267.928394] binder: undelivered TRANSACTION_ERROR: 29189
[  267.933939] binder: undelivered TRANSACTION_ERROR: 29189
[  267.939419] binder: undelivered TRANSACTION_ERROR: 29201
[  267.944915] binder: undelivered TRANSACTION_ERROR: 29189
[  267.950430] binder: undelivered TRANSACTION_ERROR: 29189
[  267.955928] binder: undelivered TRANSACTION_ERROR: 29201
[  267.961409] binder: undelivered TRANSACTION_ERROR: 29189
[  267.966952] binder: undelivered TRANSACTION_ERROR: 29189
[  267.972430] binder: undelivered TRANSACTION_ERROR: 29201
[  267.977928] binder: undelivered TRANSACTION_ERROR: 29189
[  267.983444] binder: undelivered TRANSACTION_ERROR: 29189
[  267.988978] binder: undelivered TRANSACTION_ERROR: 29189
[  267.994457] binder: undelivered TRANSACTION_ERROR: 29189
[  268.000087] binder: undelivered TRANSACTION_ERROR: 29189
[  268.005647] binder: undelivered TRANSACTION_ERROR: 29201
[  268.011151] binder: undelivered TRANSACTION_ERROR: 29189
[  268.016691] binder: undelivered TRANSACTION_ERROR: 29189
[  268.022162] binder: undelivered TRANSACTION_ERROR: 29201
[  268.027653] binder: undelivered TRANSACTION_ERROR: 29189
[  268.033184] binder: undelivered TRANSACTION_ERROR: 29189
[  268.038684] binder: undelivered TRANSACTION_ERROR: 29189
[  268.044175] binder: undelivered TRANSACTION_ERROR: 29201
[  268.049658] binder: undelivered TRANSACTION_ERROR: 29189
[  268.055155] binder: undelivered TRANSACTION_ERROR: 29201
[  268.060669] binder: undelivered TRANSACTION_ERROR: 29189
[  268.066437] binder: undelivered TRANSACTION_ERROR: 29201
[  268.071993] binder: undelivered TRANSACTION_ERROR: 29189
[  268.076549] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
[  268.083907] binder: undelivered TRANSACTION_ERROR: 29201
2017/12/02 09:23:21 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_sctp(0xa, 0x805, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000224000-0x2c)=[@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}], 0x1c)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000ba0000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r1 = syz_open_dev$tun(&(0x7f00002d2000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000141000)=0x101)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000533000)={@generic="02000000040000000004008000e9bc22", @ifru_settings={0x10001, 0x0, @fr=&(0x7f0000013000-0x18)={0x0, 0x8000000000002, 0x3, 0xfffffffffffffffb, 0x81c7, 0x7fffffff, 0x26e}}})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000dd6000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r2 = syz_open_dev$evdev(&(0x7f0000cc3000-0x12)="2f6465762f696e7075742f6576656e742300", 0x1, 0x80)
fallocate(r2, 0x3, 0x700000, 0x0)
syz_open_dev$tun(&(0x7f0000b1f000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
r3 = socket(0x10, 0x3, 0x4000000000)
write(r3, &(0x7f00000b8000)="260000005e0009fff10000f83a0000000000000001000000ffffffee0000085b1ee9fb4b35ea", 0x26)
2017/12/02 09:23:21 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0x31, 0x0, &(0x7f000000b000-0xd7)="48a85bf0d7bb41bb7fae47acba64f959302cb9491cb02e3a2b04f9dacd27477eefaf68de88ed73c57e83a510960e2d8abb"})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:21 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, 0x0})
r6 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
2017/12/02 09:23:21 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:21 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:21 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
eventfd2(0x2, 0x801)
r0 = socket$llc(0x1a, 0x1, 0x0)
r1 = dup(r0)
ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f00009c5000-0x10)={0xc7, 0x4})
timerfd_gettime(r1, &(0x7f0000795000)={{0x0, 0x0}, {0x0, 0x0}})
getsockopt$inet_tcp_buf(r1, 0x6, 0x1b, &(0x7f00004c0000)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", &(0x7f0000d37000)=0xc0)
execveat(r1, &(0x7f00004cf000-0x8)="2e2f66696c653000", &(0x7f00005bd000)=[&(0x7f0000999000-0x6)="2a656d315b00", &(0x7f00008bc000-0xa)="5c5c73656c696e757800", &(0x7f0000d14000)="2100", &(0x7f0000792000-0xe)="6c6f657468312d766d6e65743000", &(0x7f00002d9000-0x8)="6c6f657468304000", &(0x7f0000fa5000)="766d6e6574312b766d6e65743100"], &(0x7f0000a28000)=[&(0x7f0000a1c000-0x1)="00", &(0x7f0000543000-0x9)="656d312926266c6f00", &(0x7f00006a0000)="00", &(0x7f000077b000-0x1a)="bc2975736572637075736574766d6e6574305e6b657972696e67", &(0x7f0000626000)="656d30736563757269747900"], 0x400)
mkdir(&(0x7f0000027000)="2e2f66696c653000", 0x0)
ioctl$DRM_IOCTL_AGP_RELEASE(r1, 0x6431)
mount(&(0x7f0000b29000-0x8)="2e2f66696c653100", &(0x7f00000bf000-0x8)="2e2f66696c653000", &(0x7f0000cda000-0x5)="397000", 0x0, 0x0)
rt_sigreturn()
ioctl$TCFLSH(r1, 0x540b, 0x3)
[  268.089669] binder: undelivered TRANSACTION_ERROR: 29189
2017/12/02 09:23:21 executing program 6:
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)="2f6465762f6175746f667300", 0x40040, 0x0)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000000000)={@loopback={0x0, 0x0}, <r1=>0x0}, &(0x7f0000000000)=0x14)
ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00005b1000)={@loopback={0x0, 0x1}, 0x40, r1})
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r2, &(0x7f0000372000)="23216164", 0x4)
execveat(r2, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
syz_open_dev$mice(&(0x7f00008bc000-0x10)="2f6465762f696e7075742f6d69636500", 0x0, 0x40000)
2017/12/02 09:23:21 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000071f000-0x78)={0x0, 0x78, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xffffffffffff8000, 0x400000000, 0x0, 0x0, 0x2408000000, 0x2, 0x0, 0x0, 0x0, 0x2ba69649, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffffff, 0x1ff, 0xffffffffffffff9c, 0x8)
perf_event_open(&(0x7f00008a8000-0x78)={0x4000000002, 0x78, 0xa2, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000390000)=0x0)
r0 = getpgid(0x0)
gettid()
r1 = getpgrp(r0)
perf_event_open(&(0x7f00006d1000)={0x2, 0x78, 0xc30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f00008ab000-0x8)=0x8000000074)
r2 = memfd_create(&(0x7f0000e5f000-0x3)="405b00", 0x2)
ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0086426, &(0x7f00004ab000)={0x3, &(0x7f00006b6000-0x18)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$sock_int(r3, 0x1, 0x800000008, &(0x7f0000f8f000-0x4)=0x0, 0x4)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
r5 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xd4e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2001000000000f6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000cc5000)="2e2f66696c653000", 0x10000, 0x0)
r6 = socket(0x11, 0x3, 0x0)
bind(r6, &(0x7f00005a2000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679c00800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c000100000000e9ffff48740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000122000)={{{@in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, @in6=@local={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {{@in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0}, 0x0, @in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f00001a1000)=0xe8)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r6, 0x84, 0x13, &(0x7f00009d5000-0x4)=0x10000, 0x4)
r7 = socket$inet(0x2, 0x80a, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0xfffffffffffffffd})
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000586000)={0x0, @in6={{0xa, 0x3, 0xfb1, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x4}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x2, 0x80000001, 0x7, 0x7, 0x7d}, &(0x7f0000555000)=0xa0)
perf_event_open(&(0x7f00006b3000-0x78)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0x0, r5, 0x0)
writev(r6, &(0x7f0000cdc000-0x20)=[], 0x0)
r8 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0x100})
2017/12/02 09:23:21 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000027000)="2e2f66696c653000", 0x0)
mount(&(0x7f0000b29000-0x8)="2e2f66696c653100", &(0x7f00000bf000-0x8)="2e2f66696c653000", &(0x7f0000cda000-0x5)="397000", 0x0, 0x0)
lgetxattr(&(0x7f0000eea000-0x8)="2e2f66696c653100", &(0x7f00003db000-0x15)=@known="636f6d2e6170706c652e46696e646572496e666f00", &(0x7f00005fe000)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0x97)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00004e9000)={0xffffffffffffffff, 0x28, &(0x7f00000ee000)={0x0, <r0=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000e5c000-0x4)=r0, 0x4)
truncate(&(0x7f0000c86000-0x8)="2e2f66696c653000", 0x1)
2017/12/02 09:23:21 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  268.128109] binder: 4255:4261 ERROR: BC_REGISTER_LOOPER called without request
[  268.135594] binder: 4261 RLIMIT_NICE not set
2017/12/02 09:23:21 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
2017/12/02 09:23:21 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:21 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_sctp(0xa, 0x805, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000224000-0x2c)=[@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}], 0x1c)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000ba0000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r1 = syz_open_dev$tun(&(0x7f00002d2000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000141000)=0x101)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000533000)={@generic="02000000040000000004008000e9bc22", @ifru_settings={0x10001, 0x0, @fr=&(0x7f0000013000-0x18)={0x0, 0x8000000000002, 0x3, 0xfffffffffffffffb, 0x81c7, 0x7fffffff, 0x26e}}})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000dd6000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r2 = syz_open_dev$evdev(&(0x7f0000cc3000-0x12)="2f6465762f696e7075742f6576656e742300", 0x1, 0x80)
fallocate(r2, 0x3, 0x700000, 0x0)
syz_open_dev$tun(&(0x7f0000b1f000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
r3 = socket(0x10, 0x3, 0x4000000000)
write(r3, &(0x7f00000b8000)="260000005e0009fff10000f83a0000000000000001000000ffffffee0000085b1ee9fb4b35ea", 0x26)
[  268.153618] 9pnet_virtio: no channels available for device ./file1
[  268.175585] binder: 4255:4266 ioctl c0306201 20002fd0 returned -14
[  268.178049] binder: 4255:4266 got reply transaction with bad transaction stack, transaction 1803 has target 4255:0
2017/12/02 09:23:21 executing program 6:
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)="2f6465762f6175746f667300", 0x40040, 0x0)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000000000)={@loopback={0x0, 0x0}, <r1=>0x0}, &(0x7f0000000000)=0x14)
ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00005b1000)={@loopback={0x0, 0x1}, 0x40, r1})
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r2, &(0x7f0000372000)="23216164", 0x4)
execveat(r2, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
syz_open_dev$mice(&(0x7f00008bc000-0x10)="2f6465762f696e7075742f6d69636500", 0x0, 0x40000)
2017/12/02 09:23:21 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
set_mempolicy(0x1, &(0x7f0000a07000-0x8)=0x3, 0x6)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000c7000-0x4)=0x0)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
2017/12/02 09:23:21 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x0, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:21 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
mq_notify(0xffffffffffffffff, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r5=>0x0})
mq_timedsend(0xffffffffffffffff, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r5})
r6 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
[  268.178061] binder: 4255:4266 transaction failed 29201/-71, size 24-8 line 2685
[  268.196234] binder: 4255:4266 ioctl c0306201 20005fd0 returned -14
[  268.198521] binder: 4255:4266 ioctl c018620b 2000dfe8 returned -14
[  268.203802] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
[  268.207529] 9pnet_virtio: no channels available for device ./file1
[  268.221574] binder: 4255:4266 ioctl 40046205 0 returned -22
[  268.247199] 9pnet_virtio: no channels available for device ./file1
[  268.264995] binder: BINDER_SET_CONTEXT_MGR already set
[  268.265011] binder: 4255:4266 ioctl 40046207 0 returned -16
[  268.265255] binder: 4255:4280 ERROR: BC_REGISTER_LOOPER called without request
[  268.265267] binder: 4280 RLIMIT_NICE not set
[  268.267273] binder_alloc: 4255: binder_alloc_buf, no vma
[  268.267301] binder: 4255:4266 transaction failed 29189/-3, size 0-0 line 2870
[  268.274362] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
[  268.279607] binder: 4255:4266 ioctl c0306201 20002fd0 returned -14
2017/12/02 09:23:21 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f000000b000-0xd7)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:21 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:21 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:21 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000071f000-0x78)={0x0, 0x78, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xffffffffffff8000, 0x400000000, 0x0, 0x0, 0x2408000000, 0x2, 0x0, 0x0, 0x0, 0x2ba69649, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffffff, 0x1ff, 0xffffffffffffff9c, 0x8)
perf_event_open(&(0x7f00008a8000-0x78)={0x4000000002, 0x78, 0xa2, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000390000)=0x0)
r0 = getpgid(0x0)
gettid()
r1 = getpgrp(r0)
perf_event_open(&(0x7f00006d1000)={0x2, 0x78, 0xc30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f00008ab000-0x8)=0x8000000074)
r2 = memfd_create(&(0x7f0000e5f000-0x3)="405b00", 0x2)
ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0086426, &(0x7f00004ab000)={0x3, &(0x7f00006b6000-0x18)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$sock_int(r3, 0x1, 0x800000008, &(0x7f0000f8f000-0x4)=0x0, 0x4)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket$inet(0x2, 0x1, 0x0)
r5 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xd4e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2001000000000f6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000cc5000)="2e2f66696c653000", 0x10000, 0x0)
r6 = socket(0x11, 0x3, 0x0)
bind(r6, &(0x7f00005a2000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679c00800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c000100000000e9ffff48740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000122000)={{{@in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, @in6=@local={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {{@in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0}, 0x0, @in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f00001a1000)=0xe8)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r6, 0x84, 0x13, &(0x7f00009d5000-0x4)=0x10000, 0x4)
r7 = socket$inet(0x2, 0x80a, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0xfffffffffffffffd})
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000586000)={0x0, @in6={{0xa, 0x3, 0xfb1, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x4}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x2, 0x80000001, 0x7, 0x7, 0x7d}, &(0x7f0000555000)=0xa0)
perf_event_open(&(0x7f00006b3000-0x78)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0x0, r5, 0x0)
writev(r6, &(0x7f0000cdc000-0x20)=[], 0x0)
r8 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f00008a4000-0x20)={@common="6c6f0000000000000000000000000000", @ifru_flags=0x100})
2017/12/02 09:23:21 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
set_mempolicy(0x1, &(0x7f0000a07000-0x8)=0x3, 0x6)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000c7000-0x4)=0x0)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
2017/12/02 09:23:21 executing program 6:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000027000)="2e2f66696c653000", 0x0)
mount(&(0x7f0000b29000-0x8)="2e2f66696c653100", &(0x7f00000bf000-0x8)="2e2f66696c653000", &(0x7f0000cda000-0x5)="397000", 0x0, 0x0)
rename(&(0x7f0000786000-0x8)="2e2f66696c653100", &(0x7f0000f1d000)="2e2f66696c653000")
2017/12/02 09:23:21 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
2017/12/02 09:23:21 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_sctp(0xa, 0x805, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000224000-0x2c)=[@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}], 0x1c)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000ba0000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r1 = syz_open_dev$tun(&(0x7f00002d2000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000141000)=0x101)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000533000)={@generic="02000000040000000004008000e9bc22", @ifru_settings={0x10001, 0x0, @fr=&(0x7f0000013000-0x18)={0x0, 0x8000000000002, 0x3, 0xfffffffffffffffb, 0x81c7, 0x7fffffff, 0x26e}}})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000dd6000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r2 = syz_open_dev$evdev(&(0x7f0000cc3000-0x12)="2f6465762f696e7075742f6576656e742300", 0x1, 0x80)
fallocate(r2, 0x3, 0x700000, 0x0)
syz_open_dev$tun(&(0x7f0000b1f000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
socket(0x10, 0x3, 0x4000000000)
[  268.284920] binder: 4255:4280 BC_FREE_BUFFER uffffffffffffffff no match
[  268.284958] binder: 4255:4280 IncRefs 0 refcount change on invalid ref 1 ret -22
[  268.284969] binder: 4255:4280 got transaction to invalid handle
[  268.284979] binder: 4255:4280 transaction failed 29201/-22, size 0-8 line 2755
[  268.284998] binder: 4255:4280 ioctl c0306201 20005fd0 returned -14
[  268.456317] binder: 4261 RLIMIT_NICE not set
[  268.460843] binder: release 4255:4261 transaction 1803 in, still active
[  268.467647] binder: send failed reply for transaction 1803 to 4255:4266
2017/12/02 09:23:21 executing program 6 (fault-call:2 fault-nth:0):
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:21 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
[  268.474471] binder: undelivered TRANSACTION_COMPLETE
[  268.481899] binder: undelivered TRANSACTION_ERROR: 29201
[  268.493186] 9pnet_virtio: no channels available for device ./file1
2017/12/02 09:23:21 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
set_mempolicy(0x1, &(0x7f0000a07000-0x8)=0x3, 0x6)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000c7000-0x4)=0x0)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
2017/12/02 09:23:21 executing program 6 (fault-call:2 fault-nth:1):
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:21 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f000000b000-0xd7)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
[  268.501255] 9pnet_virtio: no channels available for device ./file1
[  268.504237] binder: 4326:4328 ERROR: BC_REGISTER_LOOPER called without request
[  268.504249] binder: 4328 RLIMIT_NICE not set
2017/12/02 09:23:21 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r4 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r4, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r5=>0x0})
mq_timedsend(r4, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r5})
r6 = dup2(r3, r0)
ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
2017/12/02 09:23:21 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:21 executing program 6 (fault-call:2 fault-nth:2):
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:21 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
set_mempolicy(0x1, &(0x7f0000a07000-0x8)=0x3, 0x6)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000c7000-0x4)=0x0)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
[  268.534460] binder: 4328 RLIMIT_NICE not set
[  268.537746] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
[  268.538293] binder: 4326:4328 ioctl c0306201 20002fd0 returned -14
2017/12/02 09:23:21 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
2017/12/02 09:23:21 executing program 6 (fault-call:2 fault-nth:3):
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
[  268.543304] binder: 4328 RLIMIT_NICE not set
[  268.544476] binder: 4326:4328 BC_FREE_BUFFER uffffffffffffffff no match
[  268.544571] binder: 4326:4328 got transaction with invalid offsets ptr
[  268.544605] binder: 4326:4328 transaction failed 29201/-14, size 0-8 line 2898
[  268.544623] binder: 4326:4328 ioctl c0306201 20005fd0 returned -14
[  268.544968] binder: 4326:4328 ioctl c018620b 2000dfe8 returned -14
[  268.547320] binder: 4326:4328 ioctl 40046205 0 returned -22
[  268.553048] binder: BINDER_SET_CONTEXT_MGR already set
[  268.553058] binder: 4326:4328 ioctl 40046207 0 returned -16
[  268.553119] binder: 4326:4335 ERROR: BC_REGISTER_LOOPER called without request
[  268.553128] binder: 4335 RLIMIT_NICE not set
[  268.556348] binder_alloc: 4326: binder_alloc_buf, no vma
[  268.556378] binder: 4326:4328 transaction failed 29189/-3, size 0-0 line 2870
[  268.563597] FAULT_INJECTION: forcing a failure.
[  268.563597] name failslab, interval 1, probability 0, space 0, times 0
[  268.563611] CPU: 1 PID: 4340 Comm: syz-executor6 Not tainted 4.15.0-rc1+ #114
[  268.563618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  268.563622] Call Trace:
[  268.563639]  dump_stack+0x194/0x257
[  268.563660]  ? arch_local_irq_restore+0x53/0x53
[  268.563700]  should_fail+0x8c0/0xa40
[  268.563719]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  268.563733]  ? lock_downgrade+0x980/0x980
[  268.563748]  ? get_pid_task+0xbc/0x140
[  268.563769]  ? find_held_lock+0x39/0x1d0
[  268.563807]  ? lock_downgrade+0x980/0x980
[  268.563848]  ? trace_event_raw_event_sched_switch+0x800/0x800
[  268.563876]  ? rcu_note_context_switch+0x710/0x710
[  268.563912]  should_failslab+0xec/0x120
[  268.563930]  __kmalloc_track_caller+0x5f/0x760
[  268.563950]  ? strncpy_from_user+0x430/0x430
[  268.563960]  ? strndup_user+0x62/0xb0
[  268.563984]  memdup_user+0x2c/0x90
[  268.564000]  strndup_user+0x62/0xb0
[  268.564018]  copy_mount_string+0x24/0x40
[  268.564030]  compat_SyS_mount+0x2d/0x1070
[  268.564049]  ? show_fd_locks+0x2c0/0x2c0
[  268.564064]  do_fast_syscall_32+0x3ee/0xf9d
[  268.564090]  ? do_int80_syscall_32+0x9d0/0x9d0
[  268.564116]  ? lockdep_sys_exit+0x47/0xf0
[  268.564128]  ? syscall_return_slowpath+0x2ad/0x550
[  268.564149]  ? sysret32_from_system_call+0x5/0x3b
[  268.564174]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  268.564200]  entry_SYSENTER_compat+0x51/0x60
[  268.564208] RIP: 0023:0xf7fcbc79
[  268.564212] RSP: 002b:00000000f77c708c EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  268.564231] RAX: ffffffffffffffda RBX: 0000000020018000 RCX: 000000002002c000
[  268.564237] RDX: 000000002002cffa RSI: 0000000001000818 RDI: 000000002000a000
[  268.564244] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  268.564251] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  268.564257] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  268.565413] binder: 4326:4328 ioctl c0306201 20002fd0 returned -14
[  268.570995] binder: 4326:4335 BC_FREE_BUFFER uffffffffffffffff no match
[  268.571094] binder: 4326:4335 IncRefs 0 refcount change on invalid ref 1 ret -22
[  268.571105] binder: 4326:4335 got transaction to invalid handle
[  268.571117] binder: 4326:4335 transaction failed 29201/-22, size 0-8 line 2755
[  268.571137] binder: 4326:4335 ioctl c0306201 20005fd0 returned -14
[  268.599325] binder: BINDER_SET_CONTEXT_MGR already set
[  268.599335] binder: 4345:4348 ioctl 40046207 0 returned -16
[  268.599429] binder: 4345:4348 ERROR: BC_REGISTER_LOOPER called without request
[  268.599440] binder: 4348 RLIMIT_NICE not set
[  268.611852] FAULT_INJECTION: forcing a failure.
[  268.611852] name failslab, interval 1, probability 0, space 0, times 0
[  268.611864] CPU: 0 PID: 4347 Comm: syz-executor6 Not tainted 4.15.0-rc1+ #114
[  268.611871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  268.611875] Call Trace:
[  268.611892]  dump_stack+0x194/0x257
[  268.611917]  ? arch_local_irq_restore+0x53/0x53
[  268.611930]  ? __save_stack_trace+0x7e/0xd0
[  268.611965]  should_fail+0x8c0/0xa40
[  268.611974]  ? check_noncircular+0x20/0x20
[  268.611992]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  268.612003]  ? kasan_kmalloc+0xad/0xe0
[  268.612012]  ? __kmalloc_track_caller+0x15e/0x760
[  268.612020]  ? memdup_user+0x2c/0x90
[  268.612027]  ? strndup_user+0x62/0xb0
[  268.612035]  ? copy_mount_string+0x24/0x40
[  268.612042]  ? compat_SyS_mount+0x2d/0x1070
[  268.612052]  ? do_fast_syscall_32+0x3ee/0xf9d
[  268.612072]  ? find_held_lock+0x39/0x1d0
[  268.612112]  ? lock_downgrade+0x980/0x980
[  268.612158]  ? trace_event_raw_event_sched_switch+0x800/0x800
[  268.612178]  ? rcu_note_context_switch+0x710/0x710
[  268.612190]  ? __check_object_size+0x25d/0x4f0
[  268.612215]  should_failslab+0xec/0x120
[  268.612231]  __kmalloc_track_caller+0x5f/0x760
[  268.612251]  ? strncpy_from_user+0x430/0x430
[  268.612262]  ? strndup_user+0x62/0xb0
[  268.612274]  ? _copy_from_user+0x99/0x110
[  268.612293]  memdup_user+0x2c/0x90
[  268.612309]  strndup_user+0x62/0xb0
[  268.612327]  copy_mount_string+0x24/0x40
[  268.612339]  compat_SyS_mount+0x49/0x1070
[  268.612358]  ? show_fd_locks+0x2c0/0x2c0
[  268.612373]  do_fast_syscall_32+0x3ee/0xf9d
[  268.612400]  ? do_int80_syscall_32+0x9d0/0x9d0
[  268.612424]  ? lockdep_sys_exit+0x47/0xf0
[  268.612438]  ? syscall_return_slowpath+0x2ad/0x550
[  268.612459]  ? sysret32_from_system_call+0x5/0x3b
[  268.612482]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  268.612509]  entry_SYSENTER_compat+0x51/0x60
[  268.612517] RIP: 0023:0xf7fcbc79
[  268.612523] RSP: 002b:00000000f77c708c EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  268.612534] RAX: ffffffffffffffda RBX: 0000000020018000 RCX: 000000002002c000
[  268.612540] RDX: 000000002002cffa RSI: 0000000001000818 RDI: 000000002000a000
[  268.612545] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  268.612551] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  268.612556] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  268.632069] binder_alloc: 4326: binder_alloc_buf, no vma
[  268.632101] binder: 4345:4357 transaction failed 29189/-3, size 0-0 line 2870
[  268.647842] FAULT_INJECTION: forcing a failure.
[  268.647842] name failslab, interval 1, probability 0, space 0, times 0
[  268.647854] CPU: 1 PID: 4363 Comm: syz-executor6 Not tainted 4.15.0-rc1+ #114
[  268.647860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  268.647864] Call Trace:
[  268.647880]  dump_stack+0x194/0x257
[  268.647901]  ? arch_local_irq_restore+0x53/0x53
[  268.647918]  ? depot_save_stack+0x12c/0x490
[  268.647949]  should_fail+0x8c0/0xa40
[  268.647970]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  268.647980]  ? copy_mount_string+0x24/0x40
[  268.647991]  ? do_fast_syscall_32+0x3ee/0xf9d
[  268.648000]  ? entry_SYSENTER_compat+0x51/0x60
[  268.648035]  ? find_held_lock+0x39/0x1d0
[  268.648075]  ? lock_downgrade+0x980/0x980
[  268.648126]  ? trace_event_raw_event_sched_switch+0x800/0x800
[  268.648139]  ? __check_object_size+0x25d/0x4f0
[  268.648153]  ? rcu_note_context_switch+0x710/0x710
[  268.648182]  should_failslab+0xec/0x120
[  268.648197]  kmem_cache_alloc_trace+0x4b/0x750
[  268.648214]  ? kasan_check_write+0x14/0x20
[  268.648230]  ? _copy_from_user+0x99/0x110
[  268.648261]  copy_mount_options+0x5f/0x2e0
[  268.648286]  compat_SyS_mount+0x65/0x1070
[  268.648307]  ? show_fd_locks+0x2c0/0x2c0
[  268.648322]  do_fast_syscall_32+0x3ee/0xf9d
[  268.648351]  ? do_int80_syscall_32+0x9d0/0x9d0
[  268.648378]  ? lockdep_sys_exit+0x47/0xf0
[  268.648392]  ? syscall_return_slowpath+0x2ad/0x550
[  268.648413]  ? sysret32_from_system_call+0x5/0x3b
[  268.648438]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  268.648467]  entry_SYSENTER_compat+0x51/0x60
[  268.648476] RIP: 0023:0xf7fcbc79
[  268.648481] RSP: 002b:00000000f77c708c EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  268.648490] RAX: ffffffffffffffda RBX: 0000000020018000 RCX: 000000002002c000
[  268.648495] RDX: 000000002002cffa RSI: 0000000001000818 RDI: 000000002000a000
[  268.648500] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  268.648504] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  268.648508] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  268.648519] binder: 4345:4357 ioctl c0306201 2000afd0 returned -14
[  268.660213] binder: 4345:4357 ioctl c0306201 20005fd0 returned -14
[  268.661505] binder: 4345:4357 ioctl c018620b 2000dfe8 returned -14
[  268.684632] binder: 4345:4357 ioctl 40046205 0 returned -22
[  268.689796] FAULT_INJECTION: forcing a failure.
[  268.689796] name failslab, interval 1, probability 0, space 0, times 0
[  268.689807] CPU: 1 PID: 4375 Comm: syz-executor6 Not tainted 4.15.0-rc1+ #114
[  268.689812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  268.689816] Call Trace:
[  268.689830]  dump_stack+0x194/0x257
[  268.689853]  ? arch_local_irq_restore+0x53/0x53
[  268.689894]  should_fail+0x8c0/0xa40
[  268.689915]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  268.689934]  ? lock_release+0xda0/0xda0
[  268.689957]  ? find_held_lock+0x39/0x1d0
[  268.689994]  ? lock_downgrade+0x980/0x980
[  268.690051]  ? trace_event_raw_event_sched_switch+0x800/0x800
[  268.690063]  ? depot_save_stack+0x12c/0x490
[  268.690083]  ? rcu_note_context_switch+0x710/0x710
[  268.690114]  should_failslab+0xec/0x120
[  268.690131]  kmem_cache_alloc+0x47/0x760
[  268.690152]  ? find_held_lock+0x39/0x1d0
[  268.690174]  getname_flags+0xcb/0x580
[  268.690200]  user_path_at_empty+0x2d/0x50
[  268.690228]  do_mount+0x15f/0x2bb0
[  268.690261]  ? copy_mount_string+0x40/0x40
[  268.690276]  ? rcu_pm_notify+0xc0/0xc0
[  268.690310]  ? copy_mount_options+0x5f/0x2e0
[  268.690325]  ? rcu_read_lock_sched_held+0x108/0x120
[  268.690337]  ? kmem_cache_alloc_trace+0x459/0x750
[  268.690349]  ? kasan_check_write+0x14/0x20
[  268.690359]  ? _copy_from_user+0x99/0x110
[  268.690390]  ? copy_mount_options+0x1f4/0x2e0
[  268.690414]  compat_SyS_mount+0xd0/0x1070
[  268.690433]  ? show_fd_locks+0x2c0/0x2c0
[  268.690448]  do_fast_syscall_32+0x3ee/0xf9d
[  268.690475]  ? do_int80_syscall_32+0x9d0/0x9d0
[  268.690499]  ? lockdep_sys_exit+0x47/0xf0
[  268.690513]  ? syscall_return_slowpath+0x2ad/0x550
[  268.690535]  ? sysret32_from_system_call+0x5/0x3b
[  268.690558]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  268.690585]  entry_SYSENTER_compat+0x51/0x60
[  268.690593] RIP: 0023:0xf7fcbc79
[  268.690599] RSP: 002b:00000000f77c708c EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  268.690610] RAX: ffffffffffffffda RBX: 0000000020018000 RCX: 000000002002c000
[  268.690615] RDX: 000000002002cffa RSI: 0000000001000818 RDI: 000000002000a000
[  268.690620] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  268.690626] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  268.690632] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  268.694099] binder: BINDER_SET_CONTEXT_MGR already set
[  268.694108] binder: 4345:4357 ioctl 40046207 0 returned -16
[  268.695041] binder: 4345:4369 ERROR: BC_REGISTER_LOOPER called without request
[  268.695050] binder: 4369 RLIMIT_NICE not set
[  268.696283] binder_alloc: 4326: binder_alloc_buf, no vma
[  268.696308] binder: 4345:4357 transaction failed 29189/-3, size 0-0 line 2870
[  268.699443] binder: 4345:4357 ioctl c0306201 20002fd0 returned -14
[  268.701334] binder: 4345:4357 ioctl c0306201 2000afd0 returned -14
[  268.707882] binder: 4345:4369 ioctl c0306201 20005fd0 returned -14
[  268.709162] binder: 4345:4357 ioctl c018620b 2000dfe8 returned -14
[  269.764750] binder: undelivered TRANSACTION_ERROR: 29189
[  269.770319] binder: undelivered TRANSACTION_ERROR: 29189
[  269.775850] binder: unexpected work type, 4, not freed
[  269.781141] binder: undelivered TRANSACTION_COMPLETE
[  269.786243] binder: undelivered TRANSACTION_ERROR: 29201
[  269.791703] binder: undelivered TRANSACTION_COMPLETE
[  269.796802] binder: undelivered transaction 1810
2017/12/02 09:23:23 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f000000b000-0xd7)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:23 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_sctp(0xa, 0x805, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000224000-0x2c)=[@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}], 0x1c)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000ba0000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r1 = syz_open_dev$tun(&(0x7f00002d2000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000141000)=0x101)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000533000)={@generic="02000000040000000004008000e9bc22", @ifru_settings={0x10001, 0x0, @fr=&(0x7f0000013000-0x18)={0x0, 0x8000000000002, 0x3, 0xfffffffffffffffb, 0x81c7, 0x7fffffff, 0x26e}}})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000dd6000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r2 = syz_open_dev$evdev(&(0x7f0000cc3000-0x12)="2f6465762f696e7075742f6576656e742300", 0x1, 0x80)
fallocate(r2, 0x3, 0x700000, 0x0)
syz_open_dev$tun(&(0x7f0000b1f000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
2017/12/02 09:23:23 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mq_timedreceive(0xffffffffffffffff, &(0x7f00002d3000)="0000000000000000000000000000000000000000000000000000000000", 0x1d, 0x20000000, 0x0)
2017/12/02 09:23:23 executing program 6 (fault-call:2 fault-nth:4):
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:23 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r4 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r4, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r5=>0x0})
mq_timedsend(r4, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r5})
r6 = dup2(0xffffffffffffffff, r0)
ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
2017/12/02 09:23:23 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r3, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r5 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r5, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r6=>0x0})
mq_timedsend(r5, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r6})
r7 = dup2(r4, r0)
ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
2017/12/02 09:23:23 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
set_mempolicy(0x1, &(0x7f0000a07000-0x8)=0x3, 0x6)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
2017/12/02 09:23:23 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  269.803614] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
[  269.810192] binder: undelivered TRANSACTION_ERROR: 29189
[  269.815742] binder: undelivered TRANSACTION_ERROR: 29201
[  269.821339] binder: undelivered TRANSACTION_ERROR: 29189
[  269.826885] binder: undelivered TRANSACTION_ERROR: 29201
[  269.832395] binder: undelivered TRANSACTION_ERROR: 29189
2017/12/02 09:23:23 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mq_timedreceive(r0, &(0x7f00002d3000)="", 0x0, 0x20000000, 0x0)
[  269.892336] binder: 4386:4389 ERROR: BC_REGISTER_LOOPER called without request
[  269.899855] binder: 4389 RLIMIT_NICE not set
2017/12/02 09:23:23 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
set_mempolicy(0x1, &(0x7f0000a07000-0x8)=0x3, 0x6)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
2017/12/02 09:23:23 executing program 6 (fault-call:2 fault-nth:5):
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:23 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mq_timedreceive(r0, &(0x7f00002d3000)="000000000000000000000000000000", 0xf, 0x20000000, 0x0)
2017/12/02 09:23:23 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
set_mempolicy(0x1, &(0x7f0000a07000-0x8)=0x3, 0x6)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
2017/12/02 09:23:23 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = gettid()
r3 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(0xffffffffffffffff, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r4 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r4, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r5=>0x0})
mq_timedsend(r4, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r5})
r6 = dup2(r3, r0)
ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
[  269.921696] FAULT_INJECTION: forcing a failure.
[  269.921696] name fail_page_alloc, interval 1, probability 0, space 0, times 1
2017/12/02 09:23:23 executing program 6 (fault-call:2 fault-nth:6):
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:23 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mq_timedreceive(r0, &(0x7f00002d3000)="00", 0x1, 0x20000000, 0x0)
[  269.921709] CPU: 0 PID: 4400 Comm: syz-executor6 Not tainted 4.15.0-rc1+ #114
[  269.921717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  269.921722] Call Trace:
[  269.921736]  dump_stack+0x194/0x257
[  269.921755]  ? arch_local_irq_restore+0x53/0x53
[  269.921787]  should_fail+0x8c0/0xa40
[  269.921808]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  269.921832]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[  269.921842]  ? find_held_lock+0x39/0x1d0
[  269.921873]  ? lock_downgrade+0x980/0x980
[  269.921887]  ? __free_insn_slot+0x5c0/0x5c0
[  269.921914]  ? check_noncircular+0x20/0x20
[  269.921927]  ? lock_downgrade+0x980/0x980
[  269.921935]  ? should_fail+0x23b/0xa40
[  269.921945]  ? __bpf_address_lookup+0x2b0/0x2b0
[  269.921967]  __alloc_pages_nodemask+0x338/0xd80
[  269.921974]  ? lock_release+0xda0/0xda0
[  269.921993]  ? __alloc_pages_slowpath+0x2d00/0x2d00
[  269.922003]  ? find_held_lock+0x39/0x1d0
[  269.922035]  ? lock_downgrade+0x980/0x980
[  269.922078]  ? depot_save_stack+0x12c/0x490
[  269.922093]  ? rcu_note_context_switch+0x710/0x710
[  269.922109]  cache_grow_begin+0x72/0x3f0
[  269.922124]  kmem_cache_alloc+0x403/0x760
[  269.922145]  getname_flags+0xcb/0x580
[  269.922162]  user_path_at_empty+0x2d/0x50
[  269.922177]  do_mount+0x15f/0x2bb0
[  269.922198]  ? copy_mount_string+0x40/0x40
[  269.922207]  ? rcu_pm_notify+0xc0/0xc0
[  269.922232]  ? copy_mount_options+0x5f/0x2e0
[  269.922243]  ? rcu_read_lock_sched_held+0x108/0x120
[  269.922254]  ? kmem_cache_alloc_trace+0x459/0x750
[  269.922265]  ? kasan_check_write+0x14/0x20
[  269.922275]  ? _copy_from_user+0x99/0x110
[  269.922298]  ? copy_mount_options+0x1f4/0x2e0
[  269.922318]  compat_SyS_mount+0xd0/0x1070
[  269.922333]  ? show_fd_locks+0x2c0/0x2c0
[  269.922345]  do_fast_syscall_32+0x3ee/0xf9d
[  269.922366]  ? do_int80_syscall_32+0x9d0/0x9d0
[  269.922383]  ? trace_event_raw_event_sys_exit+0x260/0x260
[  269.922395]  ? lockdep_sys_exit+0x47/0xf0
[  269.922406]  ? syscall_return_slowpath+0x2ad/0x550
[  269.922422]  ? sysret32_from_system_call+0x5/0x3b
[  269.922440]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  269.922460]  entry_SYSENTER_compat+0x51/0x60
[  269.922466] RIP: 0023:0xf7fcbc79
[  269.922470] RSP: 002b:00000000f77c708c EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  269.922478] RAX: ffffffffffffffda RBX: 0000000020018000 RCX: 000000002002c000
[  269.922482] RDX: 000000002002cffa RSI: 0000000001000818 RDI: 000000002000a000
[  269.922486] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  269.922490] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  269.922494] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  269.953751] binder: 4386:4401 ioctl c0306201 20002fd0 returned -14
[  269.956952] binder: 4386:4401 ioctl c0306201 2000afd0 returned -14
[  269.967212] binder: 4386:4401 ioctl c0306201 20005fd0 returned -14
[  269.968518] binder: 4386:4401 ioctl c018620b 2000dfe8 returned -14
[  269.978355] FAULT_INJECTION: forcing a failure.
[  269.978355] name failslab, interval 1, probability 0, space 0, times 0
[  269.978365] CPU: 0 PID: 4412 Comm: syz-executor6 Not tainted 4.15.0-rc1+ #114
[  269.978371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  269.978374] Call Trace:
[  269.978389]  dump_stack+0x194/0x257
[  269.978406]  ? arch_local_irq_restore+0x53/0x53
[  269.978425]  ? __kernel_text_address+0xd/0x40
[  269.978456]  should_fail+0x8c0/0xa40
[  269.978478]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  269.978493]  ? perf_trace_lock_acquire+0xe3/0x980
[  269.978506]  ? save_stack+0xa3/0xd0
[  269.978528]  ? find_held_lock+0x39/0x1d0
[  269.978563]  ? lock_downgrade+0x980/0x980
[  269.978621]  ? trace_event_raw_event_sched_switch+0x800/0x800
[  269.978640]  ? rcu_note_context_switch+0x710/0x710
[  269.978649]  ? lock_downgrade+0x980/0x980
[  269.978678]  should_failslab+0xec/0x120
[  269.978692]  __kmalloc_track_caller+0x5f/0x760
[  269.978713]  ? do_raw_spin_trylock+0x190/0x190
[  269.978720]  ? kstrdup_const+0x39/0x50
[  269.978741]  kstrdup+0x39/0x70
[  269.978756]  kstrdup_const+0x39/0x50
[  269.978769]  alloc_vfsmnt+0x1a5/0x9c0
[  269.978785]  ? mnt_free_id.isra.21+0x50/0x50
[  269.978802]  ? avc_has_extended_perms+0x12c0/0x12c0
[  269.978819]  ? avc_has_perm+0x43e/0x680
[  269.978846]  ? find_held_lock+0x39/0x1d0
[  269.978876]  ? lock_downgrade+0x980/0x980
[  269.978888]  ? __get_fs_type+0x22/0xc0
[  269.978899]  ? selinux_ipv4_output+0x40/0x40
[  269.978913]  ? module_unload_free+0x5b0/0x5b0
[  269.978925]  ? lock_release+0xda0/0xda0
[  269.978934]  ? _cond_resched+0x14/0x30
[  269.978952]  ? selinux_mount+0x2bb/0x4e0
[  269.978972]  vfs_kern_mount.part.26+0x84/0x4a0
[  269.978989]  ? may_umount+0xa0/0xa0
[  269.978999]  ? _raw_read_unlock+0x22/0x30
[  269.979009]  ? __get_fs_type+0x8a/0xc0
[  269.979034]  do_mount+0xea4/0x2bb0
[  269.979059]  ? copy_mount_string+0x40/0x40
[  269.979069]  ? rcu_pm_notify+0xc0/0xc0
[  269.979096]  ? copy_mount_options+0x5f/0x2e0
[  269.979107]  ? rcu_read_lock_sched_held+0x108/0x120
[  269.979119]  ? kmem_cache_alloc_trace+0x459/0x750
[  269.979129]  ? kasan_check_write+0x14/0x20
[  269.979139]  ? _copy_from_user+0x99/0x110
[  269.979166]  ? copy_mount_options+0x1f4/0x2e0
[  269.979189]  compat_SyS_mount+0xd0/0x1070
[  269.979206]  ? show_fd_locks+0x2c0/0x2c0
[  269.979220]  do_fast_syscall_32+0x3ee/0xf9d
[  269.979243]  ? do_int80_syscall_32+0x9d0/0x9d0
[  269.979265]  ? lockdep_sys_exit+0x47/0xf0
[  269.979277]  ? syscall_return_slowpath+0x2ad/0x550
[  269.979295]  ? sysret32_from_system_call+0x5/0x3b
[  269.979318]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  269.979344]  entry_SYSENTER_compat+0x51/0x60
[  269.979351] RIP: 0023:0xf7fcbc79
[  269.979356] RSP: 002b:00000000f77c708c EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  269.979365] RAX: ffffffffffffffda RBX: 0000000020018000 RCX: 000000002002c000
[  269.979371] RDX: 000000002002cffa RSI: 0000000001000818 RDI: 000000002000a000
[  269.979376] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  269.979382] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  269.979387] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  269.998437] binder: 4386:4401 ioctl 40046205 0 returned -22
[  270.007688] binder: BINDER_SET_CONTEXT_MGR already set
[  270.007697] binder: 4386:4401 ioctl 40046207 0 returned -16
[  270.007751] binder: 4386:4417 ERROR: BC_REGISTER_LOOPER called without request
[  270.007760] binder: 4417 RLIMIT_NICE not set
[  270.008992] binder_alloc: 4386: binder_alloc_buf, no vma
[  270.009038] binder: 4386:4401 transaction failed 29189/-3, size 0-0 line 2870
[  270.011828] binder: 4386:4401 ioctl c0306201 20002fd0 returned -14
[  270.013232] binder: 4386:4401 ioctl c0306201 2000afd0 returned -14
[  270.019323] binder: 4386:4417 ioctl c0306201 20005fd0 returned -14
[  270.020916] FAULT_INJECTION: forcing a failure.
[  270.020916] name failslab, interval 1, probability 0, space 0, times 0
[  270.020927] CPU: 0 PID: 4424 Comm: syz-executor6 Not tainted 4.15.0-rc1+ #114
[  270.020934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  270.020937] Call Trace:
[  270.020953]  dump_stack+0x194/0x257
[  270.020971]  ? arch_local_irq_restore+0x53/0x53
[  270.020990]  ? __kernel_text_address+0xd/0x40
[  270.021024]  should_fail+0x8c0/0xa40
[  270.021046]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  270.021063]  ? perf_trace_lock_acquire+0xe3/0x980
[  270.021077]  ? save_stack+0xa3/0xd0
[  270.021099]  ? find_held_lock+0x39/0x1d0
[  270.021131]  ? lock_downgrade+0x980/0x980
[  270.021169]  ? trace_event_raw_event_sched_switch+0x800/0x800
[  270.021187]  ? rcu_note_context_switch+0x710/0x710
[  270.021196]  ? lock_downgrade+0x980/0x980
[  270.021221]  should_failslab+0xec/0x120
[  270.021237]  __kmalloc_track_caller+0x5f/0x760
[  270.021257]  ? do_raw_spin_trylock+0x190/0x190
[  270.021267]  ? kstrdup_const+0x39/0x50
[  270.021287]  kstrdup+0x39/0x70
[  270.021302]  kstrdup_const+0x39/0x50
[  270.021316]  alloc_vfsmnt+0x1a5/0x9c0
[  270.021333]  ? mnt_free_id.isra.21+0x50/0x50
[  270.021350]  ? avc_has_extended_perms+0x12c0/0x12c0
[  270.021369]  ? avc_has_perm+0x43e/0x680
[  270.021393]  ? find_held_lock+0x39/0x1d0
[  270.021424]  ? lock_downgrade+0x980/0x980
[  270.021437]  ? __get_fs_type+0x22/0xc0
[  270.021449]  ? selinux_ipv4_output+0x40/0x40
[  270.021464]  ? module_unload_free+0x5b0/0x5b0
[  270.021476]  ? lock_release+0xda0/0xda0
[  270.021485]  ? _cond_resched+0x1d/0x30
[  270.021503]  ? selinux_mount+0x2bb/0x4e0
[  270.021522]  vfs_kern_mount.part.26+0x84/0x4a0
[  270.021539]  ? may_umount+0xa0/0xa0
[  270.021549]  ? _raw_read_unlock+0x22/0x30
[  270.021560]  ? __get_fs_type+0x8a/0xc0
[  270.021585]  do_mount+0xea4/0x2bb0
[  270.021619]  ? copy_mount_string+0x40/0x40
[  270.021631]  ? rcu_pm_notify+0xc0/0xc0
[  270.021659]  ? copy_mount_options+0x5f/0x2e0
[  270.021672]  ? rcu_read_lock_sched_held+0x108/0x120
[  270.021685]  ? kmem_cache_alloc_trace+0x459/0x750
[  270.021695]  ? kasan_check_write+0x14/0x20
[  270.021705]  ? _copy_from_user+0x99/0x110
[  270.021730]  ? copy_mount_options+0x1f4/0x2e0
[  270.021753]  compat_SyS_mount+0xd0/0x1070
[  270.021771]  ? show_fd_locks+0x2c0/0x2c0
[  270.021785]  do_fast_syscall_32+0x3ee/0xf9d
[  270.021811]  ? do_int80_syscall_32+0x9d0/0x9d0
[  270.021835]  ? lockdep_sys_exit+0x47/0xf0
[  270.021847]  ? syscall_return_slowpath+0x2ad/0x550
[  270.021866]  ? sysret32_from_system_call+0x5/0x3b
[  270.021887]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  270.021913]  entry_SYSENTER_compat+0x51/0x60
[  270.021920] RIP: 0023:0xf7fcbc79
[  270.021925] RSP: 002b:00000000f77c708c EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  270.021935] RAX: ffffffffffffffda RBX: 0000000020018000 RCX: 000000002002c000
[  270.021941] RDX: 000000002002cffa RSI: 0000000001000818 RDI: 000000002000a000
[  270.021946] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
2017/12/02 09:23:24 executing program 7:
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000005000)="2f6465762f62696e6465722300", 0x0, 0x0)
close(r0)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)="2f6465762f62696e6465722300", 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = mmap$binder(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000002000)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003000-0x30)={0x4c, 0x0, &(0x7f000000b000-0x4c)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x3, 0x11, 0x0, 0x0, 0x0, 0x8, &(0x7f000000a000)=[], &(0x7f0000006000-0x10)=[0x38]}}, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f000000b000-0xd7)=""})
mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff, 0x0, 0x0}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)=""})
mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000001000-0x18)={<r3=>0x0, 0x0, 0x0, 0x0})
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x108, 0x0, &(0x7f000000b000-0x108)=[@free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x0}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f000000b000)=[], &(0x7f000000e000-0x8)=[0x30]}}, @clear_death={0x400c630f, 0x0, 0x1}, @request_death={0x400c630e, 0x3, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000008000)=[@fda={0x66646185, 0x7, 0x0, 0x2e}], &(0x7f0000002000-0x10)=[0x78, 0x28]}}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000006000)=[@fda={0x66646185, 0x1, 0x3, 0x2d}], &(0x7f000000b000-0x18)=[0x78, 0x28, 0x78]}}], 0xeb, 0x0, &(0x7f0000010000-0xeb)="ef7e012f6dedee7f24f0f1408ca3662d07dd3b564a5f775291eb7cfd3c7303c239d60396a2b0d00c7ba73cdf425373ba6c0ed9c15ace0e07973b0a7a4e896178660036ead3c45e3db404d38c7f0abf8a7e1e2e710447f0ec93e717de20a81366c5f0b3c57795367a4fbafbdf474a87cbf7a4c1c1d785883bb7da6c67f03f21703efd5cd3de10a906355794d2fd44028a3501650048ae53bbccc20a6f9f2a05992946058324d71b64a7e7c389302d34fff8983fc8cf5f39af11cf4f5e9d6a75b820e0767c839fefc0220df5f72da23f52d4c73aa7df4388f5c736869601b251a8289e93bb8bbd7512d626a9"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f000000e000-0x18)={r2, 0x0, 0x0, 0x0})
2017/12/02 09:23:24 executing program 1:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_sctp(0xa, 0x805, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000224000-0x2c)=[@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}], 0x1c)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000ba0000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r1 = syz_open_dev$tun(&(0x7f00002d2000)="2f6465762f6e65742f74756e00", 0x0, 0x0)
ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000141000)=0x101)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000533000)={@generic="02000000040000000004008000e9bc22", @ifru_settings={0x10001, 0x0, @fr=&(0x7f0000013000-0x18)={0x0, 0x8000000000002, 0x3, 0xfffffffffffffffb, 0x81c7, 0x7fffffff, 0x26e}}})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000dd6000-0x8)={0xffffffffffffffff, 0xffffffffffffffff})
r2 = syz_open_dev$evdev(&(0x7f0000cc3000-0x12)="2f6465762f696e7075742f6576656e742300", 0x1, 0x80)
fallocate(r2, 0x3, 0x700000, 0x0)
2017/12/02 09:23:24 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
set_mempolicy(0x1, &(0x7f0000a07000-0x8)=0x3, 0x6)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
2017/12/02 09:23:24 executing program 5:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
2017/12/02 09:23:24 executing program 6 (fault-call:2 fault-nth:7):
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:24 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mq_timedreceive(r0, &(0x7f00002d3000)="0000000000000000", 0x8, 0x20000000, 0x0)
2017/12/02 09:23:24 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000c7000-0x4)=0xfffffffffffffffe, 0x4)
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r4 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r4, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r5=>0x0})
mq_timedsend(r4, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r5})
r6 = dup2(r3, r0)
ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
2017/12/02 09:23:24 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70746d7800", 0x2, 0x0)
epoll_create1(0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000843000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0})
ioctl$TCXONC(r0, 0x540a, 0x0)
poll(&(0x7f000065e000)=[{r0, 0x0, 0x0}], 0x1, 0x299f)
write(r0, &(0x7f0000caf000)="9c", 0x1)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000040fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCXONC(r0, 0x540a, 0x2)
ioctl$TCXONC(r0, 0x540a, 0x1)
[  270.021951] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  270.021955] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  270.957565] binder: 4389 RLIMIT_NICE not set
[  270.962120] binder: release 4386:4389 transaction 1821 in, still active
[  270.968920] binder: send failed reply for transaction 1821 to 4386:4401
[  270.975725] binder: undelivered TRANSACTION_COMPLETE
2017/12/02 09:23:24 executing program 6 (fault-call:2 fault-nth:8):
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000313000-0x8)="2e2f66696c653000", 0x0)
mount(&(0x7f0000018000)="2e2f66696c653000", &(0x7f000002c000)="2e2f66696c653000", &(0x7f000002d000-0x6)="72616d667300", 0x1000818, &(0x7f000000a000)="")
2017/12/02 09:23:24 executing program 0:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x0, &(0x7f000033f000-0x20)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mq_timedreceive(r0, &(0x7f00002d3000)="00", 0x1, 0x20000000, 0x0)
2017/12/02 09:23:24 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000ee4000)="2f6465762f7667615f6172626974657200", 0x0)
write(r0, &(0x7f0000372000)="23216164", 0x4)
set_mempolicy(0x1, &(0x7f0000a07000-0x8)=0x3, 0x6)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
execveat(r0, &(0x7f0000ff7000)="2e2f66696c653000", &(0x7f0000fc7000)=[], &(0x7f0000d4e000-0x8)=[&(0x7f0000ff7000)="0000000000000006080400200016fd0cf365643b79935b005f1b76"], 0x1000)
2017/12/02 09:23:24 executing program 2:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000271000)={0x2, 0x78, 0x45, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00008ab000-0x8)=0x8000000075)
openat$ptmx(0xffffffffffffff9c, &(0x7f00006c2000-0xa)="2f6465762f70746d7800", 0x80000, 0x0)
accept4$inet6(0xffffffffffffffff, &(0x7f0000273000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000b85000-0x4)=0x1c, 0x80000)
r1 = gettid()
r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket(0xfffffffffffffffc, 0x400000000000802, 0x0)
mq_getsetattr(r2, &(0x7f0000000000)={0x5982a8af, 0x3, 0x7fff, 0x7fffffff, 0x1, 0xff, 0x3, 0x3}, &(0x7f0000009000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbd000-0x38)={0x0, 0x0, &(0x7f0000fa4000-0x10)=[{&(0x7f000061d000-0x24)=[{0x18, 0x1a, 0x11, 0x0, 0x0, "0a04040800"}], 0x18}], 0x1, &(0x7f0000f93000)=[], 0x0, 0x0}, 0x0)
r4 = mq_open(&(0x7f0000d7e000)="6574683000", 0x842, 0x101, &(0x7f000033f000-0x20)={0x1ffd, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3})
mq_notify(r4, &(0x7f0000804000)={0x0, 0x1c, 0x8000000000000, @tid=r1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
clock_gettime(0x8, &(0x7f00004eb000-0x8)={0x0, <r5=>0x0})
mq_timedsend(r4, &(0x7f0000e91000-0x2)="77f9", 0x2, 0x1, &(0x7f0000c2d000-0x10)={0x77359400, r5})
r6 = dup2(r3, r0)
ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000927000)={0x1, &(0x7f00007b9000)=[{0x8d, 0x4, 0xd, 0xf1}]})
getegid()
[  270.994686] binder: 4438:4441 ERROR: BC_REGISTER_LOOPER called without request
[  270.994698] binder: 4441 RLIMIT_NICE not set
[  271.005957] FAULT_INJECTION: forcing a failure.
[  271.005957] name failslab, interval 1, probability 0, space 0, times 0
[  271.005968] CPU: 0 PID: 4447 Comm: syz-executor6 Not tainted 4.15.0-rc1+ #114
[  271.005975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  271.005978] Call Trace:
[  271.005991]  dump_stack+0x194/0x257
[  271.006017]  ? arch_local_irq_restore+0x53/0x53
[  271.006029]  ? check_noncircular+0x20/0x20
[  271.006061]  should_fail+0x8c0/0xa40
[  271.006080]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  271.006111]  ? find_held_lock+0x39/0x1d0
[  271.006145]  ? lock_downgrade+0x980/0x980
[  271.006186]  ? trace_event_raw_event_sched_switch+0x800/0x800
[  271.006194]  ? sget_userns+0x157/0xe20
[  271.006209]  ? rcu_note_context_switch+0x710/0x710
[  271.006235]  should_failslab+0xec/0x120
[  271.006249]  kmem_cache_alloc_trace+0x4b/0x750
[  271.006279]  sget_userns+0x2a3/0xe20
[  271.006286]  ? get_anon_bdev+0x2a0/0x2a0
[  271.006313]  ? destroy_unused_super.part.7+0xd0/0xd0
[  271.006325]  ? cred_has_capability+0x1a0/0x3d0
[  271.006339]  ? selinux_ipv4_output+0x40/0x40
[  271.006354]  ? free_pages+0x51/0x90
[  271.006366]  ? selinux_sb_copy_data+0x443/0x610
[  271.006392]  ? selinux_capable+0x36/0x40
[  271.006406]  ? security_capable+0x8e/0xc0
[  271.006417]  ? get_anon_bdev+0x2a0/0x2a0
[  271.006427]  ? ns_capable_common+0xcf/0x160
[  271.006439]  ? get_anon_bdev+0x2a0/0x2a0
[  271.006448]  sget+0xd2/0x120
[  271.006456]  ? __get_fs_type+0x22/0xc0
[  271.006469]  ? ramfs_symlink+0x150/0x150
[  271.006479]  mount_nodev+0x37/0x100
[  271.006495]  ramfs_mount+0x2c/0x40
[  271.006507]  mount_fs+0x66/0x2d0
[  271.006524]  vfs_kern_mount.part.26+0xc6/0x4a0
[  271.006548]  ? may_umount+0xa0/0xa0
[  271.006561]  ? _raw_read_unlock+0x22/0x30
[  271.006572]  ? __get_fs_type+0x8a/0xc0
[  271.006595]  do_mount+0xea4/0x2bb0
[  271.006617]  ? copy_mount_string+0x40/0x40
[  271.006627]  ? rcu_pm_notify+0xc0/0xc0
[  271.006652]  ? copy_mount_options+0x5f/0x2e0
[  271.006663]  ? rcu_read_lock_sched_held+0x108/0x120
[  271.006674]  ? kmem_cache_alloc_trace+0x459/0x750
[  271.006685]  ? kasan_check_write+0x14/0x20
[  271.006694]  ? _copy_from_user+0x99/0x110
[  271.006714]  ? copy_mount_options+0x1f4/0x2e0
[  271.006734]  compat_SyS_mount+0xd0/0x1070
[  271.006748]  ? show_fd_locks+0x2c0/0x2c0
[  271.006760]  do_fast_syscall_32+0x3ee/0xf9d
[  271.006779]  ? do_int80_syscall_32+0x9d0/0x9d0
[  271.006798]  ? lockdep_sys_exit+0x47/0xf0
[  271.006808]  ? syscall_return_slowpath+0x2ad/0x550
[  271.006823]  ? sysret32_from_system_call+0x5/0x3b
[  271.006841]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  271.006862]  entry_SYSENTER_compat+0x51/0x60
[  271.006869] RIP: 0023:0xf7fcbc79
[  271.006873] RSP: 002b:00000000f77c708c EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  271.006883] RAX: ffffffffffffffda RBX: 0000000020018000 RCX: 000000002002c000
[  271.006887] RDX: 000000002002cffa RSI: 0000000001000818 RDI: 000000002000a000
[  271.006891] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  271.006896] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  271.006901] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  271.034717] binder: 4441 RLIMIT_NICE not set
[  271.037322] binder: 4438:4441 ioctl c0306201 20002fd0 returned -14
[  271.039671] binder: 4438:4441 BC_FREE_BUFFER uffffffffffffffff no match
[  271.039703] binder: 4438:4441 IncRefs 0 refcount change on invalid ref 1 ret -22
[  271.039712] binder: 4438:4441 got transaction to invalid handle
[  271.039723] binder: 4438:4441 transaction failed 29201/-22, size 0-8 line 2755
[  271.039740] binder: 4438:4441 ioctl c0306201 20005fd0 returned -14
[  271.040067] binder: 4438:4441 ioctl c018620b 2000dfe8 returned -14
[  271.046716] FAULT_INJECTION: forcing a failure.
[  271.046716] name failslab, interval 1, probability 0, space 0, times 0
[  271.046745] CPU: 0 PID: 4462 Comm: syz-executor6 Not tainted 4.15.0-rc1+ #114
[  271.046751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  271.046754] Call Trace:
[  271.046767]  dump_stack+0x194/0x257
[  271.046789]  ? arch_local_irq_restore+0x53/0x53
[  271.046822]  should_fail+0x8c0/0xa40
[  271.046832]  ? wait_for_completion+0x7b0/0x7b0
[  271.046845]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  271.046871]  ? find_held_lock+0x39/0x1d0
[  271.046899]  ? __lock_is_held+0xbc/0x140
[  271.046930]  ? trace_event_raw_event_sched_switch+0x800/0x800
[  271.046941]  ? rcu_note_context_switch+0x710/0x710
[  271.046950]  ? rcu_note_context_switch+0x710/0x710
[  271.046972]  should_failslab+0xec/0x120
[  271.046984]  __kmalloc+0x63/0x760
[  271.046992]  ? lockdep_init_map+0x3d/0x70
[  271.047008]  ? debug_mutex_init+0x2d/0x60
[  271.047016]  ? __list_lru_init+0xcf/0x750
[  271.047034]  __list_lru_init+0xcf/0x750
[  271.047053]  ? memcg_destroy_list_lru_node.isra.7+0x110/0x110
[  271.047065]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  271.047072]  ? __lockdep_init_map+0xe4/0x650
[  271.047087]  ? lockdep_init_map+0x3d/0x70
[  271.047107]  sget_userns+0x64f/0xe20
[  271.047114]  ? get_anon_bdev+0x2a0/0x2a0
[  271.047138]  ? destroy_unused_super.part.7+0xd0/0xd0
[  271.047148]  ? cred_has_capability+0x1a0/0x3d0
[  271.047161]  ? selinux_ipv4_output+0x40/0x40
[  271.047174]  ? free_pages+0x51/0x90
[  271.047185]  ? selinux_sb_copy_data+0x443/0x610
[  271.047209]  ? selinux_capable+0x36/0x40
[  271.047221]  ? security_capable+0x8e/0xc0
[  271.047233]  ? get_anon_bdev+0x2a0/0x2a0
[  271.047242]  ? ns_capable_common+0xcf/0x160
[  271.047255]  ? get_anon_bdev+0x2a0/0x2a0
[  271.047264]  sget+0xd2/0x120
[  271.047272]  ? __get_fs_type+0x22/0xc0
[  271.047284]  ? ramfs_symlink+0x150/0x150
[  271.047294]  mount_nodev+0x37/0x100
[  271.047309]  ramfs_mount+0x2c/0x40
[  271.047321]  mount_fs+0x66/0x2d0
[  271.047337]  vfs_kern_mount.part.26+0xc6/0x4a0
[  271.047351]  ? may_umount+0xa0/0xa0
[  271.047359]  ? _raw_read_unlock+0x22/0x30
[  271.047368]  ? __get_fs_type+0x8a/0xc0
[  271.047387]  do_mount+0xea4/0x2bb0
[  271.047409]  ? copy_mount_string+0x40/0x40
[  271.047418]  ? rcu_pm_notify+0xc0/0xc0
[  271.047442]  ? copy_mount_options+0x5f/0x2e0
[  271.047452]  ? rcu_read_lock_sched_held+0x108/0x120
[  271.047462]  ? kmem_cache_alloc_trace+0x459/0x750
[  271.047470]  ? kasan_check_write+0x14/0x20
[  271.047479]  ? _copy_from_user+0x99/0x110
[  271.047500]  ? copy_mount_options+0x1f4/0x2e0
[  271.047517]  compat_SyS_mount+0xd0/0x1070
[  271.047536]  ? show_fd_locks+0x2c0/0x2c0
[  271.047549]  do_fast_syscall_32+0x3ee/0xf9d
[  271.047570]  ? do_int80_syscall_32+0x9d0/0x9d0
[  271.047583]  ? trace_event_raw_event_sys_exit+0x260/0x260
[  271.047596]  ? lockdep_sys_exit+0x47/0xf0
[  271.047605]  ? syscall_return_slowpath+0x2ad/0x550
[  271.047621]  ? sysret32_from_system_call+0x5/0x3b
[  271.047638]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  271.047659]  entry_SYSENTER_compat+0x51/0x60
[  271.047665] RIP: 0023:0xf7fcbc79
[  271.047669] RSP: 002b:00000000f77c708c EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  271.047678] RAX: ffffffffffffffda RBX: 0000000020018000 RCX: 000000002002c000
[  271.047682] RDX: 000000002002cffa RSI: 0000000001000818 RDI: 000000002000a000
[  271.047687] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  271.047691] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  271.047695] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  271.047779] ------------[ cut here ]------------
[  271.047781] DEBUG_LOCKS_WARN_ON(depth <= 0)
[  271.047825] WARNING: CPU: 0 PID: 4462 at kernel/locking/lockdep.c:3766 lock_release+0x5de/0xda0
[  271.047828] Kernel panic - not syncing: panic_on_warn set ...
[  271.047828] 
[  271.047834] CPU: 0 PID: 4462 Comm: syz-executor6 Not tainted 4.15.0-rc1+ #114
[  271.047838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  271.047839] Call Trace:
[  271.047846]  dump_stack+0x194/0x257
[  271.047853]  ? arch_local_irq_restore+0x53/0x53
[  271.047861]  ? vsnprintf+0x1ed/0x1900
[  271.047869]  panic+0x1e4/0x41c
[  271.047875]  ? refcount_error_report+0x214/0x214
[  271.047882]  ? show_regs_print_info+0x65/0x65
[  271.047890]  ? __warn+0x1c1/0x200
[  271.047898]  ? lock_release+0x5de/0xda0
[  271.047902]  __warn+0x1dc/0x200
[  271.047908]  ? lock_release+0x5de/0xda0
[  271.047917]  report_bug+0x211/0x2d0
[  271.047927]  fixup_bug.part.11+0x37/0x80
[  271.047933]  do_error_trap+0x2d7/0x3e0
[  271.047940]  ? __down_trylock_console_sem+0x10d/0x1e0
[  271.047948]  ? math_error+0x400/0x400
[  271.047953]  ? vprintk_emit+0x3ea/0x590
[  271.047964]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  271.047972]  do_invalid_op+0x1b/0x20
[  271.047977]  invalid_op+0x18/0x20
[  271.047983] RIP: 0010:lock_release+0x5de/0xda0
[  271.047987] RSP: 0018:ffff8801d3c2f588 EFLAGS: 00010086
[  271.047993] RAX: dffffc0000000008 RBX: 1ffff1003a785eb6 RCX: ffffffff8159c48e
[  271.047997] RDX: 0000000000010000 RSI: ffffc900035ae000 RDI: 0000000000000000
[  271.048000] RBP: ffff8801d3c2f6f8 R08: 0000000000000001 R09: 0000000000000000
[  271.048008] R10: ffff8801d65f4140 R11: fffffbfff0e8926b R12: ffff8801d3c2f5d0
[  271.048012] R13: ffff8801d3c2f6d0 R14: ffff8801c4564898 R15: ffffffff87489d60
[  271.048023]  ? vprintk_func+0x5e/0xc0
[  271.048032]  ? lock_release+0x5de/0xda0
[  271.048039]  ? destroy_unused_super.part.7+0x18/0xd0
[  271.048044]  ? lock_downgrade+0x980/0x980
[  271.048053]  ? rcu_read_lock_sched_held+0x108/0x120
[  271.048060]  ? __kmalloc+0x471/0x760
[  271.048066]  ? lockdep_init_map+0x3d/0x70
[  271.048074]  ? up_read+0x1a/0x40
[  271.048081]  ? memcg_put_cache_ids+0x10/0x20
[  271.048088]  ? __list_lru_init+0x35c/0x750
[  271.048096]  up_write+0x6b/0x120
[  271.048101]  ? up_read+0x40/0x40
[  271.048106]  ? __lockdep_init_map+0xe4/0x650
[  271.048114]  ? lockdep_init_map+0x3d/0x70
[  271.048121]  destroy_unused_super.part.7+0x18/0xd0
[  271.048128]  sget_userns+0x905/0xe20
[  271.048133]  ? get_anon_bdev+0x2a0/0x2a0
[  271.048144]  ? destroy_unused_super.part.7+0xd0/0xd0
[  271.048151]  ? cred_has_capability+0x1a0/0x3d0
[  271.048158]  ? selinux_ipv4_output+0x40/0x40
[  271.048165]  ? free_pages+0x51/0x90
[  271.048171]  ? selinux_sb_copy_data+0x443/0x610
[  271.048178]  ? selinux_capable+0x36/0x40
[  271.048183]  ? security_capable+0x8e/0xc0
[  271.048187]  ? get_anon_bdev+0x2a0/0x2a0
[  271.048192]  ? ns_capable_common+0xcf/0x160
[  271.048196]  ? get_anon_bdev+0x2a0/0x2a0
[  271.048201]  sget+0xd2/0x120
[  271.048207]  ? __get_fs_type+0x22/0xc0
[  271.048217]  ? ramfs_symlink+0x150/0x150
[  271.048225]  mount_nodev+0x37/0x100
[  271.048233]  ramfs_mount+0x2c/0x40
[  271.048239]  mount_fs+0x66/0x2d0
[  271.048245]  vfs_kern_mount.part.26+0xc6/0x4a0
[  271.048253]  ? may_umount+0xa0/0xa0
[  271.048258]  ? _raw_read_unlock+0x22/0x30
[  271.048264]  ? __get_fs_type+0x8a/0xc0
[  271.048271]  do_mount+0xea4/0x2bb0
[  271.048279]  ? copy_mount_string+0x40/0x40
[  271.048284]  ? rcu_pm_notify+0xc0/0xc0
[  271.048290] binder: 4438:4441 ioctl 40046205 0 returned -22
[  271.048295]  ? copy_mount_options+0x5f/0x2e0
[  271.048302]  ? rcu_read_lock_sched_held+0x108/0x120
[  271.048309]  ? kmem_cache_alloc_trace+0x459/0x750
[  271.048314]  ? kasan_check_write+0x14/0x20
[  271.048320]  ? _copy_from_user+0x99/0x110
[  271.048330]  ? copy_mount_options+0x1f4/0x2e0
[  271.048337]  compat_SyS_mount+0xd0/0x1070
[  271.048345]  ? show_fd_locks+0x2c0/0x2c0
[  271.048354]  do_fast_syscall_32+0x3ee/0xf9d
[  271.048365]  ? do_int80_syscall_32+0x9d0/0x9d0
[  271.048374]  ? trace_event_raw_event_sys_exit+0x260/0x260
[  271.048382]  ? lockdep_sys_exit+0x47/0xf0
[  271.048389]  ? syscall_return_slowpath+0x2ad/0x550
[  271.048398]  ? sysret32_from_system_call+0x5/0x3b
[  271.048407]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  271.048416]  entry_SYSENTER_compat+0x51/0x60
[  271.048420] RIP: 0023:0xf7fcbc79
[  271.048424] RSP: 002b:00000000f77c708c EFLAGS: 00000296 ORIG_RAX: 0000000000000015
[  271.048431] RAX: ffffffffffffffda RBX: 0000000020018000 RCX: 000000002002c000
[  271.048435] RDX: 000000002002cffa RSI: 0000000001000818 RDI: 000000002000a000
[  271.048438] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  271.048441] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  271.048444] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  271.048883] Dumping ftrace buffer:
[  271.048887]    (ftrace buffer empty)
[  271.048889] Kernel Offset: disabled
[  272.194428] Rebooting in 86400 seconds..